Privacy Policy

1 Who We Are

BDGate ("we", "our", "us") is a payment gateway platform operated by BDGate, with offices in Dhaka and Tangail, Bangladesh, and Kuala Lumpur, Malaysia.

Our platform enables merchants to accept mobile financial service (MFS) payments from customers in Bangladesh and internationally.

Website: https://bdgate.net
Email: privacy@bdgate.net
Phone: 09617179060

2 Information We Collect

2.1 Account Information

2.2 Transaction Data

When payments are processed through BDGate, we collect:

• Transaction ID, amount, currency, and timestamp
• Payment method used (bKash, Nagad, Rocket, etc.)
• Customer phone number (partial, for matching)
• Payment status (pending, approved, failed, refunded)

2.3 Technical Data

• IP address and device information
• Browser type and operating system
• Pages visited and time spent
• API request logs (authenticated endpoints only)

2.4 Communications

If you contact our support team, we retain records of those communications to resolve your inquiry and improve our service.

3 How We Use Your Information

• Service delivery: Processing payments, generating invoices, sending confirmations
• Account management: Authentication, settings, subscription billing
• Security: Fraud detection, bot prevention, unauthorized access prevention
• Communication: Transaction notifications, service updates, support responses
• Analytics: Aggregated, anonymized usage statistics to improve the platform
• Legal compliance: Responding to lawful requests from authorities

We do not use your data for advertising or sell it to marketing companies.

4 SMS Data & Android Relay App

4.1 What SMS Data We Access

The BDGate SMS Relay app, when installed on a merchant's Android device, reads incoming SMS messages only from known MFS providers:

• bKash, Nagad, Rocket (DBBL), Upay, CellFin, IBBL, Tap, mCash, MyCash, SureCash

All other SMS messages (personal, bank, OTP from other services, etc.) are completely ignored and never accessed or transmitted.

4.2 What We Extract from MFS SMS

• Transaction ID (TrxID)
• Payment amount
• Sender phone number (customer's number)
• MFS provider name
• Timestamp of the SMS

4.3 How SMS Data is Used

Extracted SMS data is transmitted securely (HTTPS) to BDGate's servers solely to match and automatically confirm pending payment transactions. SMS content is:

• Stored in your merchant transaction log for record-keeping
• Used to trigger payment status updates
• Never shared with third parties outside of BDGate
• Never used for marketing or advertising purposes

4.4 Data Security in Transit

All data transmitted by the relay app is:

• Encrypted via HTTPS/TLS 1.2+
• Authenticated with a unique Security Secret token per merchant
• Protected against replay attacks with timestamp validation

5 Data Sharing & Third Parties

We do not sell, rent, or trade your personal data. We may share data with:

5.1 Payment Processors

Transaction data is shared with MFS providers (bKash, Nagad, etc.) as necessary to process payments.

5.2 Email Service Providers

We use email service providers to send transactional emails (payment confirmations, invoices). They process only your email address and message content.

5.3 Legal Requirements

We may disclose information to comply with Bangladesh Bank regulations, court orders, or other legal obligations.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction. We will notify affected users in advance.

6 Data Retention

7 Data Security

We implement industry-standard security measures:

• All data transmitted over TLS 1.2+ encryption
• Passwords stored as bcrypt hashes (never in plain text)
• API authentication via JWT tokens with expiry
• Domain whitelisting for API calls
• Rate limiting to prevent brute-force attacks
• Regular security audits

While we take all reasonable precautions, no system is 100% secure. Please report any suspected security issues to security@bdgate.net.

8 Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Update inaccurate or incomplete information
• Deletion: Request deletion of your account and associated data
• Portability: Receive your transaction data in a structured format
• Objection: Object to certain types of data processing
• Withdrawal: Revoke consent for optional data processing

To exercise these rights, email privacy@bdgate.net or contact us through the support portal. We will respond within 14 business days.

9 Cookies

We use minimal, essential cookies only:

• Session cookies: Keep you logged into your merchant panel
• Preference cookies: Remember your UI settings

We do not use advertising cookies or third-party tracking cookies. You can disable cookies in your browser, but this may affect the functionality of the merchant panel.

10 Children's Privacy

BDGate services are intended for business use by adults (18+). We do not knowingly collect personal information from individuals under 18 years of age. If we become aware that a minor has registered an account, we will delete the account promptly.

11 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last Updated" date at the top of this page
• Notify registered merchants via email for material changes
• Post a notice on our website for 30 days

Your continued use of BDGate services after changes take effect constitutes acceptance of the updated policy.

12 Contact Us

For privacy-related inquiries, data requests, or concerns:

• Email: privacy@bdgate.net
• Phone: 09617179060 (Sat–Thu, 9am–7pm BST)
• WhatsApp: +880 1719 570794
• Address: 110, Goalbari, Mirpur-14, Dhaka, Bangladesh