Privacy Policy

1. Data We Collect

Account data: Your name, email, company name, password (hashed). Billing data: Invoice numbers, payment TrxIDs, sender phone (last 4 digits). Usage data: Campaign content, contact lists, engagement events (opens, clicks). Technical data: IP address, browser type, login timestamps.

2. How We Use Your Data

• To provide the Service (sending emails, tracking, analytics)
• To verify payments and prevent fraud
• To communicate with you about your account
• To improve product quality and detect abuse
• To comply with legal obligations

3. Data Sharing

We do NOT sell your data. We share data only with:

• Infrastructure providers (SMTP relays, hosting, databases) under DPAs
• Authorities when legally compelled
• Your team members when you invite them

4. Your Rights (GDPR + BD Data Protection Act 2023)

• Access: request a copy of your data
• Rectification: correct inaccurate data
• Erasure: request deletion ("right to be forgotten")
• Portability: export your data in machine-readable format
• Objection: opt out of marketing communications

To exercise these rights, email privacy@rootcodebd.com.

5. Data Retention

Account data is retained while your account is active. After suspension, data is retained for 60 days then permanently deleted. Engagement events (opens, clicks) are aggregated and anonymized after 90 days.

6. Security

Data is encrypted at rest. PII fields use additional field-level encryption. Backups are encrypted and retained for 30 days. We undergo annual security reviews.

7. Cookies

We use essential cookies (session, CSRF) and analytics cookies (PostHog, self-hosted). You can disable analytics cookies without affecting functionality.

8. Contact

RootCode BD · Dhaka, Bangladesh · privacy@rootcodebd.com