Privacy Policy

In this policy “we” means WinningSeller. It covers the data of three kinds of people:
• Merchants: anyone who opens a WinningSeller account and runs a shop, and their staff
• Buyers: anyone who orders at a merchant's shop
• Visitors: anyone who reads this website

Buyers' data is owned and controlled by the merchant concerned. We process it only on the merchant's behalf, to run their shop.

• Name, email, mobile number and password (we cannot read the password either; only its hash is stored)
• The shop's name, address, products, pictures, prices, buying prices, accounting entries and receipt photos
• Courier, Facebook and Fraud BD API keys and tokens (stored encrypted, never shown on screen)
• Payment details: which method, from which number, how much, and the transaction ID
• A log of who did what and when (such as order status changes), and the IP address and browser type for security
• One session cookie that keeps you signed in to the admin

• Name, mobile number, address, delivery area, order details and notes
• The IP address and browser details at the time of the order (against fake orders)
• Which link or ad they came from (utm and fbclid), and Facebook's cookies (_fbp, _fbc) when the merchant has the Facebook Pixel on
• With the Pixel on: the page view event goes from the buyer's browser to Facebook; product view, add-to-cart and checkout-start events go from the browser and from our server with the IP address and browser details; and the Purchase event goes from our server, with the buyer's phone number and name as SHA-256 hashes (from the browser too when the shop sends it the moment the order is placed)

A merchant's shop pages set no cookies of our own. The cart and the ad source stay in the buyer's own browser and reach the server only when they order.

This website sets no cookies of our own either, except one small cookie (ws_lang) when you choose a language with the switch, so you are not sent to the other language again. If our Facebook Pixel is on here to measure our own advertising, Facebook sets its cookies (_fbp, _fbc) in your browser and events such as page views go to Facebook with your IP address and browser details.

• To run the service: showing the shop, taking orders, sending parcels, showing the accounts
• For security and against fake orders
• To match bills and payments
• To give support and send important notices
• To measure our own advertising (section 6 below)
• To comply with the law

We do not sell anyone's data, and we never use merchants' buyers' data for our own advertising or anything else.

Only the services a merchant switches on themselves, and only as much as needed:
• Couriers (Steadfast, Pathao, RedX): the buyer's name, number, address and amount, for the parcel
• Facebook (Meta): events that measure advertising; phone numbers and names are sent as SHA-256 hashes
• Steadfast, Pathao or Fraud BD: the buyer's mobile number, to see their past parcel record

For our own advertising: when our Facebook Pixel is on here and someone opens an account, one 'CompleteRegistration' event goes from our server to Facebook (Meta), with their email, mobile number and name (SHA-256 hashed), the IP address at sign-up, browser details and Facebook's cookies (_fbp, _fbc).

For servers and backups: our server is rented in Singapore, and an encrypted backup of it is taken every day. An email delivery service may be used to send email. These only store or carry data on our behalf.

We may hand data to the proper authorities when the law obliges us to.

• Each shop's data is kept apart; no shop can see another's
• API keys and tokens are stored encrypted; backups are encrypted too
• Buying prices and profit are seen only by the people a merchant allows
• To give support, our super admins can open any shop with the owner's rights; we record who opened which shop on which day

Even so, nothing on the internet is completely safe. If we learn of a data breach, we will tell the merchants concerned quickly.

Whether a shop is open or paused after its term, its data is not deleted by itself, so that everything is back when you pay again.

To have it deleted, the shop's owner writes to the email or phone below. After checking that it is the owner, we delete the shop's data within 10 working days. Copies in backups disappear by themselves within about 8 weeks. Payment records (how much, when, by which method) may be kept as long as the law requires for legal or accounting reasons.

As a merchant you can see your data, correct it, ask for a copy or ask for it to be deleted. If you ask for a copy, we email your shop's data (for example orders and products as CSV files) within 10 working days.

As a buyer, to see or change your data, contact the shop you bought from; we will help that shop when needed.

This service is not for anyone under 18 to open an account.

When the policy changes we show it here with the date; a major change is also announced in the admin or by email.