Privacy Policy

Dokan (dokan.gg) is a marketplace: independent sellers run stores on it and sell to you directly. Dokan runs the website, your account and the order system. [Legal entity name, registered address and trade licence number to be added.]

For your account and the marketplace itself, Dokan decides how your information is used. When you order from a seller, that seller also receives what they need to deliver the order (see section 4) and is responsible for using it only for that.

Your account. Your name, email address and password (we only keep a one-way hash of it, never the password itself). If you sign in with Google, the Google account ID, name, email address and profile photo Google shares with us. If you turn on two-step sign-in, its secret is stored encrypted and its recovery codes only as hashes. We also record when you agreed to these terms and which version.

Sign-ins. For each device you're signed in on: a description of the browser (its user agent), the IP address it signed in from and when it was last used, so you can be signed out everywhere and so stolen sessions can be detected.

Addresses. The names, phone numbers, email addresses and delivery addresses you save.

Orders. What you ordered, prices, delivery fee, the VAT included, your notes, a copy of the delivery address at the time of the order and the order's progress. For some cash-on-delivery orders (large amounts, new accounts) we text a code to the delivery phone; the code is stored only as a hash and expires within an hour, and we remember that the number was confirmed.

Returns, disputes, reviews and reports. What you write in them. Reviews are public and show your name.

Sellers. Store details; the business verification you submit (ID numbers and documents are stored encrypted and seen only by Dokan staff who review them); payout account details (encrypted) and courier account credentials (encrypted).

Technical records. Each request to our servers is logged with its path, result, timing and the account making it (not your IP address). Security-sensitive actions, such as staff changes to orders, stores and payouts, are recorded in an audit log with the IP address. When something breaks we may send an error report to our error-tracking service; these reports never include cookies, sign-in headers or what you typed into forms.

• To run your account and sign you in securely (needed to provide the service you asked for).
• To take, deliver, return and refund orders, and to settle disputes between you and sellers (needed to perform the contract).
• To prevent fraud and abuse: limits on how many orders an account or phone number can place, phone confirmation for risky cash-on-delivery orders, and checks on sellers before their store goes live (legitimate interest in a safe marketplace).
• To send emails about your account and orders. Sellers can switch optional emails off in their settings.
• To keep records that tax and consumer law require (legal obligation).

We don't sell your information and we don't show advertising based on it.

• The seller you order from sees your name, the delivery phone and address, and what you ordered. They see only part of your email address. Once an order has been finished for 90 days, the seller no longer sees its phone number or street address.
• Couriers (Steadfast, Pathao or RedX) receive the recipient's name, phone, address and the amount to collect when the seller books delivery through Dokan.
• Service providers that run parts of Dokan for us, only for that purpose: MongoDB Atlas (database hosting), SendGrid (email delivery), our SMS provider (phone confirmation codes), Google (if you choose Google sign-in) and our error-tracking service.
• Images. Product and store photos uploaded by sellers are stored on a public IPFS gateway. Anyone can view them and they can't be fully deleted, so they should never show people or personal documents.
• Authorities, when the law requires us to, or to protect people from fraud or harm.

Some of these providers store data outside Bangladesh. [Legal review: confirm the transfer basis required by Bangladesh's data protection rules.]

We use two cookies to keep you signed in. They can't be read by scripts on the page and are needed for signing in to work, so there's no option to turn them off. There are no advertising or analytics cookies.

Your cart, your saved items and a copy of your basic profile (to show your name) are kept in your browser's storage, not on our servers, until you sign out or clear it.

• Your account: until you close it.
• Sign-ins: until the session expires or you sign out.
• Phone confirmation codes: up to an hour.
• Orders, returns and disputes: kept after you close your account, because sellers and Dokan must keep records of sales, with your email replaced and your name shown as “Deleted user”. [Legal review: confirm the retention period tax law requires.]
• Seller verification records: while the store operates, then as long as the law requires.
• Audit logs: kept for security and can't be edited.
• Backups: deleted information can remain in encrypted backups until they're replaced.

• See and download your data: on your profile, choose “Download my data” to get everything we hold about your account, addresses, orders, returns, reviews and disputes as a file.
• Correct it: change your name on your profile and your addresses at any time.
• Delete it: on your profile, choose “Close my account”. Your sign-in details, addresses, confirmed phone numbers and notifications are removed and you're signed out everywhere; order records are kept as described above. Orders still on their way, returns and disputes need to finish first. Seller accounts are closed by our team, because stores, payouts and verification records have to be settled.
• Ask or complain: email support@dokan.gg. We answer within 30 days.

Connections are encrypted, passwords are hashed, payout details, courier credentials, verification documents and two-step secrets are encrypted in the database, and staff tools need two-step sign-in. No system is perfectly secure; if a breach puts you at risk, we'll tell you and the authorities as the law requires.

You must be at least 18 to create an account. We don't knowingly collect information about children.

Each version is dated at the top of this page. If we change what we collect or who we share it with, we'll ask you to agree to the new version when you next sign in. See also our Terms and Conditions.