Privacy policy

• Account details: your name, email address, phone number, shop name, a short bio and country, and a password, which we store only as a one-way hash.
• Sign-in and security: the device sessions you're signed in on (IP address and browser or app name), two-factor secrets and recovery codes, and the public keys of passkeys you register. Fingerprint and face data never leave your phone.
• Payout details: the bKash, Nagad or bank account you ask us to pay you to. These are encrypted before they are stored.
• Orders and customers: the products you sell and, for each order, the buyer name, phone, email, delivery address and notes that you enter so we can deliver it.
• Payments: the amount, status and transaction ID of each payment you make through bKash. We never see or store your bKash PIN.
• Photos you upload: for example, evidence for a return request or artwork for custom packaging. The app asks before using your camera or photos and only takes the images you pick.
• Support conversations: the messages you send in Support, and any files the assistant makes for you there.
• Notifications: if you allow them, a push token that lets us send order and payout updates to your phone.

We don't collect your location or contacts, we don't use advertising IDs, and we don't run advertising or third-party tracking.

• To run your account and the service: to place and deliver orders, take payments, pay out your earnings and keep the ledger.
• To keep accounts safe: to sign you in, detect abuse, limit repeated attempts and keep an audit trail of sensitive actions.
• To contact you about your account, orders, payouts and support requests.
• To meet legal, tax and accounting duties.

We don't sell your personal data or share it for advertising.

We share data only with the services that run R SLASH, and only what each one needs:

• Hosting and file storage: our servers, database and file storage.
• bKash: to process the payments you make.
• Email delivery: to send confirmation, security and account emails.
• Push delivery: Expo's push service, Google Firebase Cloud Messaging and Apple Push Notification service.
• AI assistant: support messages go to AI model providers (Google Gemini, Groq or OpenRouter) so the assistant can answer. You can always ask for a person instead.
• Suppliers and couriers: they get the delivery details of the orders they fulfil.

We also disclose data when the law requires it.

All traffic to the website and the app is encrypted with HTTPS. Payout details and two-factor secrets are encrypted at rest, and passwords are hashed. Staff access is limited by role and permission, and every sensitive action is logged. The app stores your sign-in only in the phone's secure storage and blocks screenshots on payout and security screens.

We keep your data while your account is open. When you delete your account, we close it straight away and erase your personal data. We keep only the order, payment and ledger records the law requires us to keep for accounting and tax purposes.

• You can see and edit your profile and payout details in Settings.
• You can sign out of other devices, and turn off notifications in your phone's settings.
• You can delete your account at any time. See how to delete your account.
• You can email us for a copy of your data or to correct it.

R SLASH is a business service for adults. We don't knowingly collect data from anyone under 18.

If we change this policy, we'll update the date at the top. For significant changes, we'll also tell you in the app or by email.