Privacy Policy

1. Who we are

Boneek Courier is a managed courier gateway in Bangladesh, run by Boneek. This policy explains what personal data we collect, why, who we share it with, how long we keep it and what you can do about it. It covers the merchant dashboard, the Boneek rider and hub screens, the public tracking pages, and the Boneek Courier API.

For your buyers' data, you (the merchant) decide why it is collected, and Boneek processes it to deliver your parcels. For your own account data, Boneek decides how it is used, as described here.

2. What we collect

About your business: business name, phone, email, address, pickup addresses (with map pins if you add them), business category, logo, website or Facebook page, and payout accounts (bKash, Nagad or bank: account name, number, bank and branch).

About the people on your team: name, phone and email from your Boneek account, role, and an activity log of what each person did in the dashboard. Sign-in is through your Boneek account; we don't store your Boneek password.

For business verification (KYC): the owner's National ID number and photos, and, for registered businesses, trade license, e-TIN or VAT BIN.

About your buyers: name, phone number, delivery address, the COD amount and what you tell us about the parcel (description, value, weight, notes). When a buyer uses a tracking or delivery-preference page, we record what they choose (for example a new delivery date) and when.

About parcels: every status change, who held the parcel (our rider, our hub, the delivery partner), hub weight and photo, delivery proof and the money collected.

Technical data: sign-in sessions, IP address and browser on sign-in and API requests, API request logs (kept so you can debug your integration), and essential cookies that keep you signed in. We don't use advertising cookies.

3. Why we use it

To pick up, sort, hand over, deliver and return parcels; to contact buyers about their delivery; to collect COD and pay you; to charge our rate card and keep your passbook; to support you and settle disputes; to verify businesses and prevent fraud (for example, spotting buyers who refuse many parcels across shops, without showing their names or phones to other shops); to meet accounting, tax and other legal duties; and to improve routing (which delivery partner delivers best in an area).

4. Who we share it with

The delivery partner carrying the parcel. Boneek hands each parcel to one delivery partner (Pathao, Steadfast, RedX, Paperfly, Sundarban, eCourier or Delivery Tiger). That partner receives only the fields it needs to deliver that parcel: buyer name, phone, address, COD amount, weight and handling notes. The parcel page shows which partner has it. If we move a parcel to another partner, the new partner receives the same fields and the old one stops getting updates.

Service providers who help us run Boneek Courier: SMS and WhatsApp gateways (to send delivery messages and sign-in codes), banks and mobile financial services (bKash, Nagad, our bank) to pay you, and hosting providers. They may use the data only to provide that service to us.

Boneek and connected partners you use. If you joined through your online store on Boneek, your store and Boneek Courier share the orders and shipment updates you send between them, so both show the same parcel. Partners you connect (for example a dropshipping platform) receive only the parcels you ship through them.

Authorities, when the law requires it, or to protect people from harm or fraud.

We never sell personal data, and we never give your buyer list to another merchant.

5. How long we keep it

One-time sign-in codes: 7 days. Other SMS and messages: 90 days. KYC documents: 5 years after your account closes. Money records (passbook, withdrawals, statements, invoices): permanently, as accounting and tax law requires. Parcel records: as long as your account is open, then as long as the money records they belong to.

When a buyer's data is erased on request, we keep only what money records need (the parcel, the amount and the date), with the name, phone and address removed.

6. How we protect it

Data is encrypted in transit. Team roles control who on your team sees what, and you can hide buyer details from some roles. Boneek staff see buyer details only when their job needs it, and their access is logged. Webhooks are signed, and API keys are shown once and can be revoked any time.

7. Your rights and choices

Download your data: Settings > Your account > Download your data.

Correct your data: edit business details, pickup addresses and payout accounts in Settings. Your name, phone and email come from your Boneek account and are changed there.

Close your account: Settings > Your account. We close it once no parcels are on the way and nothing is owed, and we refund your balance first.

Buyers can ask us to correct or erase their details, or dispute a record, at /privacy/request. We reply within 30 days.

You can choose which notifications you get in Settings. Messages about a parcel on its way and sign-in codes can't be turned off.

8. Children

Boneek Courier is for businesses. Account holders must be at least 18. We don't knowingly collect data about children, except a buyer's name and address that a merchant gives us for delivery.

9. Where the data is stored

We store data with hosting providers that may keep it outside Bangladesh. Wherever it is stored, this policy applies and we require the same protection from those providers.

10. Changes to this policy

When we change this policy we update the version line at the top and tell you in the dashboard. If a change affects how we share your or your buyers' data, we tell you before it applies.

11. Contact

Questions about privacy: open a ticket from Help & tickets in your dashboard and choose "Privacy". Buyers: use /privacy/request. This policy is governed by the laws of the People's Republic of Bangladesh.