Privacy Policy

Account information you give us. When you register, we collect your name, email address, a hashed password, your university affiliation, and (optionally) a phone number. Landlords who onboard via WhatsApp OTP provide only a phone number until they complete a listing.

Property listings (landlords). If you list a property, we collect the address, photos, rent, amenities, availability, and the contact details you want shown to renters. Listings are public by default once approved.

Reviews and saved listings. We store the reviews you write (tied to your account) and the properties you save or recently view.

Usage data we observe. When you use the Service we automatically collect your IP address, browser type, device type, pages visited, and referring URL. We log when a renter reveals a landlord's contact details on a listing — this is shown to landlords as engagement information, not to other renters.

Bot-protection signals. On sign-up and login we run Cloudflare Turnstile, which collects basic browser signals (cookies, IP, screen size, hardware concurrency) to decide whether you're human. We don't see the raw signals — only a pass/fail token.

What we don't collect. We don't collect payment information. We don't use third-party ad networks. We don't sell personal data.

• To run the Service — show you listings, let you contact landlords, store your saved properties and reviews.
• To verify your account by email (and, for landlords, by WhatsApp OTP).
• To protect the Service from bots, abuse, and fraud.
• To respond when you contact us for support.
• To send transactional emails (verification, password resets). We don't send marketing email without your explicit opt-in.
• To improve the product — understanding which listings get traffic, which filters get used, where errors happen.

We use the following service providers. Each receives only the data necessary to do its job, and each has its own privacy policy.

• MongoDB Atlas — stores all account, listing, and review data (US/EU regions).
• Vercel — hosts the website and serverless backend, including basic analytics (page views, country, no PII).
• Cloudinary — stores and delivers listing photos.
• Gmail / Nodemailer — sends transactional email (verification, password reset).
• Twilio — sends WhatsApp OTPs for landlord onboarding.
• Cloudflare — bot protection on sign-up and login (Turnstile).
• OpenStreetMap — provides the map tiles you see on listings. Map requests include your IP address.

We will disclose information if required by valid legal process from authorities with jurisdiction over us, or if we believe in good faith that disclosure is necessary to prevent imminent harm.

If basha.bd is ever acquired by or merged with another company, your information may transfer to the new owner. We'll notify you in advance of any such change.

We use browser local storage (not cookies) for your authentication token, recently viewed listings, and UI preferences. No advertising cookies are set by us.

Cloudflare Turnstile and Vercel may set their own cookies — see their respective privacy policies. You can clear them at any time via your browser settings.

Active accounts: we keep your data as long as your account exists.

Deleted accounts: when you delete your account, we remove your profile within 30 days. Reviews you wrote are anonymized rather than deleted, so the listing's rating history remains intact for other renters.

Listings: we keep listings while they're live. Once removed by a landlord we retain a copy for 12 months for fraud investigation, then permanently delete.

Logs: server logs containing IP addresses are retained for 90 days.

You can, at any time:

• Access the personal data we hold about you — visible on your profile page.
• Correct inaccurate data by editing your profile.
• Delete your account (email us until we ship a self-serve button).
• Export a copy of your data (email us — we'll send a JSON dump within 30 days).
• Object to any processing you think is unjustified.

Email bashakhujibd@gmail.com for anything not yet self-serve. We respond within 30 days.

If you're in the EU, you have additional rights under GDPR including the right to lodge a complaint with your local supervisory authority.

Passwords are hashed with bcrypt before storage — we never see your password in plaintext. All traffic between your browser and our servers is encrypted with TLS. Database access is restricted to authorized engineers and audited.

No system is perfectly secure. If you believe your account has been compromised, email us immediately.

The Service is for users aged 16 and over. We don't knowingly collect information from anyone younger. If you believe a child has provided us information, email us and we'll delete it.

basha.bd is operated from Bangladesh, but our hosting providers (Vercel, MongoDB Atlas, Cloudinary, Cloudflare) store and process data in data centers around the world, including the United States and Europe. When you use the Service, your information may be transferred to and processed in jurisdictions other than your own.

Where required by law, we rely on Standard Contractual Clauses or equivalent mechanisms to safeguard cross-border transfers.

We'll update this page when we change how we handle data. If the change is material (e.g. a new third party, a new category of data collected), we'll email registered users at least 7 days before it takes effect.

The "Last updated" date at the top reflects the most recent revision. Past versions are available on request.

Questions, requests, or complaints about privacy:

bashakhujibd@gmail.com

basha.bd, Bashundhara R/A, Dhaka, Bangladesh.