Privacy
Oporanno runs online shops for businesses. Each shop decides what it sells and who it delivers to; Oporanno keeps the shop running and holds its records. This page says what is kept, why, and who else sees it.
Last changed 12 October 2026.
If you buy from a shop
To deliver an order, the shop keeps your name, mobile number, delivery address and what you ordered. An email address is kept only if you give one or open an account. An account also keeps a password, stored only as a one-way hash.
The shop uses these to confirm the order (often by phone), send it and answer you. The shop is the business you buy from: ask it first about your order and your details, using the contact details on the shop.
To stop fake orders, each order is also given a risk score. The score looks at how many earlier parcels to the same number were delivered or returned at all shops on Oporanno. Other shops see only those counts, never which shop or what you bought. In order records, the address of your connection is kept only as a keyed hash, and a random number in a cookie marks your browser; neither is used to follow you anywhere else.
If you type your mobile number at checkout and leave without ordering, the shop keeps it with what was in your bag for up to 30 days, so it can get in touch once to help. The checkout says so beside the phone field.
A review shows its stars, words, the name you give and any photos you add on the product page, for everyone. Your phone number and address are never shown. The shop can hide a review but cannot change it.
Oporanno shows no ads and adds no analytics. A shop may switch on its own Facebook pixel to measure its Facebook ads; then its pages load Meta's script, and Meta receives what is listed below. That shop's own privacy page says so.
If you run a shop
We keep your name, email, a password hash, your shop's settings and its products, orders and customers, so the shop can run. Keys for couriers, calls and other services you connect are stored sealed (encrypted).
Your customers' details belong to your business: use them only to serve those customers, and keep them safe when you export or copy them.
Who else receives personal data
Only these services, and only when the shop or the platform has switched them on:
- Couriers (Pathao, Steadfast, RedX). When a shop books a parcel: the buyer's name, phone, address and the cash to collect.
- Sworborno (confirmation calls). When a shop uses automated calls: the buyer's name, phone, address and the order, so a voice agent can call to confirm it.
- Meta (Facebook pixel and Conversions API). Only when a shop switches on its Facebook pixel: the pages and products a shopper views, what goes in the bag, and for each order its total and products with the buyer's phone and name as a one-way hash (never the address), plus the browser's address and name.
- SMS gateway. When an order needs a code to prove the number: the phone number and the code.
- Email (SMTP) provider. When an email is sent, such as a set-a-password link or a message from a shop's contact page: the address and the message.
- AI services (Anthropic, or a model reached through OpenRouter). When a merchant asks: a product photo to draft a listing, a pasted chat (which can hold a buyer's name, phone and address) to draft an order, a product's details to write a post caption, or the shop's order counts and totals (no names or phone numbers) to answer a question about the shop. When a shopper uses প্রশ্ন করুন: their questions in that chat, with the shop's products and delivery charges; the chat is not stored. Nothing else is sent.
- Image service (Muse, through Meta). When a merchant taps Touch up: the product photo.
Each of these services handles the data under its own terms. Oporanno does not sell personal data.
Cookies and browser storage
Only these. Only Facebook's two, on shops that switched on the pixel, are for advertising:
| Name | What it does | Kept for |
|---|---|---|
| haat_customercookie | Keeps a shopper signed in to their account at a shop. | 7 days |
| haat_orderscookie | A signed list of orders placed without an account, so they join the account if the shopper opens one later. | 60 days |
| oc_devcookie | A random number for this browser, used only by the fraud check to notice many different phone numbers ordering from one device. | 365 days |
| haat-cart, haat-recentyour browser only | The bag and the recently viewed products, kept only in the shopper's own browser. | until cleared |
| checkout-draft, checkout-buyer, checkout-ordersyour browser only | What was typed at checkout, the name, phone and address for the next order, and recent order numbers for tracking, kept only in the shopper's own browser. | up to 120 days |
| _fbp, _fbccookie | Set by Facebook's pixel, only on shops that switched it on: a random browser id, and the ad that was clicked to come here. | 90 days |
| haat_merchantcookie | Keeps a merchant signed in to the dashboard. | 7 days |
| setup-celebrated-…cookie | Remembers that the dashboard already showed the 'shop is ready' card. | 1 year |
How long records are kept
Orders and customer records stay while the shop has an account, because shops need them for deliveries, returns and their own accounts. When a shop asks to close its account, its records are deleted with it. A number left at checkout without an order is deleted after 30 days.
Seeing, correcting or removing your details
Ask the shop you ordered from. If you cannot reach the shop, or you are a merchant, write to hello@oporanno.com. A shop may need to keep an order record for its own accounts even after other details are removed.
Changes
When this page changes, the date at the top changes too.