Privacy Policy

Last updated: 5 October 2026

SPOILT, based in Dhaka, Bangladesh, operates this store. This notice explains our handling of customer information, delivery details, communications and online tracking. We currently deliver within Bangladesh. It is a privacy notice, not a request for blanket consent.

Information · Uses · Promotions · Cookies · Your choices

1. Information we handle

• Information you provide: name, email, phone, delivery/billing address, selected products and sizes, account and wishlist preferences, order notes and support messages. Returns may involve photographs or an optional unboxing video.
• Transactions: order contents, amounts, payment method and confirmation/reference, delivery progress, returns and refund records. Payment providers handle their payment credentials. Never send SPOILT a PIN, password, OTP or full card details.
• Device and activity: IP address, browser/device type, referring pages and, where permitted, product views, searches, clicks, cart and checkout events, purchases and cookie identifiers.
• Information from partners: payment confirmations, delivery status and, when enabled with the relevant permission, analytics or advertising reports. We keep records of consent choices and withdrawal requests.

2. Why we use it

We use necessary information to confirm and fulfil orders, arrange delivery, communicate payment/order updates, answer support requests and manage returns, refunds and disputes. We also maintain necessary business records, meet legal obligations and protect against fraud or misuse.

Optional uses, subject to the relevant choices, include remembering shopping preferences, personalised recommendations, measuring product views/searches/carts/purchases, evaluating advertising performance and retargeting advertising. These activities do not mean that we record your screen or follow your physical movements.

Where a legal basis is required, order processing relies on performing the purchase contract or taking steps you request before purchase; legally required records rely on legal obligations; proportionate security, fraud prevention and claim handling may rely on legitimate interests, subject to your rights. Optional tracking and our promotional communications rely on the applicable consent. Declining optional uses does not prevent a purchase.

3. Email, SMS and WhatsApp

Providing an email address or phone number for an order does not subscribe you to promotions. We use these contact details for fulfilment and related service communications, and for promotional messages only when you separately agree to the particular channel.

• Service messages: confirmations, payment/delivery updates, delays and communications about a support, return or refund request. These are separate from marketing.
• Promotions: offers, product launches, newsletters, abandoned-cart reminders and review requests are sent only through a channel for which you have opted in. Agreeing to email does not agree to SMS or WhatsApp.
• Requested alerts: a back-in-stock alert you specifically request is limited to that request. It does not enrol you in general promotions.

Use the unsubscribe link in an email, reply STOP where replies are supported, or contact us with the channel and address/number you want removed. You can withdraw one channel or all channels. An unsubscribe request does not cancel an order; necessary order and legal communications may continue. We retain a limited suppression record where necessary to avoid resubscribing you accidentally.

Cookie acceptance, creating an account, purchasing, contacting support, or accepting sales terms is not promotional-message consent. See Promotional Preferences to contact us about your choices.

4. Sharing and delivery partners

We disclose information relevant to the service to Shopify and technology/support providers; payment providers; delivery partners; and communication providers that help deliver requested messages. A courier receives the recipient, delivery address, contact number and relevant order/COD details, not an unrestricted customer database. Delivery partners can change, so this notice uses service categories rather than a fixed courier list. Ask us which partner handled your order.

Enabled analytics or advertising services, such as Meta or Google if configured, may receive permitted browser identifiers and store events for the purposes you allow. Advertising-event sharing is different from uploading contact lists. SPOILT does not upload customer email/phone lists for advertising audiences, sell or rent customer lists, or use session-replay recordings. We do not give partners permission to use delivery contact information for their unrelated marketing.

We may disclose necessary information to advisers, authorities or other recipients where required by law or reasonably necessary to establish, exercise or defend legal claims. We limit disclosure to the relevant purpose.

5. Shopify and other providers

Shopify hosts the store and supplies commerce, checkout, security and certain analytics/privacy infrastructure. Depending on the activity, Shopify processes information for us or for purposes for which it is independently responsible. Read Shopify's Privacy Policy and Cookie Policy for its practices. SPOILT remains responsible for the processing and settings it controls; this notice does not transfer all responsibility to Shopify.

Providers may process information outside Bangladesh. Where applicable privacy law requires safeguards for international transfers, the relevant processing must use the required safeguards. Contact us for information about the recipients and safeguards relevant to your request. External websites and social platforms apply their own privacy notices when you choose to use them.

6. Cookies, storage and tracking choices

Cookies and similar storage can keep your cart/session working, remember choices, or support optional analysis and advertising. Necessary security, checkout, cart and consent-preference storage supports the service you request. Optional categories are:

• Preferences: remembered choices and personalised shopping features.
• Analytics: understanding visits, searches, product views, carts and purchases.
• Advertising: ad measurement and retargeting through enabled services.

Where the SPOILT cookie panel is shown, choose Accept necessary to keep optional cookies off, or Manage to choose individual optional categories and save your choices. On a first visit, closing it does not grant optional consent. Closing a reopened settings panel leaves an existing saved choice unchanged. Use Cookie Settings in the footer to revise the choices. The panel sends choices to Shopify's Customer Privacy API; independent tools must also be configured to honour them. Availability of a category is not a statement that every service in that category is installed.

The panel remembers a choice for up to 180 days in this browser; Shopify and enabled providers have their own cookie lifetimes, described in their cookie information. Browser settings also let you clear or block storage. Blocking essential storage may affect checkout. Choices are browser/device-specific and clearing storage can cause the panel to appear again. Withdrawing consent stops future consent-dependent processing; it does not automatically erase past lawful records.

7. Retention and security

Retention depends on the purpose: order/payment records are kept for required accounting, tax, dispute and legal periods; support evidence for resolving and documenting the matter; account/preferences while needed for the requested service; and consent/suppression records as needed to demonstrate and respect your choices. We review information for deletion or anonymisation when no longer needed, subject to legal holds and backup cycles. Contact us for the applicable period or criteria for your records.

Access should be limited to team members and service providers who need information for their duties. No online service can promise absolute security. Please protect your account and contact us promptly about suspected misuse. Send only information relevant to your request and avoid unrelated personal details in images or videos.

8. Requests, complaints and children

Contact contact@spoiltbd.com or phone/WhatsApp +8801572974804 for access, correction, deletion, consent withdrawal or a privacy complaint. We may request proportionate identity verification. Some records cannot be deleted immediately because of legal or transaction requirements; we will explain relevant limits.

Where EU/EEA or UK data-protection law applies, you may also have rights to restrict processing, object, receive portable data, and complain to the relevant supervisory authority. We respond within applicable legal deadlines; where the GDPR applies this is normally one month, subject to permitted extensions with notice. These rights apply according to the relevant law, not solely because this site can be viewed overseas.

Children should use purchasing/account services with an appropriate parent or guardian. We do not intentionally target children with behavioural advertising. Tell us if a child has supplied information inappropriately so we can assess and address it.

9. Changes and contact

We update this notice when our practices change and revise the date above. Material new consent-based purposes require a new choice where applicable; continued browsing alone does not grant that consent. SPOILT — Dhaka, Bangladesh. Support is available 24/7 at contact@spoiltbd.com and +8801572974804.