Privacy Policy
Last updated: September 27, 2026
1. Introduction
Onescle ("Onescle", "we", "us", or "our") is committed to protecting the privacy of our merchants ("Merchants") and their customers ("Shoppers"). This Privacy Policy explains our practices regarding the collection, use, disclosure, and protection of personal data when you visit our marketing website, use our platform, or purchase products through stores powered by Onescle.
2. Information We Collect as a Service Provider
When you register for an Onescle account as a Merchant, we collect your name, email address, phone number, business name, billing address, and payment information. When shoppers place orders on merchant storefronts, we process transaction details (shipping address, phone number, recipient name, payment status) solely on behalf of and under the instructions of the respective merchant.
3. How We Use Your Data
We use collected data to provide, maintain, and optimize our e-commerce platform services; process transactions; generate courier consignments; enable Meta Conversions API telemetry (subject to shopper consent); enforce platform security; and communicate important system updates.
4. Third-Party Data Disclosures
We never sell your data. We share data only with trusted service providers necessary to operate the platform: courier providers (Pathao, Steadfast, RedX) for parcel delivery, payment processors (bKash, Nagad, SSLCommerz) for payment settlement, and marketing platforms (Meta, Google) only when configured by the merchant with explicit consent.
5. Facebook, Instagram and Messenger Data
When a Merchant connects a Facebook Page to Onescle, Meta Platforms, Inc. provides us, with the Merchant’s authorization, the following data: the Page’s ID, name and profile picture; the ID of any Instagram professional account linked to the Page; the list of permissions the Merchant granted; and access tokens that let us act on the Page. Access tokens are stored encrypted with AES-256-GCM and are never shown to anyone, including the Merchant. If the Merchant enables Messenger, we also receive and store messages sent to the Page — their text, attachments, timestamps and the sender’s Page-scoped ID (PSID) — so the Merchant can read and answer them here. We use this data only to publish content the Merchant creates, to deliver and answer the Page’s messages, to synchronize the Merchant’s product catalog, and to show the Merchant the results. We do not use Meta data to build profiles of Shoppers, to advertise to them on our own behalf, or for any purpose other than the service the Merchant configured. Our use of data received from Meta complies with the Meta Platform Terms and Developer Policies.
6. Data Security and Retention
We enforce industry-standard security safeguards including PostgreSQL Row-Level Security (RLS), TLS (HTTPS) encryption in transit, AES-256-GCM encryption for stored API keys and access tokens, and periodic automated backups. We retain merchant account information for as long as the account remains active. Facebook access tokens are deleted the moment a Page is disconnected. Messenger conversations and message content are retained for 90 days after the Page is disconnected or the merchant account is closed, then deleted; published-post records are retained while the merchant account is active. Deletion requests are actioned within 30 days.
7. Disconnecting Facebook and Deleting Your Data
A Merchant can disconnect a Page at any time from Marketing → Facebook in the dashboard; this deletes the stored access tokens immediately. You can also remove Onescle from Facebook under Settings → Business Integrations, which revokes our access and notifies us. Any person whose data reached us through Meta — including Shoppers who messaged a connected Page — can ask for it to be deleted by removing the Onescle app in their Facebook settings and choosing “Delete”, which sends us a signed deletion request and gives them a confirmation code to check its status at onescle.com/data-deletion, or by emailing [email protected]. We act on every request within 30 days.
8. Cookies and Similar Technologies
We use a small number of strictly necessary cookies to run the service: an opaque session token that keeps you signed in, a cart token so a shopper does not lose their basket, and a token that lets us recognise a browser for fraud prevention at checkout. These carry no personal information in themselves, are read only by our servers, and cannot be switched off without breaking the service. Where you consent, we also use Google Analytics to see which pages are read, and marketing cookies set by Meta on merchant storefronts that connect an advertisement to an order. On this website we also use the Meta Pixel to measure our own advertising: whether a visit that began at one of our ads led to an account being created, a plan checkout being started or a plan being paid for. For those three steps our servers also tell Meta, through its Conversions API, a one-way hash (SHA-256) of your email address and name, your IP address and browser, and the plan and its price — never your password or payment details. In the European Economic Area, the United Kingdom and Switzerland none of this happens until you accept; elsewhere it is on by default and stops when you choose “Decline non-essential”. You can change or withdraw your choice at any time from the cookie banner, and you can clear or block cookies in your browser — strictly necessary ones included, though signing in and checking out will then not work.
9. Your Rights and Contact Information
You have the right to access, rectify, or request deletion of your personal information. To have data deleted, use the request form at https://onescle.com/data-deletion or write to us. If you have questions regarding this Privacy Policy, please contact us at [email protected].