Privacy Policy

This policy describes how SSS Trading — a company registered in Bangladesh — collects, uses, stores, and shares information when you use any of our products and services. One policy covers the nine SSS companies and their supporting services.

01 Scope

This policy applies uniformly to SSS Trading and every product operated under it:

• SSS Portfolio · SSS Social · SSS Tech Builder · SSS Payments · SSS Shipping
• SSS Books · SSS Retail Ops · SSS Affiliates · SSS Investments
• Supporting surfaces and services, including B2B, Platform Admin, analytics, AI-assisted features, notifications, Lightcallers (WhatsApp business messaging & calling), and the mother website at ssstrading.site

References to "Services" below mean all of the above.

02 Information we collect

Information you provide. Name, email, password, phone, profile photo, business name and addresses, social handles, written content (bio, taglines, posts), payment metadata, and anything else you submit voluntarily.

From third-party login providers. When you sign in or connect a third-party account (Google, Meta/Facebook, GitHub, Discord, LinkedIn, Twitter/X, YouTube, Instagram, TikTok, Twitch, Spotify), we receive only the basic profile fields you authorise via that provider's OAuth dialog — typically provider user ID, name, email, avatar, and any platform-specific public data such as Facebook Pages you manage. We never receive your third-party password.

Automatically. IP address, browser/user-agent, device type, referrer URL, page-view timestamps, and basic usage events (clicks, profile views).

03 How we use it

• To create and authenticate your SSS account.
• To render your public profile, business card, CV, and the data feeds shown across SSS products.
• To deliver the specific feature you requested — publishing a post on your behalf, generating a PDF, processing an order.
• To send transactional notifications (login alerts, order updates, password resets).
• To detect, prevent, and respond to fraud, abuse, and security incidents.
• To compute aggregate, non-identifying usage statistics that help us improve the Services.

04 Meta platforms (Facebook, Instagram & WhatsApp) data

If you connect a Facebook or Instagram account, we use the access token issued by Meta solely to: (a) display your verified Facebook/Instagram identity on your SSS profile, (b) list the Facebook Pages you manage, the Instagram Business accounts linked to those Pages, and any Instagram professional account you connect directly with Instagram login (its user id, username, name and profile picture), and (c) at your explicit request, or at the time you scheduled, publish posts to those Pages or accounts.

We do not read private messages, friend lists, or any data you have not granted via Meta's OAuth consent. Tokens are stored encrypted and may be revoked at any time from your SSS settings or directly from Facebook.

WhatsApp business messaging & calling (Lightcallers). Our Lightcallers product connects to the WhatsApp Business Platform (Cloud API) operated by Meta so that a business can receive and respond to WhatsApp messages and calls. When someone messages or calls a business number connected to Lightcallers, Meta delivers a webhook to us that may contain the sender's WhatsApp phone number, WhatsApp profile name, message content, and call metadata (such as timestamps and call status). We use this data only to route and deliver the messaging and calling feature the business has enabled — we do not use it for advertising and we do not sell it.

WhatsApp webhook payloads are processed in transit and written to short-lived server logs used solely for delivery, debugging, and abuse prevention; these logs are retained no longer than needed for those purposes and are then rotated and deleted. All handling of WhatsApp data is additionally subject to Meta's WhatsApp Business Terms and Meta's Platform Terms. If you messaged a business, you can ask that business — or us — to delete your data; see our Data Deletion page.

05 Information stored on your device

Our products store a small amount of information in your browser's local storage and session storage on the device you use: the token that keeps you signed in, which workspace or store you last had open, enough to let a large upload in progress survive a page refresh, the page you were heading to before you were asked to sign in, an invitation you are in the middle of sending, and — in SSS Portfolio — which builder tips you have dismissed and whether you have finished the guided setup. We set no advertising or analytics cookies, we load no third-party advertising or analytics scripts, and we do not track you across other websites. You can delete all of it at any time with your browser's "clear site data" control; the only effect is that you will be asked to sign in again.

Two kinds of third party may place, access or recognise cookies or similar technology on your device:

• A platform you sign in with or connect. Signing in with Google (including YouTube), Facebook, Instagram, TikTok, Discord or GitHub happens on that provider's own website, where the provider may set its own cookies under its own privacy policy. We never see them.
• Our payment provider. If you buy a package, you are taken to a checkout page hosted by our merchant of record, Creem (creem.io), where the payment is entered. Creem may store information on your device to process the payment and prevent fraud, under Creem's own privacy policy, and that happens on Creem's pages rather than ours. Our own pages load no payment script and place nothing on your device for payment; no card details ever reach our servers.

06 How we share information

We do not sell your personal information. Sharing is limited to:

• Public profile data you have explicitly marked public is shown to anyone visiting your public SSS Portfolio URL.
• Service providers (cloud hosting, email delivery, payment processors) acting under contract on our behalf, only as needed to operate the Services.
• Legal requests when required by Bangladeshi law or a valid court order.
• Business transfers (merger, acquisition, asset sale) with continued protections at least as strong as this policy.

07 Data retention

We retain your account data while your account is active. If you delete your account, personal data is removed or anonymised within 30 days, except where retention is required by law (tax, accounting, fraud prevention, dispute resolution) — in which case retention is limited to the minimum required period.

08 Your rights

• Access and download your data from your SSS settings.
• Correct any field on your profile at any time.
• Disconnect any third-party social account, immediately revoking our access token.
• Request deletion of your data — see our Data Deletion page.
• Contact us with any privacy question or complaint.

09 Security

We use industry-standard practices: encrypted database storage, hashed passwords (bcrypt), TLS for all data in transit, and least-privilege access controls. No system is 100% secure, but we work continuously to protect your data.

10 Children

The Services are not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us data, contact us and we will delete it.

11 International users

SSS Trading is registered in Bangladesh. Your data is processed and stored on infrastructure that may be located in Bangladesh, Singapore, or other regions where our cloud providers operate. By using the Services you consent to this processing.

12 Changes

We may update this policy from time to time. Material changes will be announced by email or by a banner on the Services at least 30 days before they take effect.

13 Contact