Privacy policy
How Enterlumix collects, uses, shares and protects personal information across its live platform, merchant services and authentication integrations.
Effective and last updated
Use our onsite support form to send a request without opening an email app. Guests can submit requests without signing in; support still verifies identity and authority.
Business operator and contact
Enterlumix · Operated by Sultan Mahmod, founder and owner.
Shapla Chattar, Sadar, Rangpur, Bangladesh.
E-trade licence no. 2503012100064833.
Service and privacy requests: support@enterlumix.com.
Who we are and the scope of this policy
Enterlumix is a live commerce and merchant-operations platform operated by founder and owner Sultan Mahmod in Bangladesh. This policy covers our website, platform accounts, merchant, developer and partner workspaces, support and Enterlumix Authentication, including WhatsApp verification when enabled. Our business contact details appear below. Each independent merchant remains responsible for its own customer-facing privacy policy and lawful instructions for customer and staff information.
Information we collect
We collect information you provide, such as your name, email, phone number, country, account credentials, store memberships, support messages and submitted content. Merchant workspaces contain products, customer names, delivery addresses, phone numbers, orders, staff records, attendance, payroll, invoices and payment references as supplied through their use. We also process technical information such as IP addresses, request and security logs, browser/session identifiers and service usage needed to operate and protect the platform.
Sign-in, verification and Meta WhatsApp
Google sign-in can provide a provider identifier, name, email verification status and profile image. Email and WhatsApp verification use your chosen destination, a time-limited verification challenge and delivery or verification status. When WhatsApp authentication is enabled, your phone number and authentication message are sent through Meta’s WhatsApp Business Platform and any configured delivery provider to deliver the code you request and prevent abuse. Codes expire after five minutes. We do not request access to your WhatsApp contacts, personal chats, Google mailbox or provider password. WhatsApp setup or Meta approval does not make Facebook Login available.
Why we use information
We use information to create and secure accounts, verify sign-in and recovery requests, authorise store access, provide merchant tools and AI assistance, process billing and partner records, deliver requested communications, respond to support, prevent fraud and meet legal obligations. Where applicable, the basis is performance of our service agreement, legitimate operational/security interests, legal obligations or your consent. Consent-based marketing or tracking is not a condition of receiving a requested authentication code; withdrawing consent does not undo prior lawful processing.
Merchant customer and staff information
For records managed on behalf of a merchant, that merchant determines the business purpose and is normally the appropriate first contact for customer or employee requests. We process these records to provide the workspace and its authorised integrations. A store owner’s approval may be needed before changing shared records; one staff account cannot request deletion of another merchant’s data. We do not make private merchant records publicly available as AI documentation.
AI conversations, attachments and generated content
Guru AI processes your prompt, relevant conversation context, images or attachments and, inside an authorised workspace, relevant store records needed for the requested tool or answer. This context may be sent to the configured AI and image-generation providers. Web research may send search terms to a search provider. Public Guru does not have access to private store records; merchant chat is store-scoped and can be saved for continuity. Providers process requests under their own terms; we do not promise that all providers have identical retention or training settings. Avoid unnecessary personal data, passwords, OTPs and payment secrets, and review AI output before acting.
Sharing and international processing
We do not sell personal information. We disclose information needed to hosting/storage, email, identity, Meta WhatsApp, AI/search, payment, courier, supplier and support providers for the services you or your merchant enable. Authorised platform personnel may access records for operations, security and support. We may disclose information when legally required or to protect lawful rights and investigate abuse. Providers may process information outside Bangladesh; applicable provider terms and legally required transfer safeguards apply. Contact us for information about a particular integration.
Cookies and local storage
Session/security cookies support sign-in, store selection and request protection. Browser storage can preserve preferences, cart state and same-page form recovery; recovered text and files are held locally rather than uploaded solely for recovery. Merchant storefront pixels and customer-event integrations are controlled separately by each merchant and applicable consent. Read our Cookie notice and the store’s own notice.
Retention, deletion and exceptions
We keep account and workspace information while needed to provide the service and resolve support, security or legal obligations. Expiry of a verification code is not a promise that every related audit record is instantly erased. After a verified deletion request, we remove or anonymise data no longer needed; necessary billing, tax, fraud/security, dispute and legal-hold records can remain for the applicable obligation. Shared merchant records, backup copies and records held by independent providers may have different handling. We explain relevant exceptions and any additional time in our response instead of claiming an unsupported universal retention period.
Security and your privacy choices
We use authentication, tenant-scoped access, role permissions and operational safeguards to limit unauthorised access; no service can guarantee zero security risk. Contact support promptly about suspected compromise. Subject to applicable law, you may request access, correction, a copy/export, deletion, restriction or objection, or withdraw consent. We check identity and authority, aim to complete verified deletion requests within 30 days or explain a justified extension, and respect any shorter mandatory deadline. Our User data deletion instructions explain how to request account or WhatsApp-linked data deletion without signing in. You may also contact the competent privacy authority where applicable.
Children and policy updates
Enterlumix business accounts are intended for adults with authority to act for their business, not children under 18. Do not knowingly submit children’s personal information without a lawful basis and required authority. Contact us if such information has been submitted improperly. We publish policy changes with an updated effective date and communicate material changes through the service or account contact where appropriate.
To request account or WhatsApp-linked data deletion, follow our User data deletion instructions.
For assistance: support@enterlumix.com.