Privacy Policy

We collect the information you give us when you create an account and use Tukri — such as your name, email address, phone number, shop details, and the business records you enter. We also collect basic technical data, like device and usage information, to keep the service running and secure.

We use your information to provide and improve the app, process payments, send you important service messages, and offer support. We do not sell your personal information.

The sales, stock and customer records you enter belong to you. We store them securely so you can reach them from any device, and you can export them at any time.

We share data only with service providers that help us run Tukri (such as payment and messaging partners), and only as needed to deliver the service — or where the law requires it.

On our public website (tukri.bd, its blog, guides and Help Center) we use Google Analytics, through Google Tag Manager, to count visits and see which pages and links people use. We also use Microsoft Clarity to see how the pages are used, such as where people click and scroll, including recordings of visits in which the text people type is hidden. Both set cookies on your device. In the European Economic Area, the UK and Switzerland they run without analytics cookies unless you consent.

A cookie on your own device also keeps which link or website first brought you to Tukri: the campaign tags on the link, the name of the website you came from and the page you landed on, never the full address you came from. If you create an account, we store this with it, together with Google Analytics' random identifier for your browser, so that we can tell which of our posts, ads and partners bring us shops. When you set up a shop we may ask where you heard about Tukri; answering is optional.

None of this runs inside the Tukri app once you are signed in. No analytics or advertising script is loaded on the app's screens, so your shop's sales, stock and customer records are never sent to Google or Microsoft. From our own server we tell Google Analytics that an account was created, a shop was set up or a plan was paid for, without your name, email address, phone number or shop details.

How Google uses this data: How Google uses information from sites or apps that use our services. How Microsoft uses it: the Microsoft Privacy Statement. You can block or delete cookies in your browser's settings at any time, and opt out of Google Analytics with Google's browser add-on at tools.google.com/dlpage/gaoptout.

If a shop connects its Facebook Page, Instagram account or Telegram bot to Tukri, we receive the messages its customers send to that Page, account or bot, and the replies sent back, so the shop can read and answer them in Tukri. With each conversation we keep the chat ID the platform gives us and, where Telegram, Facebook or Instagram provides it, the sender's name (on Instagram, also their username). We store the text of messages, and the link to a post or reel a customer shares on Instagram. A photo or voice message a customer sends is downloaded only while automatic replies are on, so that our AI service provider can read the photo or write down what the voice message says; we keep that written text with the conversation, and never keep the photo, the recording or any other file. When a customer mentions a shop in an Instagram story, we keep only a note that they did, never the story itself. If a customer unsends an Instagram message, we delete it from Tukri too. If a customer places an order in the chat, the name, phone number and delivery address they type are saved with the order for the shop to review.

If a shop also turns on answering comments for its Facebook Page, we receive the comments people leave on that Page's posts. For each comment we keep the commenter's name where Facebook provides it, the comment's text, a link to the post and, when Facebook lets us read the post, the start of its text. The comment, with the post's text and main picture, is sent to our AI service provider to write one private Messenger reply to the person who commented; the picture is never stored. We delete these comments 90 days after they arrive.

A shop can also connect a person's own Telegram account to its bot (Telegram Business). We then receive the messages in the private chats that account lets the bot see — from the people who write to it and from the account itself — but only after someone in the shop approves the account; until then we keep nothing from its chats. We store and answer them as we do the bot's own chats, and replies go out as that account. If a message in one of those chats is deleted, we delete it from Tukri too. We keep the account's Telegram user ID, name and username so the shop can see whose account it is.

When the shop has switched automatic replies on, the message (including a photo or voice message), the recent conversation and the shop's own product information and notes are sent to our AI service provider, which processes them on our behalf to write the reply. Automatic replies say that they come from an automated assistant, and a customer can ask for a person at any time.

We delete these conversations automatically 90 days after their last message, together with any order the shop did not accept. An order the shop accepts becomes one of its sales and is kept like any other sale record.

A connected Page's, Instagram account's or bot's access token is stored encrypted and deleted when the shop disconnects it. We also keep the Facebook user ID of the person who connected a Page or an Instagram account, so that we can act on Facebook's requests to remove the app or delete data.

To have this data deleted: a shop can disconnect its Page, Instagram account or bot, or remove a personal Telegram account, under Settings → Social Commerce; a person who connected a Facebook Page or an Instagram account can remove Tukri in their Facebook settings, and we then disconnect it and delete its token automatically; a person whose Telegram account is connected can remove the bot in Telegram's own settings; and anyone can email us at the address below to ask for their messages to be deleted.

We send two kinds of email, and they are kept apart on purpose. Account email — receipts, invoices, renewal and failed-payment notices, email verification, password resets and team invitations — is part of the service, arrives whatever your settings say, and cannot be unsubscribed from while your account is open. Product announcements — new features, pricing changes, maintenance notices and offers — are optional and are sent only to people who have asked for them.

You opt in to announcements by ticking the box when you create your account, or by turning them on later under Settings → Profile. We record the date and how you gave it. You can switch them off in the same place, or use the unsubscribe link at the foot of any announcement — including your mail provider's own one-click unsubscribe button — and we stop immediately. Opting out never affects your account email.

Announcements are sent from news.tukri.bd using Amazon Web Services (Amazon SES) as our delivery provider, which processes the recipient address and delivery result on our behalf. If an address bounces permanently or someone reports a message as spam, we add that address to a permanent internal suppression list and never mail it again.

Full details of how we send, what we record and how to stop it are on our Email policy page.

We use industry-standard measures to protect your data. You can update your details, export your data, or request deletion of your account at any time.