Privacy notice
Last updated 13 November 2026. This notice covers NagarData accounts, payments, the API and the website. NagarLab's general notice is here.
Who is responsible
NagarLab operates NagarData. Paid plans in Bangladesh are sold by , which processes billing data on NagarLab's behalf. Contact for privacy questions: , or use the privacy request form.
What we collect and why
| Account: name, email, password (stored only as a scrypt hash), what you use the data for | To run your account (contract). Kept until you delete the account. |
|---|---|
| Billing: name and address on invoices, BIN, mobile number, invoices and payment records | To bill you and meet tax law (legal obligation). Invoices are kept for the period tax law requires, also after account deletion. |
| Payments | Made on SSLCommerz's pages. We receive a transaction reference and status, never your card number or wallet PIN. |
| Sign-in sessions: IP address, browser name | To show your signed-in devices and protect the account (legitimate interest). Deleted 30 days after the session ends. |
| API and download logs: key, endpoint, time, IP address | To enforce plan limits and stop abuse (contract, legitimate interest). Deleted after 13 months. |
| Security log of account changes | To investigate misuse (legitimate interest). IP addresses removed after 12 months. |
| Data requests and complaints you send | To answer them (contract, legal obligation for complaints). |
We do not sell personal data, show advertising, or use tracking or analytics cookies. The site sets one essential cookie (nd_session) when you sign in, and remembers your light or dark theme in your browser's storage.
Who processes it for us
- Hosting provider (servers and backups)
- Email delivery provider (sign-in links, receipts, alerts)
- SSLCommerz (payments)
- Cloudflare (network security and delivery)
Each works under a written data-processing agreement. Where data moves between Bangladesh, the European Union and other countries, we use the European Commission's Standard Contractual Clauses and equivalent safeguards.
Your rights
You can ask to see, correct, export or delete your data, object to processing based on legitimate interest, or withdraw consent. Most of it you can do yourself on the account page (edit, delete account). Otherwise use the privacy request form; we answer within one month. You may also complain to a data protection authority.
Security
Passwords are hashed, API keys and sign-in tokens are stored only as hashes, connections use HTTPS, staff accounts use two-factor sign-in, and backups are encrypted. If a breach puts your data at risk we tell you and the authorities without undue delay.
Children
NagarData is not meant for children under 13 and we do not knowingly collect their data.
Changes
We will post changes here and email account holders about important ones.