Privacy Policy

We collect three categories of information:

• Account information — your name, email, phone number, password (stored as a hash), and profile photo when you create an account.
• Order and address information — the addresses you save, pickup and delivery coordinates, items in each order, special instructions, and the receipts and invoices we generate.
• Operational data — device and browser details, IP address, app interactions, and live location of assigned delivery agents while an order is active. This data helps us keep the service running, secure, and accountable.

• To process orders, route pickups and deliveries, and accept payments.
• To send transactional updates (order status, OTP, receipts) by SMS, email, or push notification.
• To investigate complaints, prevent fraud, and resolve disputes about cash payments.
• To improve our pricing, routing, and service quality through aggregated and anonymised analysis.
• To comply with legal obligations, including tax, anti-money-laundering, and lawful information requests.

We will send you operational messages about your orders. We will only send marketing or promotional messages if you opt in, and you can unsubscribe at any time from your profile or via the link in any marketing email.

We share information with carefully chosen service providers only as needed: payment partners (bKash, Nagad, Rocket, card networks), email/SMS providers, cloud hosting and storage, mapping providers, and analytics. Each provider is bound by a contract that limits use of your information to the purpose we engage them for.

We will share information with law enforcement or regulators when we are legally required to do so, or where we believe in good faith that disclosure is necessary to protect rights, safety, or property.

We do not sell your personal information to advertisers.

We use industry-standard measures to protect your information: encryption in transit, hashed passwords, role-based access control, audit logs on sensitive endpoints, and routine reviews of who can see what. No system is perfectly secure; please use a strong, unique password and notify us immediately if you suspect unauthorised activity.

We keep account and order records for as long as your account is active and for a reasonable period afterwards to meet legal, accounting, and tax obligations. You can request deletion of your account at any time; we will remove or anonymise information that we are not required to keep.

• Access, correct, or delete your account information from your profile page.
• Manage saved addresses and remove the ones you no longer need.
• Opt out of marketing communications.
• Request a copy of the personal information we hold about you by writing to privacy@ironman.local.

We use a small number of cookies and local-storage entries to keep you signed in, remember your preferences, and measure aggregate usage. We do not use cross-site tracking pixels for advertising. You can clear these entries from your browser at any time; doing so will log you out.

Our service is intended for adults. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently received such information, please contact us so we can remove it.

Our infrastructure may be operated in countries outside Bangladesh. Where we transfer information across borders, we use contractual and technical safeguards to keep it protected to a standard consistent with this Policy.

We will post material changes to this Policy in the app and, where appropriate, send you a notice. Continued use of the service after the effective date means you accept the updated Policy.

For privacy questions or requests, write to privacy@ironman.local.