Last updated: October 21, 2026

Introduction

হবে নাকি Coffee? is a Bangladesh-based creator-support platform. Creators can add digital services/products/support options on their profile, and supporters can make secure payments to support them or purchase services.

This Privacy Policy is prepared in accordance with applicable Bangladesh law, including:

• Information and Communication Technology Act, 2006 (amended 2013)
• Digital Security Act, 2018
• Personal Data Protection Ordinance, 2025 (PDPO 2025) — where applicable
• Consumer Rights Protection Act, 2009

This policy applies when you visit our website, create an account, support a creator, or contact us.

Terms and definitions

• Personal information: Information that can identify a person directly or indirectly (name, email, NID number, photo, etc.).
• Sensitive personal information: National ID (NID) number, biometric data (selfie photo), financial account details — treated as a special category under PDPO 2025.
• Creator: A user who creates a profile and publishes services/products/support options.
• Supporter: A user/visitor who supports/pays a creator.
• Processing: Collecting, using, storing, sharing, and deleting data — all are included.

Data Controller and contact

হবে নাকি Coffee? is responsible for the information we collect and process on this platform.

For privacy questions, complaints, or data requests:
Email: support@hobenakicoffee.com
Website: https://hobenakicoffee.com

Data Protection Contact: For formal requests under PDPO 2025 or the Digital Security Act 2018, email us with the subject line “Data Protection Request”. We aim to respond within 30 business days.

Information we collect

Account and profile information

• Name, email address, username
• Profile photo (optional)
• Login/verification information (one-time code/token logs)
• Add-on information (such as a storage Add-on, where applicable)

KYC (Identity Verification) Data — Sensitive Personal Information

KYC verification is mandatory for creators who wish to enable withdrawal (payout) functionality. During KYC, we collect:

• National ID (NID) number (10 or 17 digits — old or Smart NID)
• Front and back photos of the NID card
• Selfie photo (classified as biometric data)
• Consent timestamp and IP address (legal consent record)

Legal basis: Under PDPO 2025, processing of this data is based on (a) your explicit consent and (b) legal obligation under the Money Laundering Prevention Act 2012 and Bangladesh Bank KYC guidelines. KYC data is used solely for identity verification and fraud prevention.

Retention: KYC records are retained for a minimum of 5 (five) years following verification, per regulatory requirements, even after account closure.

Third-party logins (Social Login)

If you sign in via Google, Facebook, or another third party, we may collect basic profile information (name, email, profile photo) from that service, subject to their privacy policies and your privacy settings.

Creator information

• Profile bio, social links, services/products/support options
• Service pricing and offer/package information
• Payout method details (bKash/Nagad/Rocket number or bank account details)
• Wallet balance and transaction records

Bio drafts, submitted versions and review

Here is what happens to your Bio, step by step:

• Private working draft: Whatever you are still writing is saved privately. Only you and the Team Members who can edit your Public page can open it. Managers don’t browse working drafts, and visitors never see them.
• Submitted version: When you choose Submit changes, we keep an exact copy of that version so it can be checked and reviewed. Changing your draft afterwards doesn’t change the copy you submitted.
• Automatic checks: Every submitted version is checked automatically, with our own rules and a third-party moderation service (currently OpenAI), for content our Acceptable Use Policy doesn’t allow, such as sexual content, threats, malicious content or exposed private data. A check can approve a version, send it to a Manager for review, or fail for a technical reason. A failed check never publishes anything.
• Manager review: Authorized Managers (content managers and super admins) can read the submitted version, the result of its checks and its decision history, so they can approve or reject it. They can’t read your private working drafts.
• What visitors see: Only an approved version is shown on your Public page. Your earlier approved Bio stays up until a new version is approved.
• A video in your Bio: A Bio can show one YouTube video. A Manager watches a new or changed video before it goes live, and a video a Manager removed can’t be shown again. Your Public page loads nothing from YouTube until a visitor clicks play. After that click, YouTube receives that visitor’s request and handles it under its own privacy policy.
• Reports and removal: If a report or a review finds content that breaks our rules, a Manager can remove your Bio from your Public page. You’ll see the reason in your editor. We don’t tell you who reported. Removing a Bio doesn’t suspend your account. If you think the decision is wrong, contact support. If our automatic check rejected a version, you can also ask a Manager to look at it.

Retention: A version that was rejected, replaced by a newer one, or taken down by a Manager keeps its text for 90 days from that day, and then the text is removed. The record that a submission happened, its decision and the reason stay, without the text. The Bio that is live is kept for as long as it is live.

Investigation holds: If a version is part of an active investigation (for example a report or a legal request), a super admin can place a hold on it. A held version keeps its text past 90 days for as long as the hold lasts, and the hold, its reason and who placed it are recorded. When a hold is released, text that has passed 90 days is removed by the next cleanup. A held submitted version may be kept even after you close your account, but your drafts are not.

Supporter information

• Name (or you may choose anonymous support)
• Email address (if provided)
• Message to creator (optional)
• Limited transaction reference/status information
• Reward email (optional): if you leave an email on the gift card to get a Reward, we use it only to send that Reward and a link that opens your Rewards again for 30 days, in the language of the page you gifted from. The creator never sees it. We keep it with the gift and use it for nothing else.

Direct messages

The platform supports direct messaging between users (one-on-one or group conversations). We store message content, sender/recipient identity, and timestamps. Authorized managers may view or delete messages for content moderation purposes.

Public activity information

When you follow a creator, leave a review/rating, or like, comment, bookmark, or share feed content, that activity is linked to your profile and may be displayed publicly to other users where applicable.

Payment and transaction information

We do not store sensitive payment credentials (card numbers, CVV, OTP, MFS PIN). All payments are processed via SSLCommerz, bKash, Nagad, or other approved gateways, and we accept local and international Visa, Mastercard, American Express, UnionPay and Diners Club cards, charged in BDT.

We do store: payment status, amounts, platform fees, net amounts, payment provider reference IDs, and wallet balance snapshots. These records are retained for legal audit and tax purposes.

Automatically collected technical information

• IP address, device and browser information, operating system
• Referrer URL, visited pages, and interactions
• Date/time and log data
• Cookies/similar identifiers (when applicable)

Communication and support

When you contact us by email or form, we may store your message and contact details to resolve issues, improve services, and keep records.

Creator reports/complaints (Trust & Safety)

If you submit a report against a creator for a policy violation (no login required), we collect: the reporter’s email address, the complaint category and description, and any evidence files/images you upload — stored in a private, encrypted storage bucket.

Legal basis: Our legitimate interest in platform safety and prevention of abuse and unlawful content, and legal obligations under the Digital Security Act 2018 and the Penal Code 1860. Multiple reports against the same creator within a short period may automatically flag the account for review. The reported creator is informed of the outcome, but the reporter’s identity is kept confidential.

Retention: Reports and evidence files may be retained for a reasonable period after resolution for moderation records and potential legal requirements.

Pre-launch waitlist signups

If you join our pre-launch waitlist with your email, we collect your email address, IP address, and browser (user agent) information — to send you your Founder ticket, to notify you when sign-up opens, and to prevent spam or duplicate signups.

What we keep and why: We keep your waitlist email and your Founder number so we can honour your Founder status. When you create an account with the same verified email, we match it to your waitlist entry automatically. Your Founder number is yours alone and is never given to anyone else.

After you unsubscribe: Unsubscribing stops our emails, but we keep your email on the list, marked as unsubscribed, so your account can still be matched and your Founder status honoured. We don’t email you again unless you join the waitlist again with the same email: that subscribes you again, and we resend your Founder ticket, at most once a day.

Asking us to erase it: To have your waitlist email deleted, email support@hobenakicoffee.com (subject: “Data Rights Request”). You can ask before or after you unsubscribe. Once it is deleted, we can no longer match your account automatically; if you still want your Founder status, tell us and a manager will link the account you choose by hand.

Why we use information and legal basis

We process information on the following legal bases:

• Contractual necessity: Account creation, login, payment processing, payout, and service delivery.
• Legal obligation: KYC verification (Money Laundering Prevention Act 2012), tax records (Income Tax Ordinance 2023), regulatory compliance.
• Legitimate interests: Fraud prevention, platform security, abuse detection.
• Consent: Analytics cookies, marketing emails, KYC biometric data processing.

Specific uses include:

• Account creation, login, profile management, and service delivery
• Processing creator support/orders/transactions and updating status
• Processing payout and withdrawal requests
• Customer support and communication management
• Platform security and prevention of spam/fraud/unauthorized activity
• Legal claims and meeting legal requirements
• Improving services via analytics (where consent applies)

Marketing and Promotional Communications

We may occasionally send emails about new features, offers, or platform updates. You can opt out at any time by clicking “Unsubscribe” in the email footer or emailing support@hobenakicoffee.com. Essential account and transaction-related emails cannot be opted out of.

Cookies, analytics, and similar technologies

See our Cookie Policy for details. In summary: we use cookies for session management, security, and performance analysis. Analytics cookies (GTM, Microsoft Clarity) require your consent before use.

Support access (temporary access to your account)

To help resolve a support request or ticket, specific authorized managers (only in the super_adminand support_managerroles) may temporarily access your account in a “logged in as you” mode, without ever asking for your password, so they can see and fix the issue directly.

• Reason and record: Every such access is started against a specific support request, and the manager must record a reason. The manager’s identity, the target account, the reason, any ticket reference, and the start/end time are all recorded in an audit log.
• Time limit: Each session is valid for a maximum of 30 minutes and expires automatically.
• Restrictions: This kind of access cannot be used to perform financial or security-sensitive actions on your behalf — including withdrawals, refunds, KYC submission, closing your account, or changing payout methods. Those actions always require your own account session.
• Staff accounts are protected: A manager or staff account can never be targeted this way.
• Bio drafts: A support session can’t open your private Bio drafts or submit Bio changes.

To find out whether a support session has occurred on your account, email support@hobenakicoffee.com (subject: “Data Rights Request”).

See Your rights and choicesfor details.

Sharing and disclosure

We do not sell your personal information.

Third-party service providers

We may share limited information with the following parties to provide the service:

• SSLCommerz / MFS providers (bKash, Nagad, Rocket):Payment and payout processing.
• Supabase (United States): Hosting, database, and storage services (international data transfer — see below).
• Analytics services (Google Analytics, Microsoft Clarity):Usage analysis — with your consent.
• Email/communication services: Notifications and support communication.
• Moderation service (currently OpenAI): Automatic checks of submitted Bio text for content our Acceptable Use Policy doesn’t allow.

These providers process data only on our instructions. We apply privacy and security terms with them where possible.

Legal requirements and protection

We may disclose information if required by Bangladesh law (including Digital Security Act 2018 s.44, ICT Act 2006), a court order, or a valid government request. We may also disclose limited data to protect our rights, prevent fraud, or protect user safety.

Business changes

In case of merger, acquisition, or restructuring, information may be transferred as permitted by law. We will endeavor to provide advance notice.

International data transfer

Our primary database and storage services are provided by Supabase, whose servers are located in the United States. As a result, your personal information may be transferred to and processed outside Bangladesh. Supabase is SOC 2 Type II certified and maintains encryption and security controls. KYC documents (NID photos, selfies) are stored in encrypted, private storage buckets — not accessible via public URLs.

Data retention and Account Deletion

We follow these retention principles:

• Account and profile data: Retained while your account is active. Deactivated within 30 days of a deletion request.
• Transaction and financial records: Minimum 5 (five) years per the Income Tax Ordinance 2023 and Bangladesh Bank guidelines.
• KYC records (NID, selfie): Minimum 5 years per the Money Laundering Prevention Act 2012. Legal retention obligations survive account closure.
• Log and security data: Typically 90 days to 1 year; longer if required for investigation.
• Support tickets: Up to 2 years after resolution.
• Email notification logs: Retained for 6 months after sending, then automatically deleted.
• Direct messages: Retained on a rolling monthly basis; older messages may be periodically deleted.
• Creator reports and evidence files: Retained for a reasonable period after resolution for moderation records and potential legal requirements.
• Submitted Bio versions: The text of a rejected or replaced version is kept for 90 days from that day, then removed (a version under an investigation hold keeps it until the hold is released). The live Bio is kept for as long as it is live. Private working drafts stay with your account and are deleted when you close it.

You may request account deletion. However, transaction and KYC records cannot be fully deleted until the applicable legal retention period expires.

Data security

We apply: end-to-end encryption (TLS), Row-Level Security (RLS), least-privilege access, access logging and monitoring, and separate encrypted storage for KYC documents. Staff support access to your account is similarly time-limited and audited — see Support access.

No internet system is 100% secure. Contact us immediately if you notice anything suspicious.

Data Breach Protocol: Under Digital Security Act 2018 s.17 and PDPO 2025, in the event of a personal data breach we will notify the relevant authority within 72 hours (or as required by applicable law) and aim to notify affected users within a reasonable timeframe.

Your rights and choices

Under PDPO 2025 and applicable Bangladesh law, you have the right to:

• Access: Know what information we hold about you.
• Rectification: Request correction of inaccurate information.
• Erasure: Request deletion of data not subject to legal retention requirements.
• Withdraw consent: For consent-based processing (analytics, marketing).
• Portability: Receive your data in a machine-readable format (where applicable).
• Object: Object to processing based on legitimate interests.

To make a request, email: support@hobenakicoffee.com (Subject: “Data Rights Request”). Identity verification may be required for security.

Teen users (ages 14–17) and guardian consent

Our platform is for users aged 14+. Users aged 14–17 are minors under Bangladeshi law, therefore:

• Guardian consent is required for payments, purchases, or support transactions.
• KYC verification requires age 18+ — users under 18 cannot access withdrawal functionality.
• We apply data minimization practices for users under 18.

Children’s information

This platform is not intended for users under 14. We do not knowingly collect personal information from children. If you believe a child’s data came to us by mistake, please contact us and we will take appropriate steps.

Third-party links

The platform may contain links to third-party websites. Their privacy policies are outside our control. Please review them before use.

Changes to this policy

For significant changes, we will provide at least 15 days’ notice via email or platform notification where possible. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

Contact and complaints

For any privacy questions, requests, or complaints:

Email: support@hobenakicoffee.com
Website: https://hobenakicoffee.com

You may also lodge a complaint with the Bangladesh Telecommunication Regulatory Commission (BTRC) or other relevant authority under applicable law.