Privacy Policy

Who we are

Skinmax BD is an online cosmetics retailer operating in Bangladesh. We decide what personal information is collected on this site and why, which makes us responsible for it. Privacy questions go to support@skinmaxbd.com.

What we collect, and why

• Your mobile number. It is how you sign in (we text a six-digit code rather than asking for a password), how we confirm an order, and how the courier reaches you. Without it there is no order.
• Your name and delivery address, including division, district and thana. A parcel cannot be delivered without them.
• Your email address, if you give one. Used for order emails. It is optional and an order works without it.
• Your orders: what you bought, what you paid, what happened to the parcel. We keep these as business records; they are also what you see in your own order history. When a product you bought should be running low, we may message you once on WhatsApp to ask how it went and whether you want another. Tell us and we will not.
• Your cart and wishlist. A guest cart is tied to a cookie, not to you. Once you sign in it merges into your account.
• What you search for on this site. Search terms are logged with the number of results they returned. This is how we find out that people are searching for something we do not stock, or that a spelling we do not handle is being typed twenty times a day. It is not linked to your name.
• A checkout you did not finish. When you type a valid mobile number at checkout, we keep that number and what was in your basket, even if you then leave without ordering. We use it for one thing: to message you once and ask whether something went wrong, and offer to place the order for you. The checkout page says so under the phone field.
• Glow Games stickers. After a game at /play you can type a phone number to get a sticker pack of the character you made. We text the link to your stickers to that number by SMS straight away. We keep that number, the name you put on your poster, your score and your character's settings (skin tone, hair, outfit), and use them to send the stickers and, now and then, skincare tips. The game says so under the number field. The character you make is kept only in your own browser unless you send it to us this way. The game also counts, for us, when it is opened, played, finished and shared, using a random id it keeps in your browser. That count carries no name, number or address and is not linked to an order or account. Please enter only your own number. If your number was entered by somebody else, contact us and we will remove it and send nothing further.
• Skin Guide and Skin Bestie routines. Under a routine in our Skin Guide or at the end of Skin Bestie you can type a phone number to have the routine texted to you, to get one reminder SMS four weeks later, or both. We keep that number, which routine it was for and what you asked for, and use them to send those texts and, if you did not mind hearing from us, one WhatsApp message to ask how the routine is going. The form says what will be sent before you send it.
• A number you leave so we can tell you something. “Tell me when it’s back” on a sold-out product, “Find it for me” on a search with no results, and “Send me my routine” after the skin test each store the number or email you type, with what you asked about. It is used only to answer that request.
• Technical information: IP address, browser, and the pages you visited, in ordinary server logs, and in analytics unless you have switched that off (below).
• Our own visit count. Unless you have switched analytics off, the shop also counts the pages you open, using a random id it keeps in your browser. With each page it stores only general buckets: phone or computer, the phone's make and model, the browser or app, the city and division your connection comes from, the site or post that sent you (for example a Facebook post), the time, and when you add something to your cart. On Skin Bestie and the routines in our guides it also counts which skin concern you picked, how far you got, your myth-quiz score and whether you tapped a WhatsApp button, to see what helps. On Skinie, our AI chat, it counts that you opened it, asked a question (and whether it was answered) and tapped a product it suggested, never what you typed or what it replied. It does not store your IP address or name.
• When you leave a number or email in a form (at checkout, “Tell me when it’s back”, “Send me my routine”, a Skin Guide or Skin Bestie routine, or the Glow Games sticker pack), and analytics is on, we note that this browser's visit count belongs to that number or email. That lets us see which products you looked at, so a message from us can be about what you were actually interested in. Switching analytics off in the footer stops this. To have it removed, contact us as below.

We do not collect your date of birth, your national ID, your income, or anything about your health beyond the skin concern you choose to filter by. We never ask for your card number or your bKash PIN. See below.

Payment details we never see

Card, bKash, Nagad and Rocket payments are handled entirely by our payment gateway (SSLCommerz) on their own page. Your card number, CVV and wallet PIN are entered there, are never sent to this site, and are never stored by us. What we receive back is a confirmation, which we then verify directly with the gateway before treating an order as paid. We store the amount, the method and the gateway's transaction reference. Because we do not hold your card number, CVV or wallet PIN, our records cannot be used to take a payment from your account.

Cookies, all three of them

• Your cart (skx_cart). Set when you add something to a cart while signed out, so the cart survives a page reload. It contains an identifier, not your items. Strictly necessary; the shop cannot work without it.
• Your session (a sb-…-auth-token cookie), set only when you sign in, so you stay signed in. Strictly necessary.
• Your analytics choice (skx_consent). Set only if you use Cookie preferences at the bottom of any page. It records that you turned analytics off — or that you turned it back on — so the setting survives. If you have never touched that panel, you do not have this cookie.

Google's and Meta's cookies are described in the next section, and you can remove them and stop them coming back at any time.

Analytics and advertising, and how to switch them off

We use Google Analytics 4 to understand which pages and products people actually use, and the Meta pixel so that advertising we pay for can be measured. Both are on by default, and you can switch both off from “Cookie preferences” at the bottom of any page.

This page is our notice of that use, and the switch at the bottom of every page is your choice. We follow the rules on analytics and advertising that apply to us in Bangladesh, where this shop operates.

When analytics is off, our site does not load the Google and Meta scripts, so this site does not cause your browser to contact either company or receive their cookies. Turning it off also removes the Google and Meta cookies this site placed in your browser and reloads the page.

The choice is honoured on our servers too. We can report a purchase to Meta from our own server; if you have switched analytics off, we do not send it.

While analytics is on, the events we send describe what happened: products viewed, items added to a cart, an order placed with its total. For orders, our server also sends Meta your mobile number, email and name hashed (SHA-256, irreversible), so that Meta can match the sale to an advert it showed without ever receiving the details themselves. Your IP address and browser type go with it, unhashed, because that is what the interface requires.

The choice is stored per browser, because a cookie is all we have to store it in. Switching it off on your phone does not switch it off on a laptop, and clearing your cookies clears the setting along with everything else.

Comments on our Facebook and Instagram posts

If you comment on a Skinmax BD post on Facebook or Instagram asking for a price or a link (words such as “price”, “dam” or “দাম”), Meta sends us that comment, its ID and the Meta-assigned ID of the account that wrote it, and our Page replies to you once, privately, in Messenger or Instagram Direct, with the shop link. This uses Meta’s Messenger Platform and Instagram API under Meta’s own terms.

• We do not save it to our database. The comment is read and the reply is sent. If a reply fails, the comment’s ID may appear in our server logs, which are kept for a short period and then deleted automatically. Your comment itself stays on Facebook or Instagram, where you control it.
• One reply per comment, and only to a comment that asked. We do not message anybody who did not comment, and we do not add you to any list.
• If you reply in that chat, the conversation is an ordinary message thread with our Page, held by Meta, and answered by a person.

How to have your data deleted

• Your account: delete it yourself from your profile page (see Your choices below).
• A number you left with us (an unfinished checkout, a stock alert, a saved routine or reminder, a sticker-pack request) or anything from Facebook or Instagram: email support@skinmaxbd.com with the number, email or account name involved. We may first ask you to confirm that the number or account is yours, for example with a code sent to it. Once confirmed, we aim to delete it within 7 days and tell you when it is done. Records we are required to keep, such as orders and invoices, are kept as described below. To remove the private reply our Page sent you, delete the conversation in Messenger or Instagram.

Who else receives your information

• Our courier partners get your name, phone number, address and the amount to collect. There is no way to deliver a parcel without this.
• Our payment gateway gets your name, phone, email and the amount, plus the payment details you type on their page, which we never see.
• Our SMS and email providers get your number or email and the message we are sending you.
• Google and Meta get the analytics described above, unless you have switched analytics off.
• Google (Gemini) receives the questions you type to Skinie, our AI chat, so it can write the answer. We send only the conversation, never your name, number or account, and we do not store the chat ourselves: it is kept in your own browser until you start a new one. Google may use these messages to improve its services, so please do not type personal details into the chat.
• Our hosting and database providers store the site and its data on our behalf.

We do not sell your personal information, we do not rent our customer list, and we do not pass your number to other sellers. If we are ever required to hand something over by a court or a lawful order of a Bangladeshi authority, we will comply, and tell you unless we are forbidden to.

How long we keep it

• Orders and invoices: at least six years. These are accounting records and we are not free to delete them on request.
• Account details: until the account is closed, which is yours to do, from your profile page, at any time.
• Guest carts: cleared automatically after a period of inactivity.
• Search logs: kept in aggregate; they are not attached to your name in the first place.
• Unfinished checkouts, stock alerts, saved routines and sticker-pack requests: until we have answered you (for a routine reminder, until it has been sent), and deleted sooner whenever you ask.

Your choices

• See what we hold: most of it is on your own account pages: orders, addresses, profile. Ask us for the rest; we will confirm the request comes from the owner of the number or account before we share anything.
• Correct it: name, email and address are editable yourself; changing your mobile number needs a code sent to the new number, because that number is your login.
• Delete it: yourself, from your profile page. It removes your login, profile, addresses, wishlist and basket straight away. You cannot delete while an order is still on its way; wait until it has been delivered or cancelled. Completed orders stay, as above, and the screen says so before you confirm.
• Stop the analytics: the banner, any time.
• Stop the messages: marketing SMS and refill reminders can be stopped on request. Messages about an order you placed are not marketing and will continue until the order is finished.

Children

Orders are for adults, or for under-18s with a parent or guardian's permission, as our terms say. We do not knowingly collect information from children under 13. A parent who believes we have should contact us and we will delete it.

The legal position in Bangladesh

We follow the Bangladeshi laws that apply to us, including any data protection law in force, the Consumer Rights Protection Act, 2009, and the record-keeping duties of the tax authority. Beyond what the law requires, we apply these principles: collect only what is needed, say what it is for, keep it no longer than necessary, do not sell it, and let you see and delete it.

Changes

If we change what we collect or who receives it, this page changes and the date at the top changes with it. A material change to tracking will also reset the cookie banner, so you are asked again rather than assumed to agree. See also our terms of service.