Privacy Policy

1. Who this policy is for

Jukto (“we”) runs the platform at jukto.site, the dashboard at app.jukto.site and Jukto Store, the online-store part of the platform. A store lives on an address such as name.jukto.store or on a domain the merchant connects.

This policy covers three groups: merchants and their staff who use the dashboard; people who visit or buy from a website built on Jukto; and people who visit jukto.site and the Docs.

We play two roles. For the account data of merchants and staff, we decide why and how it is used. For the data of a merchant’s own customers and visitors, the merchant decides, and we handle it for the merchant so the website works. A merchant’s own privacy, refund, terms and shipping pages are written by the merchant and do not replace this policy.

2. What we collect

• Account: full name, mobile number, email address, store name, store link, business category and a password. The password is stored only as a one-way hash. Sign-in codes are sent to the mobile number by SMS.
• Staff: name, employee ID, a password hash, role, and the work records a store owner switches on, such as attendance, tasks and sales.
• Website content: pages, products, pictures, settings and designs that the merchant creates.
• Customers and orders: customer name, mobile number, optional email, delivery addresses, order contents and status. A merchant enters them, or a buyer enters them at checkout or in a buyer account (reviews and wishlist too).
• Billing: invoices and payments to Jukto, including the sender number and transaction ID of a bKash or Nagad payment and an optional receipt picture. If you use the Earnings wallet, its entries and a payout destination (the payout details are stored encrypted).
• Verification documents: see the section on identity verification below.
• Support and community: messages, posts and votes you send us.
• Technical records: sign-in sessions with a device label such as “Chrome on Windows” (never the raw browser string or the address), records of important actions for security, short-lived counters that limit abuse, and error logs.

3. Visitors to a website

When someone opens a website built on Jukto, the platform sets one random visitor cookie (it lasts up to 48 hours). With it we decide whether a visit starts a new session (about 30 minutes of inactivity ends one), ignore known bots and limit how many sessions one address can start per hour to stop abuse.

For at most 48 hours we keep the random id, a one-way hash of the IP address (mixed with a secret, so the address itself is not stored there) and the times. After that this record is deleted. The billing ledger keeps only a count and a one-way reference, which is used to bill the merchant’s monthly sessions.

The cookie belongs to one website address. It is not shared between websites, and we do not use it for advertising or to follow people across other sites. Tracking pixels and analytics tools on a store are added by the merchant (see the section on services a merchant switches on).

4. Cookies we set

Sign-in and visitor cookies are tied to the one address that set them (they have no shared domain), are SameSite Lax, and carry the “__Host-” prefix on HTTPS; sign-in cookies are also HttpOnly. The language and theme cookies may be shared between jukto.site and app.jukto.site so your choice follows you.

• jukto_app: your dashboard sign-in.
• jukto_device: remembers a device you verified with a code, for 180 days.
• jukto_shop: a buyer’s sign-in on a store.
• jukto_visit: the random visitor id described above.
• jukto_ownerbar and jukto_preview: the owner bar on your own store and the editor preview inside the dashboard.
• jukto_locale, jukto_theme and jukto_sf_lang: remember your language and light or dark choice.

We set no advertising cookies.

5. How we use data

• To create and run accounts and websites, and to sign you in safely (SMS codes, new-device checks).
• To review a new website before it goes live and to verify accounts.
• To bill: invoices, reminders, plan limits and usage.
• To give support and to run the community.
• To protect the platform from abuse and fix errors.
• To meet legal duties.

We do not sell personal data.

6. Who receives data

• Hosting: our servers and file storage run on Amazon Web Services in the Mumbai region (India), so data is stored outside Bangladesh. DNS is handled by Cloudflare.
• SMS: BulkSMSBD delivers our sign-in codes, billing reminders and alerts. It receives the mobile number and the message text.
• Domains: if a merchant buys a domain through Jukto (switched off until the platform enables it), the registrar Namely receives the registration details.
• AI SEO suggestions: when this feature is enabled and a merchant asks for a suggestion, the text of that product or page is sent to Anthropic to write the suggestion. Nothing is saved without the merchant accepting it.
• Merchant-enabled services: see the next section.
• Authorities, when the law requires it.

7. Services a merchant switches on

Jukto does not turn these on for a merchant. When a merchant connects one, they enter their own account or keys, and the data needed for that service goes to the provider under the merchant’s account and the provider’s own terms. The merchant is responsible for having the right to share it and for telling their customers.

• Payment gateways and wallets (for example SSLCommerz, bKash, Nagad, Paystation, EPS).
• Couriers (for example Steadfast, Pathao, RedX, Carrybee): delivery name, phone, address and parcel details.
• SMS gateways and email services (for example Brevo, Resend, Klaviyo, Mailchimp, HubSpot).
• Ads and analytics pixels (Meta, TikTok, Google Analytics, Google Tag Manager), Meta Ads and Google Search Console.
• Chat inboxes (WhatsApp, Messenger, Instagram) and store import or export tools (for example WooCommerce, Shopify).

Provider keys saved in the dashboard are encrypted, and they are left out of backups and exports.

8. Payments

Jukto does not collect or store buyers’ card numbers. A buyer’s online payment is handled by the gateway the merchant chose. Cash on delivery and manual bKash, Nagad, Rocket or bank payments are recorded by the merchant, including the sender number and transaction ID the buyer gives.

When a merchant pays Jukto, the payment is made by bKash or Nagad to the numbers shown on the invoice, and the merchant enters the sender number and transaction ID so our team can match it.

9. Identity verification documents

Every account is verified by a manual review by the Jukto team. The account owner uploads photos of a Bangladesh national ID card (both sides) or a passport, a photo of themselves, or a bank document. We do not use an outside identity provider.

The files are encrypted before they are stored, kept in private storage with no public address, and opened only by the reviewing Jukto administrator through a route that records every access. We keep them while the account exists and remove them when the account is permanently deleted.

10. How long we keep data

• While the account is open: account, website and customer data stay until the merchant deletes them or the account is deleted.
• After a cancellation: the dashboard closes for normal work. A full archive of the website can be downloaded for 10 days. The website’s data is kept for at least 30 days, and then a Jukto administrator may delete it after review; it is never deleted automatically.
• After deletion: products, orders, customers, pictures, designs and staff are removed. A small record stays: the store name, subscription, invoices, payments and the audit log, because they are financial and security history.
• Backups: we make automatic encrypted backup archives of each website and keep them for a limited time (7 days for the regular ones). Copies in server backups can remain for a short time after deletion.
• Short-lived records: visitor session records 48 hours; integration events, SMS and email logs, chat messages and dashboard notifications 90 days; error logs 30 days; products in the trash 30 days.
• Financial history: invoices, payments and audit records are kept as history.

11. Your choices and rights

You can see and edit most of your data in the dashboard, and you can export products and orders there. To ask for a correction, a copy or deletion of the data we hold, contact support. We answer through support.

To delete an account or website, ask support. A Jukto administrator moves it to the Trash and, after a final backup, deletes it permanently. Money in an Earnings wallet, withdrawals and refund requests must be settled first, and financial records are kept.

If you are a buyer on a store, ask the store owner first, because the merchant controls that data. If you get no answer, contact us and we will help.

12. How we protect data

• Each website’s data is separated from the others, and the database enforces that separation with row-level security.
• Passwords are stored as hashes. Provider keys, verification documents and backup archives are encrypted.
• Sign-in cookies are host-only, and a new device must be confirmed with an SMS code.
• The Jukto administrator area is limited to approved addresses and needs an authenticator code.
• Important actions are written to an audit log.

No system is perfectly secure, so we cannot promise absolute security.

13. Children

The dashboard is for business owners and their staff, and Jukto is not directed at children. If you believe a child has given us personal data, contact support and we will look into it.

14. If something goes wrong

If we learn that personal data we hold was accessed without permission and this is likely to harm people, we will tell the affected merchants without undue delay and say what we know.

15. Changes to this policy

We may update this policy. The date and version at the top show the latest one. For a material change we will tell account owners in the dashboard.

16. Governing law

This policy is governed by the laws of Bangladesh. See also the Terms of Service and the Refund Policy.