This policy describes what personal data Muna (muna.bd) collects, why, and what we do with it. It applies to the muna.bd website and PWA.
1. What we collect
You give us:
- Account details: name, email address, phone number, password (stored only as a secure hash), optional profile photo.
- Delivery addresses: name, phone, address lines and your chosen division, district, upazila and union.
- Order details: what you bought, the payment method, and transaction references from bKash or Nagad. We never see or store your wallet PIN.
- Content you submit: product reviews and review photos, questions, support tickets and their attachments, ratings.
- Preferences: language, notification settings, and your marketing opt-ins for email, SMS and push notifications, which are three separate choices.
Collected automatically:
- Order and account activity, such as status history and the store-credit ledger.
- Security records: sign-in attempts and one-time code verifications, including the IP address they came from. These protect your account and are never used for marketing.
- Session data (see §4).
Guest checkout: if you order without an account we collect only what the order needs, meaning name, phone, email and address, and give you a private tracking link for that order.
2. What we use it for
- Fulfilling orders: taking payment, booking couriers, and sending the updates you would expect, such as the receipt, delivery notices and refund confirmations.
- Order verification: for cash-on-delivery orders we may place an automated confirmation call to your number.
- Account features: order history, wishlist, price and stock alerts, store credit, support tickets.
- Service messages by email and SMS. SMS is kept to a minimum: a payment reminder when money is due, a failed-delivery notice, one-time codes, and cash-on-delivery amount changes. Everything else arrives on the site or by email.
- Marketing, but only with your opt-in, which you give when you register and can change at any time in My Account under Settings, then Notifications.
- Security and abuse prevention: rate limiting, fraud checks, protecting accounts.
3. Who we share it with
We share data only with the services needed to run the shop:
- Couriers that carry your order: your name, phone, address, and the amount to collect for cash on delivery. For a cash on delivery order we may also share the phone number with a courier partner before the parcel is booked, to see how earlier deliveries to that number went.
- Payment providers such as bKash, Nagad and our online payment gateway: the amount and references needed to process or refund a payment.
- SMS and email delivery providers: your number or address, and the message.
- Error monitoring: when something breaks, technical error reports may include incidental request data.
- Advertising measurement: we run no third-party tracking scripts in your browser. Where server-side conversion measurement is enabled, we report purchase events from our own server, and any identifiers included are hashed as those platforms require.
We never sell your personal data.
4. Cookies & sessions
muna.bd uses first-party cookies only, and only for what the site needs: keeping you signed in, remembering your cart and language, and security. We do not use third-party advertising cookies.
5. Retention
- Order and payment records are kept as long as accounting and legal obligations require.
- Expired one-time codes, abandoned guest carts and old technical logs are deleted automatically on a schedule.
- If you ask us to close your account (§6), you can no longer sign in and we stop sending you messages. The order and payment records we are obliged to keep are retained.
6. Your choices & rights
- See and edit your profile, addresses and preferences in My Account.
- Manage the alerts you asked for, such as price drops and back-in-stock notices, in My Account, and remove any of them whenever you like.
- Change your marketing choices in My Account, under Settings, then Notifications. Email, SMS and push are three separate switches. The same page controls whether product alerts reach you by email, and whether this device receives push notifications at all, which is a different thing from agreeing to marketing on it.
- Close your account. Tell us in the Help center and we will close it for you: you will not be able to sign in again, and we will stop sending you messages. Closing an account is not the same as erasing its records. Your order, payment and store credit history forms part of our accounting records and is kept, as described in §5.
- Ask us anything else about your data, including for a copy or a correction of what we hold.
7. Security
Passwords are stored hashed, never in plain text. Two-factor authentication is available in account settings. Changing your password signs out every other session automatically. Access to customer data inside Muna is role-restricted, and sign-in attempts are rate limited.
No system is perfectly secure. If we learn of a breach affecting your data, we will inform you as the law requires.
8. Children
Our products are for children; our customers are their adults. You must be 18 or older to create an account or place an order.
9. Changes
We may update this policy as the service changes. The date at the top always reflects the current version, and material changes will be announced on the site.