Privacy Policy

Welcome to LotDesk. This Privacy Policy describes how ABDULLAH AL MORSHED NAYEEM ("we," "us," or "our") collects, uses, and protects your personal information when you use the LotDesk mobile application and related services (collectively, the "Service").

By using LotDesk, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Information You Provide

When you register for and use LotDesk, we collect the following information that you voluntarily provide:

• Account Information: Full name, phone number (used as your login credential), email address, and password.
• Business Information: Store/Organization name, business address, and district/city location.
• Profile Information: Store logo avatar, preferred display language, and location district.
• Business Data: Products, stock lots, orders, returns, customer names, and shipping addresses entered into the system for your daily inventory and sales management.
• Contact Messages: Inquiries submitted through our Contact Us feature.

1.2 Information Collected Automatically & Device Permissions

To provide core business features and secure functionality, LotDesk requests access to certain device features and data:

• Location Data (GPS & District Geolocation): We collect approximate location (district/city level) and precise GPS coordinates (rounded to 6 decimal places) only when you explicitly grant location permission or tap "Auto-Detect Location".
  Why Location is Needed: Location data is used strictly to auto-detect your store's city/district during onboarding, auto-fill merchant shipping origins, provide regional sales analytics, and calculate local Bangladesh delivery fees. Location data is never tracked in the background when the app is closed, and is never sold or shared with third-party ad networks.
• Device Identifiers & Push Notifications: Device tokens are collected via Firebase Cloud Messaging (FCM) to deliver low-stock alerts, return notifications, and system status updates.
• Camera & Photo Gallery Access: Optional permission requested only when you choose to capture or upload a store logo avatar, product catalog image, or receipt attachment.
• Network & Internet State: Internet access is required to securely transmit encrypted business data to our HTTPS servers.
• Usage Data: Anonymous feature usage patterns and session diagnostic logs.

1.3 Third-Party Authentication

If you choose to sign in with Google, we receive your name and email address from your Google account via Google OAuth 2.0 (Google Sign-In). We do not receive or store your Google password.

2. How We Use Your Information

We use the collected information for the following specific business purposes:

• Account Management: To create, maintain, and secure your merchant account.
• Service Delivery: To provide inventory tracking, order management, FIFO stock calculations, profit-and-loss analytics, and courier fee accounting.
• Location Services: To identify store district origins, auto-suggest local city settings, and provide regional business analytics.
• Communication: To send push notifications for stock alerts, order updates, and service broadcasts.
• Support: To respond to inquiries and provide customer service.
• Security & Anti-Fraud: To enforce rate limits, verify identity, and prevent spam account creation.

3. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following limited circumstances:

• Service Providers: We use Google OAuth 2.0 for user sign-in authentication and Firebase (Google Cloud Messaging) for push notifications. These providers process data on our behalf and are bound by their own privacy policies.
• Organization Members: If you are part of a multi-user organization on LotDesk, other members of the same organization can see shared business data (products, orders, inventory) based on their role permissions.
• Legal Requirements: We may disclose your information if required by law, regulation, or legal process.

4. Data Storage and Security

Your data is stored on secure servers. We implement industry-standard security measures including:

• Encrypted data transmission (HTTPS/TLS)
• JWT-based authentication with token rotation and blacklisting
• Password hashing using Django's built-in security framework
• Role-based access control (Owner, Admin, Staff)
• Organization-level data isolation (multi-tenancy)

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

5. Data Retention

• Active Accounts: Your data is retained for as long as your account is active.
• Deactivated Accounts (App Deletion): When you delete your account from the app, your account is deactivated and your data is retained in deactivated state.
• Permanently Deleted Accounts (Web Deletion): When you delete your account through our web deletion page, your personal data and all associated business data are permanently and irreversibly removed from our servers.

6. Your Rights

You have the following rights regarding your personal data:

• Access: You can view your profile and business data at any time through the app.
• Correction: You can update your profile information through the app settings.
• Deletion: You can delete your account from the app (deactivation) or permanently through our web deletion page.
• Data Portability: You can request a copy of your data by contacting us at lotdeskbd@gmail.com.

7. Children's Privacy

LotDesk is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will take steps to delete it promptly.

8. Third-Party Services

LotDesk integrates with trusted third-party service providers to deliver secure functionality and optional rewarded features:

• Google Sign-In / OAuth 2.0 (Google) — For secure 1-tap Google account authentication.
• Firebase Cloud Messaging (Google) — For push notification delivery of stock alerts and order updates.
• Google Mobile Ads / AdMob (Google) — For delivering optional rewarded video ads that allow merchants to earn points and unlock features.

These third-party providers process data in accordance with their privacy standards. We encourage you to review Google's Privacy Policy.

9. Push Notifications

We use Firebase Cloud Messaging (FCM) to send push notifications about order updates, system alerts, and important announcements. You can disable push notifications at any time through your device settings.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated "Last Updated" date. We encourage you to review this page periodically. Continued use of the Service after changes constitutes acceptance of the revised policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: lotdeskbd@gmail.com
• Address: 124/1 West Shewrapara, Dhaka, Bangladesh
• Operator: ABDULLAH AL MORSHED NAYEEM