Legal
Privacy Policy
Last updated: July 4, 2026
This policy is written to meet internationally recognized privacy standards (including principles from the EU/UK GDPR, the CCPA/CPRA, the Facebook/Meta Platform Terms and Data Policy, and the Google API Services User Data Policy) and applies to everyone who visits folghor.com, places an order, messages us on Facebook Messenger, or signs in with Google.
1. Overview
FolGhor (“FolGhor”, “we”, “us”, or “our”) operates the folghor.com website and its associated Facebook Page and Messenger channel (together, the “Services”) to sell fresh fruits, dates, and Deshi ghee to customers, principally in Bangladesh. We are the data controller responsible for your personal information under this policy.
We process personal data in line with the principles of purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, and accountability — regardless of where you are located.
2. Information we collect
Information you give us:
- Name, phone number, delivery address, and email when you register, order, or fill in a form
- Account credentials (password is stored as a salted hash, never in plain text)
- Order history, product preferences, and packaging/delivery instructions
- Payment information, handled directly by our payment processor (Stripe) — we never see or store full card numbers
- Content of messages you send us via Facebook Messenger, contact forms, email, or phone
- Your Facebook name and profile picture, shared with us when you message our Page, per Meta's Messenger Platform
Information from sign-in providers:
- If you use “Sign in with Google”, we receive your name, email address, and profile picture from Google to create and authenticate your account
Information collected automatically:
- IP address, device/browser type, referring URL, pages viewed, and approximate location (city-level)
- Cookies and similar identifiers described in Section 5
3. How we use information
- Create and manage your account; process, fulfil, and deliver orders (including sharing your address/phone with our courier partner)
- Communicate about orders, delivery status, support requests, and account activity
- Respond to messages sent via Facebook Messenger and, where a customer sends an “Order Details” message, convert it into an order after staff review
- Operate, secure, and improve the Services, including diagnosing technical issues
- Measure site performance and marketing effectiveness through analytics and advertising pixels
- Send order-related and, with your consent or where permitted by law, marketing communications — you can opt out at any time
- Detect, investigate, and prevent fraud, abuse, and security incidents
- Comply with legal, tax, and regulatory obligations
4. Legal basis for processing
Where GDPR-equivalent laws apply, we rely on the following legal bases: contract (to take and fulfil your order or provide your account), legitimate interests (site security, fraud prevention, product improvement, first-party marketing to existing customers), consent (optional cookies, marketing communications, Messenger conversations you initiate), and legal obligation (tax and accounting records). You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
6. Facebook / Meta Platform data
We use Meta's Messenger Platform to let customers message our Page and place orders, and the Meta Pixel to measure the effectiveness of our advertising. Our use of these tools complies with Meta's Platform Terms and Data Policy.
- When you message our Page, we receive and store your Page-Scoped ID (PSID), name, profile picture, and message content, so our team can reply and, if you place an order through Messenger, fulfil it
- We request only the minimum Messenger permissions needed (
pages_messaging,pages_read_engagement,pages_manage_metadata) and do not use Messenger data for purposes unrelated to customer conversations and order fulfilment - The Meta Pixel sends browsing and conversion events (e.g. page views, purchases) to Meta, which Meta may combine with your Facebook account. See Meta's Data Policy at facebook.com/privacy/policy for how Meta processes this data
- Page access tokens are encrypted at rest and are never exposed to customers
Data deletion:you can ask Meta to review what it shares with apps via your Facebook “Apps and Websites” settings, or request deletion of the Messenger data we hold about you directly — see Section 13.
7. Google services & Google Sign-In
We offer “Sign in with Google” as an optional way to create and access your account, and we use Google Analytics to understand site traffic. Our access to and use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we only request your basic profile (name, email, profile picture) to authenticate you, we do not sell this information, we do not use it for advertising, and we do not allow humans to read it except as necessary for security, legal compliance, or with your consent.
Google Analytics collects pseudonymous usage data (pages viewed, session duration, device/browser type) via a client-side identifier. You can opt out using the Google Analytics Opt-out Browser Add-on.
9. International data transfers
We are based in Bangladesh; some of our service providers (e.g. Google, Meta, Stripe, PostHog, Cloudinary) process data on servers located outside your country, including in the United States and the European Union. Where required, we rely on the provider's own compliance mechanisms (such as EU Standard Contractual Clauses) to safeguard data transferred internationally.
10. Data retention
We keep account and order data for as long as your account is active and afterward as needed to comply with tax, accounting, and consumer-protection obligations (typically up to 6 years after your last order). Messenger conversation data is retained to support ongoing customer service and is deleted or anonymized on request (see Section 13) or after prolonged inactivity. Analytics and advertising identifiers are retained per each provider's default window (e.g. GA4: 14 months) unless you opt out sooner.
11. Data security
We use technical and organizational safeguards appropriate to the sensitivity of the data, including encryption in transit (TLS), encryption at rest for sensitive credentials (e.g. Messenger page access tokens, AES-256-GCM), hashed passwords, and access controls limiting staff access to what their role requires. No method of transmission or storage is 100% secure; if we become aware of a breach affecting your personal data, we will notify affected users and relevant authorities as required by applicable law.
12. Your rights & how to exercise them
Depending on your location, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Delete your data (“right to be forgotten”)
- Restrict or object to certain processing, including marketing and profiling
- Port your data to another service in a structured format
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with your local data protection authority
To exercise any of these rights, update your details from your account page or contact us using the details in Section 17. We will respond within 30 days (or sooner where local law requires) and may need to verify your identity before acting on a request.
13. Deleting your data
You can request deletion of your account and personal data at any time by emailing engg.zahidulislam@gmail.comwith the subject line “Data Deletion Request” and the email, phone number, or Messenger name associated with your data. We will confirm once your data has been deleted or anonymized, except where we must retain limited records (e.g. completed transactions) to meet legal or accounting obligations.
If you contact us via Facebook, Meta may also route a “Remove App” request from your Facebook settings to our automated Data Deletion Request Callback, which processes the request and returns a confirmation code and status page automatically.
14. Children's privacy
Our Services are not directed to children under 13 (or the minimum age required by local law), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it.
15. Do Not Track / Global Privacy Control
Some browsers send a “Do Not Track” or Global Privacy Control signal. There is no common industry standard for responding to these signals yet, so our Services do not currently change behavior when one is received; you can still control tracking directly through the cookie and provider opt-outs described in Section 5.
16. Changes to this policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will post the revised policy here with an updated “Last updated” date, and where changes are material, we will provide additional notice (e.g. by email or an in-app notice).
17. Contact us
For questions about this Privacy Policy or to exercise your rights, contact us at engg.zahidulislam@gmail.com or by phone at +880 1521‑360032. We are the data controller for personal information collected through the Services described in this policy.