Privacy and cookie policy

"Software Chamber" is the trade name of M B H Mishu, a sole proprietor registered in Bangladesh by trade licence, with a place of business at Flat B-6, 6th Floor, Empire Zohora Akbar, 15/Gha, Modhubag Road, Hatirjheel, Dhaka 1217, Bangladesh ("we", "us"). The proprietor is the data controller for the personal data described in this policy: data about visitors to softwarechamber.com, people who contact us, client-portal users, job applicants and the contacts of our clients and suppliers.

When we build or operate software for a client, the client is the controller of the data inside that software and we act as a processor on the client's written instructions, under a Data Processing Agreement where the law requires one. That data is not covered by this policy; the client's own privacy notice applies.

We have not appointed a representative in the European Union or the United Kingdom. Questions about this policy and requests about your data go to info@softwarechamber.com with "Privacy" in the subject.

We collect only what we need to answer you, deliver the work and run the business:

• Inquiries: name, work email, phone or WhatsApp number, company, the services you are interested in, budget range, timeline and your message.
• Meeting bookings: the time you choose, your contact details and any notes you add so the engineer can prepare.
• Cost-calculator inputs: industry, scope, priorities, budget band and start date, plus your email if you ask for the estimate to be sent to you.
• Job applications: CV, portfolio links, cover note, the role you apply for and your answers to screening questions.
• Client onboarding: legal name, billing contact, invoicing address, tax identifiers (TIN, VAT or equivalent), bank details for payouts where relevant, and references to the cloud, repository and messaging accounts you nominate.
• Client-portal accounts: login email, name, organisation, role, project activity, documents you upload, comments, invoices, support tickets and an audit log of actions.
• Technical and security data: IP address (stored hashed for form submissions), browser and device type, referrer, pages viewed, form timing signals and bot-check results, as described in the cookies and bot-protection sections.
• Communications: emails, chat messages and meeting notes exchanged with us.

We do not ask for, and please do not send us, special-category data such as health, religious or biometric information unless a project genuinely requires it, in which case we agree the handling in writing first.

Each purpose below is matched to the legal basis we rely on under the GDPR and UK GDPR (where they apply) and to the equivalent ground under Bangladesh data-protection law.

We do not sell personal data, do not share it with data brokers, and do not make automated decisions that have legal or similarly significant effects on you.

We use three measurement tools. One is cookieless and always on; two set cookies and run only after you accept them in the banner. The banner offers Accept all, Reject all and Preferences with equal prominence; rejecting is as easy as accepting, and nothing is set until you choose. Your choice is stored in your browser so the banner does not reappear.

• Cloudflare Web Analytics (always on, no cookies, no consent needed). Measures aggregate traffic and Core Web Vitals. Sees the page URL, approximate country, referrer and device class. No cookies, no fingerprinting, no profiles. Data is kept by Cloudflare for up to 6 months in aggregate form. Provider: Cloudflare, Inc. (United States).
• Google Analytics 4 (cookie-based, only after you accept analytics). Measures which pages lead to inquiries, bookings, pricing requests and job applications. Sees a pseudonymous client id, truncated IP address, page URL, device and browser, and the conversion events below. Consent Mode v2 is enabled: nothing is sent and no cookie is set before you accept. Data is kept for 14 months. Provider: Google Ireland Limited and Google LLC (United States).
• Meta Pixel (cookie-based, only after you accept advertising). Measures ad-driven conversions so paid campaigns can be optimised. Loads only when advertising consent is given, after which it records page views and the conversion events below. Sees your IP address, browser user agent, pages and events. Data is kept by Meta for up to 180 days. Provider: Meta Platforms Ireland Limited and Meta Platforms, Inc. (United States).
• Conversion events sent to GA4 and Meta when consented: contact_submit (budget range and service type), meeting_book (meeting type and host id), pricing_calculator (budget range and scope) and apply_submit (position slug). No name, email, phone number or CV content is included in any event.

Managing your choice. You can change or withdraw consent at any time: use the Cookie settings link in the footer and the banner reappears; use your browser's tracking protection; or email us and we will disable analytics for the device you describe. Withdrawing consent deletes GA4's and Meta's first-party cookies from your browser and stops lead-session recording. Aggregate data already collected cannot be un-aggregated and stays with the provider for the periods above. Rejecting cookies does not affect your ability to use the site, contact us or book a meeting.

Every public form (contact, book a meeting, cost calculators, job applications and newsletter sign-up) is protected by three technical measures that run whether or not you accept cookies, on the basis of our legitimate interest in keeping spam and abuse out of our systems. They do not profile you and are not used for marketing.

• Cloudflare Turnstile: an invisible challenge from Cloudflare, Inc. (United States) that checks browser signals and your IP address and returns a token we verify on our server. Turnstile may set the Cloudflare cookies listed above on its own domain. Cloudflare's privacy notice applies to its processing.
• A honeypot field and a timing check: a hidden field that must stay empty and a check that the form was open for at least 1.5 seconds before submission. Submissions that fail are rejected and nothing is stored.
• Rate limits: at most 5 submissions a minute and 20 an hour from one IP address. Over the limit, the form returns a "try again later" message.

For each submission we log a hashed IP address, browser family, referrer, timestamp and form name. Personal data from the form is stored only if the submission succeeds.

If you become a lead by submitting the contact form, booking a meeting, requesting an estimate or applying for a job, and you have accepted analytics in the banner, our site records the pages you visit after that submission and how long you stay on them. The record is kept only in our own backend, never shared with Google, Meta or any ad network, linked to the inquiry you submitted, and deleted automatically 30 days after the last recorded visit.

We rely on our legitimate interest in preparing a relevant follow-up to a business inquiry; we have documented the balancing test. The record is visible only to our admin and manager staff, never to clients. Nothing is recorded for anonymous visitors, for visitors who declined analytics, or after you withdraw consent.

To opt out, email info@softwarechamber.com with the subject "No lead tracking" and the email address you used. We stop recording at once and delete existing records within 7 days.

We share personal data only with providers that help us run the Services, and only as much as each needs. Each is bound by a data-processing agreement or equivalent terms.

We do not share your data with any other third party. If we bring up a fallback server in another region (for example Singapore) we will add the provider to this table before any data is stored there. If the business is transferred to a successor company on conversion to a private limited company, your data transfers with it under the same policy and we will tell you.

Everything we hold as a controller — inquiries, applications, portal data, lead sessions, staff records — is stored at rest on a server in Falkenstein, Germany (European Union), with uploaded files and nightly encrypted backups in Cloudflare R2 storage set to the EU jurisdiction. The public website is served from Cloudflare's global edge, which caches page content but does not store your form submissions or portal data. We do not store personal data on servers in Bangladesh, the United States or any other country unless this policy names the provider.

Our staff work from Dhaka, Bangladesh, and access that data to serve you. Bangladesh has no adequacy decision under the GDPR or UK GDPR. For data about people in the EU or UK, that access takes place under the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, supported by the security measures in this policy and a transfer-risk assessment. Transfers to our United States providers (Cloudflare, Google, Meta, Resend, Sentry, payment providers) rely on the EU-US Data Privacy Framework where the provider is certified and otherwise on Standard Contractual Clauses.

For people in Bangladesh, your data is stored in the EU as described above. If Bangladesh data-protection law introduces storage or transfer conditions for particular classes of data, we will meet them and update this policy. If you are a client with a regulatory need for a specific storage region, tell us before the project starts and we will deploy your product to the cloud account and region you choose.

We keep personal data only as long as the purpose requires, then delete it. Backups are pruned on a rolling basis, so a deleted record can persist in encrypted backups for up to 60 days.

Data is encrypted in transit (TLS with HSTS) and at rest. Portal and API access uses short-lived tokens, strong password hashing, role-based permissions so each person sees only their organisation's data, lockout after repeated failed logins, and audit logs. Public forms run behind the bot protection described above. Backups are encrypted and tested. Staff and contractors use two-factor authentication, work under confidentiality obligations and have access only to what their role needs; access to a client's cloud is least-privilege and revoked at the end of the engagement.

No system is perfectly secure. If we become aware of a breach that affects you, we will tell you and, where required, the relevant authority without undue delay, and tell affected clients within 48 hours so they can meet their own obligations.

Depending on where you live and which law applies, you can:

• Ask for a copy of the personal data we hold about you and information about how we use it.
• Ask us to correct data that is inaccurate or incomplete.
• Ask us to delete your data where we no longer need it or you withdraw consent.
• Object to processing based on legitimate interests, including lead sessions and marketing, or ask us to restrict it.
• Withdraw consent at any time, including for cookies and marketing emails, without affecting what was done before.
• Receive your data in a portable, machine-readable format where processing is based on consent or contract.
• Not be subject to a solely automated decision with legal or similarly significant effects. We make none.

To exercise any right, email info@softwarechamber.com with "Privacy request" in the subject, or raise a ticket in the client portal. We may ask you to confirm your identity (for example by replying from the email address we hold). We respond within 30 days, and tell you if a complex request needs longer. Requests are free unless they are clearly unfounded or excessive.

Bangladesh. The Personal Data Protection Ordinance 2025 and its successor legislation give people in Bangladesh rights of access, correction, erasure and complaint similar to those above; we honour them now, before their commencement date, and will update this policy when the authority is in place.

European Union and United Kingdom. You also have the right to complain to the supervisory authority of the country where you live or work (for example the Information Commissioner's Office in the UK, or the Data Protection Commission in Ireland). We would appreciate the chance to resolve your concern first.

Gulf and other countries. Where the UAE, Saudi or another data-protection law applies to you, the rights it gives you apply alongside this policy.

Portal accounts exist for named people at client organisations. We process your account data to run the engagement under our contract with your organisation, which may also access your activity within its own workspace. Portal actions (approvals, comments, uploads, ticket updates) are logged for accountability and shown to your organisation's administrators and to our delivery staff. We do not use portal activity for marketing. When the engagement ends, accounts are closed as set out in the retention table.

When you apply through the site we collect your CV (PDF, DOC or DOCX up to 5 MB), portfolio links, cover note and answers, check that the file is what it claims to be, and share it only with the people involved in hiring. We keep applications for 12 months after the role closes so we can contact you about similar roles; tell us if you would rather we deleted it sooner, and we will. If you are hired, your application becomes part of your staff record. We do not use automated screening tools to reject applicants.

Our services are for businesses and adults. We do not provide Services to, or knowingly collect personal data from, anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

We update this policy when our Services, our providers, our business structure or the law change. The effective date and version number at the top identify the current version; the version history below records what changed. Material changes are highlighted on this page, and clients and portal users are told by email. We keep a copy of each version for 7 years.

Software Chamber (M B H Mishu, proprietor), Flat B-6, 6th Floor, Empire Zohora Akbar, 15/Gha, Modhubag Road, Hatirjheel, Dhaka 1217, Bangladesh. Email info@softwarechamber.com with "Privacy" in the subject, phone +880-1830-208833. Our internal privacy lead handles requests and breach notifications.

• Version 2.0, 28 October 2026: named the proprietor as controller; added the purpose and legal-basis table, the cookie and browser-storage table, the bot-protection section (Turnstile, honeypot, timing check, rate limits), the processor table, the international-transfer section, the retention table aligned with our records schedule, Bangladesh data-protection rights, Global Privacy Control, client-portal and job-applicant sections, and the version history.
• Version 1.1, 26 October 2026: added the three-tool analytics description, lead-session tracking and the Germany data-location statement.
• Version 1.0, 11 October 2026: first published Privacy Policy.