Privacy Policy

Who we are

Skinmax BD is an online cosmetics retailer operating in Bangladesh. We decide what personal information is collected on this site and why, which makes us responsible for it. Privacy questions go to support@skinmaxbd.com.

What we collect, and why

• Your mobile number. It is how you sign in (we text a six-digit code rather than asking for a password), how we confirm an order, and how the courier reaches you. Without it there is no order.
• Your name and delivery address, including division, district and thana — a parcel cannot be delivered without them.
• Your email address, if you give one. Used for order emails. It is optional and an order works without it.
• Your orders — what you bought, what you paid, what happened to the parcel. We keep these as business records; they are also what you see in your own order history.
• Your cart and wishlist. A guest cart is tied to a cookie, not to you. Once you sign in it merges into your account.
• What you search for on this site. Search terms are logged with the number of results they returned. This is how we find out that people are searching for something we do not stock, or that a spelling we do not handle is being typed twenty times a day. It is not linked to your name.
• Technical information — IP address, browser, and the pages you visited — in ordinary server logs, and in analytics only if you agreed to it (below).

We do not collect your date of birth, your national ID, your income, or anything about your health beyond the skin concern you choose to filter by. We never ask for your card number or your bKash PIN — see below.

Payment details we never see

Card, bKash, Nagad and Rocket payments are handled entirely by our payment gateway (SSLCommerz) on their own page. Your card number, CVV and wallet PIN are entered there, are never sent to this site, and are never stored by us. What we receive back is a confirmation, which we then verify directly with the gateway before treating an order as paid. We store the amount, the method and the gateway's transaction reference — nothing that could be used to charge you again.

Cookies — all three of them

• Your cart (skx_cart). Set when you add something to a cart while signed out, so the cart survives a page reload. It contains an identifier, not your items. Strictly necessary; the shop cannot work without it.
• Your session (a sb-…-auth-token cookie), set only when you sign in, so you stay signed in. Strictly necessary.
• Your answer to the cookie banner (skx_consent). It records whether you said yes or no, so you are not asked again. Deleting it makes the banner reappear.

Any other cookie on this site — Google's or Meta's — exists only if you pressed Accept, because of the next section.

Analytics and advertising, and what “No thanks” really does

We use Google Analytics 4 to understand which pages and products people actually use, and the Meta pixel so that advertising we pay for can be measured. Both are optional and both are off until you say otherwise.

This is stronger than most cookie banners, and the difference is worth stating plainly: until you press Accept, the Google and Meta scripts are not loaded at all. They are not loaded and told not to collect — your browser makes no request to either company and neither gives you a cookie. If you press No thanks, that stays true.

The refusal is honoured on our servers too. We can report a purchase to Meta from our own server, where no ad blocker could stop it; if you have not agreed, we do not send it. A shop that respects a refusal in the browser and quietly posts the same event from its server has not asked a question, it has performed one.

When you have agreed, the events we send describe what happened — products viewed, items added to a cart, an order placed with its total. For orders, our server also sends Meta your mobile number, email and name hashed (SHA-256, irreversible), so that Meta can match the sale to an advert it showed without ever receiving the details themselves. Your IP address and browser type go with it, unhashed, because that is what the interface requires.

To change your mind, delete the skx_consent cookie in your browser settings and answer the banner again.

Who else receives your information

• Our courier partners get your name, phone number, address and the amount to collect. There is no way to deliver a parcel without this.
• Our payment gateway gets your name, phone, email and the amount — and the payment details you type on their page, which we never see.
• Our SMS and email providers get your number or email and the message we are sending you.
• Google and Meta get the analytics described above, and only with your consent.
• Our hosting and database providers store the site and its data on our behalf.

We do not sell your personal information, we do not rent our customer list, and we do not pass your number to other sellers. If we are ever required to hand something over by a court or a lawful order of a Bangladeshi authority, we will comply — and tell you unless we are forbidden to.

How long we keep it

• Orders and invoices: at least six years. These are accounting records and we are not free to delete them on request.
• Account details: until you ask us to close the account.
• Guest carts: cleared automatically after a period of inactivity.
• Search logs: kept in aggregate; they are not attached to your name in the first place.

Your choices

• See what we hold: most of it is on your own account pages — orders, addresses, profile. Ask us for the rest.
• Correct it: name, email and address are editable yourself; changing your mobile number needs a code sent to the new number, because that number is your login.
• Delete it: ask, and we will close the account and remove your profile, addresses and wishlist. Completed orders stay, as above, and we will tell you exactly what remains.
• Stop the analytics: the banner, any time.
• Stop the messages: marketing SMS can be stopped on request. Messages about an order you placed are not marketing and will continue until the order is finished.

Children

This shop is not intended for children under 13, and we do not knowingly collect their information. A parent who believes we have should contact us and we will delete it.

The legal position in Bangladesh

Bangladesh does not yet have a single comprehensive data protection act; a draft has been under consideration for several years. In its absence we apply the principles that law is expected to codify and that we think are right anyway: collect only what is needed, say what it is for, keep it no longer than necessary, do not sell it, and let you see and delete it. Where a Bangladeshi law does apply — the Consumer Rights Protection Act, 2009, and the record-keeping duties of the tax authority — we follow it.

Changes

If we change what we collect or who receives it, this page changes and the date at the top changes with it. A material change to tracking will also reset the cookie banner, so you are asked again rather than assumed to agree. See also our terms of service.