Privacy policy

We collect the least we can get away with while still being able to catch fake reviews, and we say plainly where we collect more than that. We use no advertising trackers, no third-party analytics, and no browser fingerprinting. We do not sell information about you to anyone.

You do not need an account to read Brandsof.bd, and reading is close to anonymous.

The device cookie

Your browser is given one small cookie of ours. It holds a random value we generate on our own server, signed so we can tell if it has been altered. It contains nothing about your device: no screen size, no fonts, no graphics fingerprint, and nothing read out of your browser's identification string. It is set only by our own site, never by anyone else, and scripts running in your browser cannot read it.

It exists for one purpose: telling whether many reviews that claim to be from different people were in fact written from the same browser. That is the single most useful signal against a paid-review campaign, and Bangladesh has an active market in those. It is looked at when a review is written. It is not used to build a profile of what you read, and it is not shared.

This is deliberately a cookie and not a fingerprint. A fingerprint follows you whether you agree or not and cannot be cleared. Clearing your cookies clears this, and you can do so at any time.

Business page view counts

Business owners can see how many times their page was viewed. That count is produced in your browser and sent to us as a single number for a single business. We store one row per business per day holding a count, and nothing else. No visitor identifier, no network address, and no device cookie is stored with it — there is nowhere in that record for one to go.

Your browser remembers, in its own temporary storage, which business pages it has already counted in this browsing session, so re-reading a page does not count twice. That memory never leaves your browser and is gone when you close it.

Requests whose browser identifies itself as a crawler, preview generator, or monitoring tool are not counted. We take that identification at face value — we do not try to unmask a visitor who does not declare themselves.

We do apply a limit on how many of these counts we will accept from one network address per minute, so that one script cannot inflate a business's figures. That limit is held in memory only. It is never written to our database and disappears when the server restarts.

You sign in with your mobile number, and we store it in international format. It identifies your account and it is where we send the one-time code. Your number is never shown on your public profile.

The one-time code is kept in exactly one place, and only for as long as it can still be used: the record your next attempt is checked against. Using the code deletes it. Asking for a new code deletes the previous one immediately, so an old message in your inbox stops working the moment you request a fresh one. A code that simply expires is deleted the next time anyone on this platform verifies one. The code is never written into our permanent log, and it is not copied into the queued job that sends your SMS — that message is composed from the single record above at the moment it is sent. Our servers' own technical log records only that a message went out and to a partly-hidden number: never the code itself, and never your number in full.

We keep a record that a message was sent to your number, when, and whether it was delivered. That record lives in our permanent log described below and cannot be deleted.

The network address you wrote from and the value of the device cookie are stored on the review. They are used for one thing: grouping reviews that may have been written by the same person or organised by the same campaign. They are never shown to other users, never shown to the business you reviewed, and never included in anything we publish.

Be aware of the limit of our commitment here: these two values stay attached to the review for as long as the review exists. We do not currently erase them on a schedule.

Photographs

Every photograph you upload is re-encoded by us before it is stored, and the hidden data cameras write into image files — GPS coordinates, camera and phone model, and the exact time the photo was taken — is discarded in the process. Only the re-encoded image is saved. Your original file is never stored anywhere.

This matters more here than it might elsewhere. A photograph taken at home, attached to a critical review of a nearby business, can carry the reviewer's home coordinates in it. Retaliation against reviewers is a real risk in this market, and no reviewer should have to know what metadata is in their own camera roll to be safe.

One thing we do read from that hidden data before discarding it: which way up the camera was held, so your photo is not saved sideways.

If a review is removed or is waiting on moderation, its photographs stop being served. The stored file itself is not deleted from our storage.

Verifying your identity, or that you represent a business, involves sending us a photograph of a national identity card, a trade licence, or a BIN certificate. These are the most sensitive things we hold.

Only staff who hold the verification capability can open them. Support staff cannot — the same check that lets a verifier see a document refuses a support agent, and it refuses before it even looks up whether the document exists, so nobody without that capability can learn one was submitted. Even the person who uploaded it cannot re-open it afterwards.

A national identity card image is deleted the moment a decision is made on it, whether the decision is approve or reject. What we keep is the single fact that the account is verified. The image is not archived.

A trade licence or BIN certificate is deleted when it is rejected. When it is approved it is kept, because it is the evidence the business's claim on its listing rests on. We have not yet set a deletion period for those, and we would rather say so here than state a period we do not enforce.

Your public profile lives at an address made of random characters generated in our database. It is not your account identifier and nothing about it can be worked backwards into one. This matters because our internal account identifiers encode the moment the account was created, almost to the millisecond, and putting one in a public address would quietly publish that.

Dates on your public profile are shown to the month, never the day. When you joined, and when each review was published, are both rounded down to the first of the month before they leave our server.

You control three things from your dashboard: whether your review history is listed at all, whether search engines are asked to index your profile, and whether your upazila is shown. Hiding your history hides the reviews from the profile; the number of reviews you have published still appears, and nothing is deleted.

Your public profile never carries your email address, your phone number, your network address, your device cookie, the exact time you joined, or the exact time you published anything.

Every action our staff take and every automated decision our system makes is written to a log that the database itself refuses to delete from. It records who acted, what they did, which thing they did it to, and the network address the request came from.

That log is what makes our transparency report countable and an appeal checkable. A moderation record that could be quietly edited afterwards would be worth nothing to the person appealing it.

It has no deletion period. We keep it. You should read that as the trade-off it is: the same property that stops us rewriting a decision against you also means we cannot remove your network address from it.

If you use our takedown form, we store what you type, including your name and contact details, and the network address you sent it from. We keep the address deliberately: a takedown demand is a legal assertion against a named person, and a false one is a serious matter. This is the only place we record a network address from someone who is not signed in.

We run no advertising trackers and no third-party analytics service. We send nothing about you to an external error-reporting service. We do not fingerprint your browser — we read no canvas, no fonts, no screen dimensions, and we do not parse your browser's identification string to identify you. We do not sell or rent information about you.

Each of these is read directly from the setting in our code that enforces it. If someone changes one without changing this page, our build fails.

• Business page view counts: kept 400 days, then deleted.
• The device cookie: expires 365 days after it is set.
• Staying signed in: your session ends 30 days after you sign in.
• A one-time sign-in code: valid for 5 minutes.
• Wrong attempts at a one-time code: after 5, the code is destroyed and you must request a new one.
• Grouping reviews by device for fraud checks: looks back 30 days.
• Grouping reviews by network address for fraud checks: looks back 7 days.

Anything not listed above has no period we enforce, and we have not implied one. Where that is true we have said so in the section it belongs to.

Write to us and we will tell you what we hold about your account and correct anything wrong. We will explain honestly what we cannot remove and why, rather than promising an erasure our own system refuses.

support@sit.jonopriyota.com

When what our software does changes, this page changes with it — that is enforced, not merely intended, for every period listed above.

support@sit.jonopriyota.com