Privacy policy

What BBR collects about you and why, who can see it, how long we keep it, and how to see, correct or delete it.

Last updated 6 November 2026

On this page

Who we are

Bangladesh Business Review (“BBR”, “we”) at bbr.com.bd is run by Taenite Limited, Banani, Dhaka, Bangladesh. We decide how the personal data described here is used, and we are responsible for it.

For anything about your personal data, write to privacy@bbr.com.bd.

This policy covers bbr.com.bd and the e-mails we send. It explains what we do with your personal data under the Personal Data Protection Act 2026 of Bangladesh. We collect only what we need to run BBR.

What we collect

Your account: Your name, your e-mail address and your password, which we store only as a scrambled hash that nobody can read back. If you add a passkey or two-factor authentication, we store only what is needed to check them: never your fingerprint or your face.
Signing in with Google: If you use “Continue with Google”, Google tells us your name, your e-mail address and your Google account ID, and we copy your Google profile photo once, as your avatar.
Your profile: The username, headline, bio, district, links and photo you choose to add.
What you post and do: Your reviews with the month of your visit, your photos, owner replies and blog posts, earlier versions of reviews you edited, your upvotes and helpful votes, the reports you send, the businesses you add, and the notifications we send you.
Business claims: Your role at the business, the phone number and e-mail address you give our team, your message, and any documents you send.
Messages to us: What you write when you e-mail us.
Technical data: Your IP address, your browser and device, and the pages you ask for, which our servers record. While you are logged in or filling in a form, our database also keeps your session with your IP address and browser. When you do certain things, such as changing your e-mail address or editing a business listing, we also record what you did and your IP address.
About businesses: Listings hold a business’s name, address, phone number, e-mail address and website, given by members, by the business or by our team. Our team also adds listings, and details of listings, from public sources, such as OpenStreetMap, online maps and businesses’ own websites and social media pages; these go live without the check we give the listings members suggest. For a business run by one person, these can be that person’s details. A business, or the person behind one, can ask us to correct or remove them: report the listing on its page, or write to privacy@bbr.com.bd.

We never ask for your national ID, and you don’t need to give a phone number to use BBR.

Why we use it

To run BBR: your account, your profile page and what you publish.
To check new listings and ownership claims, to moderate content and to handle reports.
To keep BBR safe: protecting sign-in, limiting how often actions can be repeated, spotting fake accounts and abuse, and keeping a record of important actions such as our team’s decisions.
To put businesses and reviews in order. For example, upvotes and reviews from accounts only a few days old count less towards trending, and reviews by members with a track record come a little higher.
To count visits to business pages and blog posts, how often a business is shown in a list on BBR and opened from it, and how often its contact links (call, WhatsApp, website, directions) are used, each once per visitor a day. To tell visitors apart we use a one-way code made from the IP address and browser, which runs out at midnight and is deleted that night; the counts themselves hold no personal data, and a business’s owner sees only its totals. Our team’s own visits are not counted.
To see how many people visit BBR, which pages they open and how fast those load, with Orlyn, our analytics service (below). It sets no cookie, and we do not tell it who you are.
To e-mail you about your account and what you post: confirming your address, resetting your password, a reply to your review, a decision on a business you added or claimed, and, for owners, new reviews of their business. We send no newsletters or advertising.
To meet our legal obligations, and to deal with legal claims.

We don’t sell personal data, we don’t show advertising, and we don’t use your data to build profiles for advertisers.

What other people can see

Public: your name, username, profile photo, headline, bio, district and links, the month you joined, and how many reviews and helpful votes you have; your reviews with their photos and the month of your visit; your owner replies, shown as the business’s; and your blog posts. Search engines can show public pages.
Never shown: your e-mail address, your phone number, the documents you send us, the businesses you upvoted or reported, whether you own or added a business, and anything about the security of your account.
Businesses never see your e-mail address. An owner sees reviews of their business as everyone does, and how many people viewed and upvoted it, never who.
Our team sees what it needs to run and moderate BBR, such as your account’s e-mail address, the reports about your content and the details of your claims. Our team’s decisions are recorded.

We share personal data only with the service providers that help us run BBR, listed below, and only what each of them needs. They may use it only to provide their service to us.
We disclose information to the authorities only when the law requires it, as our legal requests page explains.
If BBR is ever sold or merged, your data would pass to the new owner under this policy, and we would tell you first.

Service providers and transfers abroad

Hosting: SiteGround, Singapore: our servers, with our database, the files you upload and the daily copies of them.
E-mail delivery: SiteGround, Singapore: the e-mails we send you, with your e-mail address and their content.
E-mail you send us: Messages to our addresses are forwarded to the mailboxes of the people who run BBR, which may be with another e-mail provider outside Bangladesh, such as Google in the United States.
Google sign-in: Google LLC, United States: only if you choose “Continue with Google”.
Cloudflare Turnstile: Cloudflare, Inc., United States: when it is switched on, the check that tells people from bots on the sign-up, password reset and add-business forms. It sees your IP address and details of your browser.
Orlyn analytics: Taenite Limited, Bangladesh, which keeps its data in the United States (Google Cloud): it counts the pages people visit and measures how fast they load. Every page loads its script, which sends Orlyn the page’s address (without what follows “?”, apart from campaign tags), the site you came from, your screen width, how long you stay and how fast the page loaded; like any website, Orlyn also sees your IP address and browser. It sets no cookie and stores nothing on your device.

Our servers are in Singapore, so everything BBR stores, your personal data included, is transferred outside Bangladesh and kept there. Google and Cloudflare, when you use them, and the mailboxes your messages to us are forwarded to, also handle data outside Bangladesh. So does Orlyn, which keeps the visits it counts in the United States. We use these providers under their own data protection terms and send them only what their service needs. Apart from the bot check and Orlyn’s analytics script, everything on our pages, fonts included, comes from our own servers.

How long we keep it

We keep personal data only as long as we need it:

Your account and profile: As long as your account exists. When you delete your account, they are deleted at once, apart from what the records of important actions below keep.
Reviews with their photos, and posts: Until you delete them, or your account. A review or post our team removed stays visible to you and to our team, with the reason, until your account is deleted.
Upvotes and helpful votes: Until you take them back, or delete your account. When you take an upvote back, we keep a record of when you first upvoted that business, so that a new upvote counts from then. Nobody sees it, and it is deleted with your account, or with the business if that is deleted for good.
Notifications: The notifications we send you are kept until your account is deleted: you can mark them read, not delete them. When you delete a review, the notice the business’s owner got about it no longer shows your name or the review’s title.
Replies you wrote for your business: They stay on the business’s page after your account is deleted, as the business’s replies, without your name.
Listings you added or manage: A business’s listing stays on BBR after your account is deleted, with the details and photos you added to it: it is about the business, not about you. If you manage it, your ownership of it ends.
Reports you sent: Kept by our team. After your account is deleted, they stay without your name.
Earlier versions of edited reviews: Seen only by our team, and deleted with the review, or when a review is removed for personal information, offensive or illegal content.
Claim documents: Deleted 90 days after our latest decision on the claim: approving it, rejecting it or ending the ownership.
Other claim details: Your role, phone number, e-mail address and message stay with the claim, so that we can settle later disputes about who runs a business, until your account is deleted.
A business you are adding: An unsent draft is kept for 7 days after your last change. Its photos and documents are deleted the night after it expires.
Visit counts: The code that tells visitors apart runs out at midnight and is deleted from our database that night. The daily counts hold no personal data.
Sessions and limits: Your session ends 2 hours after you last use BBR, or when you log out, which deletes it from our database at once. A session that ran out stays there, with your IP address and browser, until BBR next clears out old sessions, which it does from time to time as people use it. The counters behind our limits run out within a day and are deleted the night after.
Server logs and errors: Our hosting provider records each request to our servers, with its IP address, in a file a day, and we delete each file once it is 14 days old. It also keeps statistics of the visits, in a file a month that lists the IP addresses that visited: the file is updated until a day or two after the month ends, and we delete it 14 days after that, so an IP address stays in it for at most 7 weeks. BBR keeps its own log of errors in a file a day, and deletes each file once it is 14 days old. When something fails, our team also gets a short e-mail that says what failed and where, never who was using BBR.
Records of important actions: Our team’s decisions, changes to business listings, changes of e-mail address and account deletions are recorded with the name and username of the account at the time and, for actions people take, their IP address. A change of e-mail address is recorded with the old and the new address. We keep these records for as long as BBR runs, after the account is deleted too, so that we can account for every decision. The IP address in these records is deleted after 12 months.
Suspended accounts: Kept, so that a suspension can’t be undone by deleting the account and signing up again.
Backups: Our hosting provider copies everything on our servers, our database and files included, every day, and keeps each copy for 30 days. Before each update of BBR we also copy our database, and keep the copies made before the last 5 updates. So data you delete stays in the daily copies for 30 days. If a copy made before an update holds it, it stays until 5 later updates have replaced that copy, and 30 days more in the daily copies.

Keeping it safe, and the risks

No system is perfectly safe, but we work to keep your data secure:

Passwords are stored only as a hash, and you can add a passkey or two-factor authentication to your account.
Photos you upload to show on BBR are re-encoded, which removes hidden data such as the place where a photo was taken.
Claim documents are kept in private storage and never shown on a page. Only our team, and you while your claim waits, can download them, and every download by our team is recorded.
Our team members can do only what their role allows, and their decisions are recorded.

The main risks, and what you can do about them: anything you post publicly can be copied or shared by others, and search engines may keep showing it for a while after you delete it, so think before you post. A password you use elsewhere can let someone into your account, so give BBR a password of its own. Reviews can upset the businesses they are about, so describe what happened rather than accusing anyone.

If a security breach puts your data at risk, we will tell the National Data Management Authority as the law requires, and tell you if your account is affected.

Your rights

Under the law of Bangladesh, you can:

see the personal data we hold about you, get a copy of it, and learn who we have shared it with;
correct it;
have it deleted;
withdraw your consent, or object to how we use your data.

Your account settings let you change your profile, your e-mail address and your password, and delete your account. For anything else, write to privacy@bbr.com.bd from the address on your account, so that we know it is you. We answer within 30 days, free of charge.

To delete your account, you need a verified e-mail address and your password. If you signed up with Google, set a password first with “Forgot password”. A suspended account can’t be deleted, so that the suspension stays in force.

Where the law requires us to keep some data, or we need it to settle a dispute, we may keep it after a request, and we will tell you so.

Cookies and storage in your browser

BBR uses only the cookies it needs to work. We set no advertising, analytics or tracking cookies. Orlyn, our analytics service, sets none either, and stores nothing in your browser.

Reading BBR’s public pages sets no cookie at all. The first two below are set when you open a page that needs them: the log-in or sign-up page, a form such as adding a business, or an upvote, a vote or a report you start before logging in.

bbr-session: Keeps your session from page to page: whether you are signed in, and short-lived things such as a form you are filling in or a message to show you. It expires 2 hours after you last use BBR.
XSRF-TOKEN: Set with the session cookie. Stops other websites from sending our forms in your name. It expires with the session.
remember_web_…: Only if you tick “Remember me” when you log in. Keeps you signed in on that browser for up to 400 days, until you log out.
appearance: Remembers whether you chose light, dark or your device’s setting, for a year; your browser’s local storage keeps it too. It is set when you choose, or when you first open the sign-in pages or your dashboard.
sidebar_state: Only in your dashboard. Remembers whether its sidebar is open, for a week.

Your browser’s local storage also keeps drafts you haven’t sent yet, so you don’t lose what you typed: a review you are writing, for 30 days, and a business you are adding, until you send it or log out. They never leave your device until you send them.

When the bot check runs on a form, Cloudflare’s script collects details of your browser to tell people from bots. You can delete cookies in your browser at any time; you will then be signed out.

Children

BBR accounts are for people aged 18 and over. If you believe a child has an account, tell us at privacy@bbr.com.bd and we will delete it.

Complaints

If you are unhappy with how we handle your data, write to us first at privacy@bbr.com.bd: we want to put it right. If we can’t, you can complain to the National Data Management Authority, the regulator under the Personal Data Protection Act 2026.

Changes to this policy

We will update this policy when what we collect, or how we use it, changes. When a change matters, we will say so on BBR before it takes effect. The date at the top of this page shows when it last changed.