A quiet promise about your data

When you visit, shop, sign up or apply to the investor program, we collect a small amount of information:

• Contact details — name, email, phone, delivery address.
• Order history — what you bought, when, and where it shipped.
• Account preferences — saved addresses, wishlist items, brewing notes.
• Device & session signals — IP, browser, basic analytics, anti-fraud markers.
• Verification records — that you confirmed an OTP or email code, plus the timestamp.

An account lets us recognise you on a future visit so you don't re-enter addresses or repeat verification. Order history, default address and wishlist live on your profile and stay there until you ask us to remove them.

Card and mobile-wallet details never touch our servers. Payments are tokenised by our two providers:

• Stripe — international cards, USD checkout, Apple Pay and Google Pay.
• EPS Bangladesh — local cards, bKash, Nagad and other BDT methods.

We store only a reference to the transaction so we can match a refund or query later.

Strictly necessary cookies keep your cart and login working. We also use a light analytics layer (page views, search terms, basic conversion) to understand which guides and teas resonate. You can clear cookies any time from your browser without losing your account.

Our monthly letter is opt-in. Unsubscribe is one click — at the foot of every email — and removes you immediately. We never send your address to third-party marketers.

If you apply to the Tea Shop BD Investor Program, we additionally collect business background, location preference, indicative budget and — when you choose to upload them — National ID and Trade Licence scans for due diligence. These documents are restricted to the founders' review and are deleted on request if your application does not proceed.

To keep the site fast, your cart, wishlist and a few preferences live in your browser's localStorage rather than on our servers. Clearing site data resets them. Once you sign in, the same items sync to your account so they survive a device change.

Connections are encrypted end-to-end. We monitor for unusual order patterns, repeated failed verifications and known fraud signals. When something looks off, we may pause an order and contact you before shipping.

Orders shipped outside Bangladesh are processed under the same standards. Where local law (GDPR, UK GDPR, similar) grants stronger rights, we extend them to you regardless of where you ordered from.

• Access — request a copy of the data we hold on you.
• Correction — fix anything that is wrong or out of date.
• Deletion — close your account and erase personal records.
• Portability — receive your data in a machine-readable format.
• Objection — opt out of marketing or analytics at any time.

Write to hello@teashopbd.com with anything privacy-related. A founder, not an inbox bot, will reply within two working days.