Last updated: July 13, 2026

Introduction

হবে নাকি Coffee? is a Bangladesh-based creator-support platform. Creators can add digital services/products/support options on their profile, and supporters can make secure payments to support them or purchase services.

This Privacy Policy is prepared in accordance with applicable Bangladesh law, including:

Information and Communication Technology Act, 2006 (amended 2013)
Digital Security Act, 2018
Personal Data Protection Ordinance, 2025 (PDPO 2025) — where applicable
Consumer Rights Protection Act, 2009

This policy applies when you visit our website, create an account, support a creator, or contact us.

Terms and definitions

Personal information: Information that can identify a person directly or indirectly (name, email, NID number, photo, etc.).
Sensitive personal information: National ID (NID) number, biometric data (selfie photo), financial account details — treated as a special category under PDPO 2025.
Creator: A user who creates a profile and publishes services/products/support options.
Supporter: A user/visitor who supports/pays a creator.
Processing: Collecting, using, storing, sharing, and deleting data — all are included.

Data Controller and contact

হবে নাকি Coffee? is responsible for the information we collect and process on this platform.

For privacy questions, complaints, or data requests:
Email: support@hobenakicoffee.com
Website: https://hobenakicoffee.com

Data Protection Contact: For formal requests under PDPO 2025 or the Digital Security Act 2018, email us with the subject line “Data Protection Request”. We aim to respond within 30 business days.

Information we collect

Account and profile information

Name, email address, username
Profile photo (optional)
Login/verification information (one-time code/token logs)
Platform subscription information (Pro/Max/Ultra plan, where applicable)

KYC (Identity Verification) Data — Sensitive Personal Information

KYC verification is mandatory for creators who wish to enable withdrawal (payout) functionality. During KYC, we collect:

National ID (NID) number (10 or 17 digits — old or Smart NID)
Front and back photos of the NID card
Selfie photo (classified as biometric data)
Consent timestamp and IP address (legal consent record)

Legal basis: Under PDPO 2025, processing of this data is based on (a) your explicit consent and (b) legal obligation under the Money Laundering Prevention Act 2012 and Bangladesh Bank KYC guidelines. KYC data is used solely for identity verification and fraud prevention.

Retention: KYC records are retained for a minimum of 5 (five) years following verification, per regulatory requirements, even after account closure.

If you sign in via Google, Facebook, or another third party, we may collect basic profile information (name, email, profile photo) from that service, subject to their privacy policies and your privacy settings.

Creator information

Profile bio, social links, services/products/support options
Service pricing and offer/package information
Payout method details (bKash/Nagad/Rocket number or bank account details)
Wallet balance and transaction records

Supporter information

Name (or you may choose anonymous support)
Email address (if provided)
Message to creator (optional)
Limited transaction reference/status information

Direct messages

The platform supports direct messaging between users (one-on-one or group conversations). We store message content, sender/recipient identity, and timestamps. Authorized managers may view or delete messages for content moderation purposes.

Public activity information

When you follow a creator, leave a review/rating, or like, comment, bookmark, or share feed content, that activity is linked to your profile and may be displayed publicly to other users where applicable.

Payment and transaction information

We do not store sensitive payment credentials (card numbers, CVV, OTP, MFS PIN). All payments are processed via SSLCommerz, bKash, Nagad, or other approved gateways.

We do store: payment status, amounts, platform fees, net amounts, payment provider reference IDs, and wallet balance snapshots. These records are retained for legal audit and tax purposes.

Automatically collected technical information

IP address, device and browser information, operating system
Referrer URL, visited pages, and interactions
Date/time and log data
Cookies/similar identifiers (when applicable)

Communication and support

When you contact us by email or form, we may store your message and contact details to resolve issues, improve services, and keep records.

Creator reports/complaints (Trust & Safety)

If you submit a report against a creator for a policy violation (no login required), we collect: the reporter’s email address, the complaint category and description, and any evidence files/images you upload — stored in a private, encrypted storage bucket.

Legal basis: Our legitimate interest in platform safety and prevention of abuse and unlawful content, and legal obligations under the Digital Security Act 2018 and the Penal Code 1860. Multiple reports against the same creator within a short period may automatically flag the account for review. The reported creator is informed of the outcome, but the reporter’s identity is kept confidential.

Retention: Reports and evidence files may be retained for a reasonable period after resolution for moderation records and potential legal requirements.

Pre-launch waitlist signups

If you join our pre-launch “Coming Soon” waitlist with your email, we collect your email address, IP address, and browser (user agent) information — to notify you at launch and prevent spam or duplicate signups.

Why we use information and legal basis

We process information on the following legal bases:

Contractual necessity: Account creation, login, payment processing, payout, and service delivery.
Legal obligation: KYC verification (Money Laundering Prevention Act 2012), tax records (Income Tax Ordinance 2023), regulatory compliance.
Legitimate interests: Fraud prevention, platform security, abuse detection.
Consent: Analytics cookies, marketing emails, KYC biometric data processing.

Specific uses include:

Account creation, login, profile management, and service delivery
Processing creator support/orders/transactions and updating status
Processing payout and withdrawal requests
Customer support and communication management
Platform security and prevention of spam/fraud/unauthorized activity
Legal claims and meeting legal requirements
Improving services via analytics (where consent applies)

Marketing and Promotional Communications

We may occasionally send emails about new features, offers, or platform updates. You can opt out at any time by clicking “Unsubscribe” in the email footer or emailing support@hobenakicoffee.com. Essential account and transaction-related emails cannot be opted out of.

Cookies, analytics, and similar technologies

See our Cookie Policy for details. In summary: we use cookies for session management, security, and performance analysis. Analytics cookies (GTM, Microsoft Clarity) require your consent before use.

Support access (temporary access to your account)

To help resolve a support request or ticket, specific authorized managers (only in the super_adminand support_managerroles) may temporarily access your account in a “logged in as you” mode, without ever asking for your password, so they can see and fix the issue directly.

Reason and record: Every such access is started against a specific support request, and the manager must record a reason. The manager’s identity, the target account, the reason, any ticket reference, and the start/end time are all recorded in an audit log.
Time limit: Each session is valid for a maximum of 30 minutes and expires automatically.
Restrictions: This kind of access cannot be used to perform financial or security-sensitive actions on your behalf — including withdrawals, refunds, KYC submission, closing your account, or changing payout methods. Those actions always require your own account session.
Staff accounts are protected: A manager or staff account can never be targeted this way.

To find out whether a support session has occurred on your account, email support@hobenakicoffee.com (subject: “Data Rights Request”).

See Your rights and choicesfor details.

We do not sell your personal information.

Third-party service providers

We may share limited information with the following parties to provide the service:

SSLCommerz / MFS providers (bKash, Nagad, Rocket):Payment and payout processing.
Supabase (United States): Hosting, database, and storage services (international data transfer — see below).
Analytics services (Google Analytics, Microsoft Clarity):Usage analysis — with your consent.
Email/communication services: Notifications and support communication.

These providers process data only on our instructions. We apply privacy and security terms with them where possible.

Legal requirements and protection

We may disclose information if required by Bangladesh law (including Digital Security Act 2018 s.44, ICT Act 2006), a court order, or a valid government request. We may also disclose limited data to protect our rights, prevent fraud, or protect user safety.

Business changes

In case of merger, acquisition, or restructuring, information may be transferred as permitted by law. We will endeavor to provide advance notice.

International data transfer

Our primary database and storage services are provided by Supabase, whose servers are located in the United States. As a result, your personal information may be transferred to and processed outside Bangladesh. Supabase is SOC 2 Type II certified and maintains encryption and security controls. KYC documents (NID photos, selfies) are stored in encrypted, private storage buckets — not accessible via public URLs.

Data retention and Account Deletion

We follow these retention principles:

Account and profile data: Retained while your account is active. Deactivated within 30 days of a deletion request.
Transaction and financial records: Minimum 5 (five) years per the Income Tax Ordinance 2023 and Bangladesh Bank guidelines.
KYC records (NID, selfie): Minimum 5 years per the Money Laundering Prevention Act 2012. Legal retention obligations survive account closure.
Log and security data: Typically 90 days to 1 year; longer if required for investigation.
Support tickets: Up to 2 years after resolution.
Email notification logs: Retained for 6 months after sending, then automatically deleted.
Direct messages: Retained on a rolling monthly basis; older messages may be periodically deleted.
Creator reports and evidence files: Retained for a reasonable period after resolution for moderation records and potential legal requirements.

You may request account deletion. However, transaction and KYC records cannot be fully deleted until the applicable legal retention period expires.

Data security

We apply: end-to-end encryption (TLS), Row-Level Security (RLS), least-privilege access, access logging and monitoring, and separate encrypted storage for KYC documents. Staff support access to your account is similarly time-limited and audited — see Support access.

No internet system is 100% secure. Contact us immediately if you notice anything suspicious.

Data Breach Protocol: Under Digital Security Act 2018 s.17 and PDPO 2025, in the event of a personal data breach we will notify the relevant authority within 72 hours (or as required by applicable law) and aim to notify affected users within a reasonable timeframe.

Your rights and choices

Under PDPO 2025 and applicable Bangladesh law, you have the right to:

Access: Know what information we hold about you.
Rectification: Request correction of inaccurate information.
Erasure: Request deletion of data not subject to legal retention requirements.
Withdraw consent: For consent-based processing (analytics, marketing).
Portability: Receive your data in a machine-readable format (where applicable).
Object: Object to processing based on legitimate interests.

To make a request, email: support@hobenakicoffee.com (Subject: “Data Rights Request”). Identity verification may be required for security.

Teen users (ages 14–17) and guardian consent

Our platform is for users aged 14+. Users aged 14–17 are minors under Bangladeshi law, therefore:

Guardian consent is required for payments, purchases, or support transactions.
KYC verification requires age 18+ — users under 18 cannot access withdrawal functionality.
We apply data minimization practices for users under 18.

Children’s information

This platform is not intended for users under 14. We do not knowingly collect personal information from children. If you believe a child’s data came to us by mistake, please contact us and we will take appropriate steps.

Third-party links

The platform may contain links to third-party websites. Their privacy policies are outside our control. Please review them before use.

Changes to this policy

For significant changes, we will provide at least 15 days’ notice via email or platform notification where possible. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

Contact and complaints

For any privacy questions, requests, or complaints:

Email: support@hobenakicoffee.com
Website: https://hobenakicoffee.com

You may also lodge a complaint with the Bangladesh Telecommunication Regulatory Commission (BTRC) or other relevant authority under applicable law.