SFSellerFlow

Privacy Policy

Last updated: 19 July 2026

This Privacy Policy describes how HAVELY STORE LTD("HAVELY STORE LTD," "we," "us," or "our") collects, uses, stores, and protects personal data when you use SellerFlow (https://sellerflow.tech), our multi-tenant SaaS platform for f-commerce sellers.

HAVELY STORE LTD is the data controller for seller account data. For customer message and contact data accessed through Meta's APIs on a seller's behalf, the seller is the data controller and HAVELY STORE LTD acts as a data processor, processing data only as instructed by the seller through the SellerFlow platform.

1. Who this policy applies to

  • Sellers — business users who register for and operate a SellerFlow account (f-commerce merchants in Bangladesh and elsewhere).
  • Seller customers — individuals who message or order from a seller through Facebook Messenger, Instagram, WhatsApp, or other channels connected to SellerFlow by that seller.
  • Website visitors — individuals who browse sellerflow.tech.

2. Data we collect

2.1 Seller account data

When you register for SellerFlow, we collect:

  • Name, email address, phone number, and business/shop name
  • Account credentials (passwords stored as salted hashes)
  • Billing and subscription information
  • Team member names and roles (if you add staff to your account)
  • Product catalog, inventory, pricing, and order records you enter
  • Courier booking and tracking data you create through the platform
  • Support communications and feedback you send to us

2.2 Data accessed via Meta platforms (on each seller's behalf)

When a seller connects their Facebook Page, Instagram professional account, or WhatsApp Business number to SellerFlow, we access data through Meta's official APIs with the seller's explicit authorization. This may include:

  • Message content and metadata (sender name, timestamp, message text, media attachments) from Messenger, Instagram Direct, and WhatsApp Business conversations
  • Customer contact information available through those channels (e.g., phone numbers, profile names, profile identifiers)
  • Page and account identifiers, webhook events, and delivery/read receipts necessary to operate the unified inbox

We access this data only for the connected sellerand only to power that seller's inbox, order workflow, and related SellerFlow features. We do not combine customer data across unrelated sellers for advertising or profiling.

2.3 Website data

When you visit sellerflow.tech, we may collect standard server logs (IP address, browser type, pages visited, referring URL) and cookies essential for site functionality. We do not use third-party advertising trackers on this marketing site.

3. How we use data

We use collected data solely to:

  • Provide and operate the SellerFlow platform (unified inbox, order management, courier booking, COD verification, inventory, accounting)
  • Generate AI-drafted reply suggestions in Bangla or English for the seller to review and send — the AI does not autonomously finalize orders or send price/stock/payment messages without seller confirmation
  • Process subscription billing and communicate about your account
  • Provide customer support and respond to your requests
  • Operate the seller blacklist feature using aggregated, evidence-based fraud indicators (never publishing raw customer identifying information publicly)
  • Improve platform reliability, security, and performance
  • Comply with legal obligations

We never sell personal data. We do not use seller or customer data for advertising, audience building, or any purpose outside operating SellerFlow for the connected seller.

4. Legal bases for processing (UK GDPR)

  • Contract — processing necessary to provide SellerFlow to registered sellers
  • Legitimate interests — platform security, fraud prevention (seller blacklist), and service improvement, balanced against individual rights
  • Consent— Meta platform connections require seller authorization through Meta's OAuth flow; COD verification messages are sent based on seller-configured workflows
  • Legal obligation — where required by applicable law

5. Data sharing

We share data only in these circumstances:

  • Service providers — cloud hosting, payment processing, SMS/WhatsApp delivery, and courier API partners, under data processing agreements
  • Meta platforms— sending messages and retrieving conversation data through official APIs on the seller's behalf
  • Legal requirements — when required by law, court order, or regulatory authority

We do not share customer message data with other sellers.

6. Data retention

  • Seller account data — retained for the duration of your subscription and up to 90 days after account closure, unless a longer period is required by law or you request earlier deletion
  • Message and conversation data — retained while your account is active and Meta channel connections remain authorized; deleted within 90 days of disconnection or account closure
  • Order and transaction records — retained for up to 7 years where required for tax, accounting, or legal compliance
  • Server logs — retained for up to 12 months

7. Data security

We implement industry-standard technical and organizational measures including encryption in transit (TLS), encrypted storage for sensitive fields, access controls, audit logging, and regular security reviews. No method of transmission over the Internet is 100% secure; we continuously work to protect your data.

8. International transfers

SellerFlow infrastructure may process data in the UK, EU, and other jurisdictions where our service providers operate. Where data is transferred outside the UK, we use appropriate safeguards such as Standard Contractual Clauses.

9. Your rights

Under UK GDPR and applicable data protection law, you may have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Object to or restrict certain processing
  • Data portability (where applicable)
  • Withdraw consent where processing is consent-based
  • Lodge a complaint with the UK Information Commissioner's Office (ICO)

For sellers

To exercise your rights regarding your SellerFlow account data, email privacy@sellerflow.tech with your account email and request. We will respond within 30 days.

For seller customers

If you are a customer of a SellerFlow seller and wish to request access to or deletion of your data, please contact the seller directly in the first instance — they are the data controller for your conversation and order data. You may also contact us at privacy@sellerflow.tech and we will forward your request to the relevant seller or process it on their behalf where appropriate. We will respond within 30 days.

Meta platform data deletion

When a seller disconnects their Meta accounts or deletes their SellerFlow account, we delete associated message and contact data retrieved through Meta APIs within 90 days, in accordance with Meta Platform Terms and our data retention policy above.

10. Cookies

The SellerFlow marketing website uses only essential cookies required for basic site operation. The SellerFlow application may use session cookies for authentication. We do not use advertising or cross-site tracking cookies.

11. Children

SellerFlow is a business platform not directed at individuals under 18. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date. Continued use of SellerFlow after changes constitutes acceptance of the revised policy.

13. Contact us

For privacy questions, data subject requests, or complaints:

See also our Terms of Service.