Get In Touch

Privacy Policy

How we collect, use, and protect personal data on reformedtech.org.

Privacy Policy

Effective date: 2 May 2026  ·  Last updated: 2 May 2026

This Privacy Policy explains how ReformedTech ("we", "us", "our") collects, uses, shares, and protects personal data in connection with reformedtech.org (the "Site") and the related services we provide. We aim to keep this policy plain, specific, and honest about what we actually do — rather than listing categories of data and processors that do not apply to our business.

By using the Site you accept the practices described below. If you disagree with any part of this policy, please do not use the Site. Questions, requests, and complaints can be sent to contact@reformedtech.org.

Contents

  1. About this policy
  2. Who we are (Data Controller)
  3. What personal data we collect
  4. How we collect it
  5. Why we use it (lawful basis)
  6. When we share it
  7. International transfers
  8. How long we keep it
  9. Cookies and local storage
  10. Your rights
  11. Children's privacy
  12. Security
  13. Changes to this policy
  14. Governing law and jurisdiction
  15. Contact us

1) About this policy

This policy applies to anyone who interacts with ReformedTech through the Site, including visitors who browse pages, people who use the AI chat assistant, and people who contact us by email, phone, or through forms on the Site. It covers personal data we collect online; engagements with paying clients are additionally governed by individual contracts and master services agreements.

2) Who we are (Data Controller)

ReformedTech is a Bangladesh-based software development company founded in 2017. We are a member of the Bangladesh Association of Software and Information Services (BASIS).

For the purposes of applicable data protection law, ReformedTech is the controller of personal data collected through the Site.

Registered address: House 32/1, Road 03, Shyamoli, Dhaka-1207, Bangladesh.
Email: contact@reformedtech.org

3) What personal data we collect

We collect a deliberately narrow set of personal data. The categories are:

  • Contact information. Name, business email address, phone number, company name, and any other details you choose to share when you submit a contact form or send us an email.
  • Inquiry content. The message body, project description, or other content of any inquiry you send us by email or through a contact form on the Site.
  • Chat assistant contact details. When you use our AI chat assistant, the assistant collects the name, email address, and (optionally) phone number you choose to share so we can follow up if there is a real opportunity to work together. The body of the conversation itself is processed in real time to generate replies and is not retained as a permanent record on our chatbot service beyond the active session.
  • Edge-level technical data (handled by Cloudflare). The Site is a statically generated website delivered through Cloudflare's network. We do not run our own application servers and we do not maintain our own access logs. Cloudflare may, in the course of routing your requests and protecting the Site, process limited technical data such as your IP address, browser type, and referring URL for security, abuse prevention, and performance purposes. This processing is governed by Cloudflare's own privacy policy and is not retained by us directly.

We do not collect special-category data (for example: health, biometric, or political-opinion data), payment-card data, government-issued ID numbers, or location data from mobile devices. The Site has no user accounts, no payments, and no user-generated content features.

4) How we collect it

We collect personal data in three ways:

  • Directly from you. When you fill in a contact form, send us email, talk to the chat assistant, or call us.
  • Through Cloudflare's edge network as part of delivering the Site to your browser, as described in Section 3. We do not retain copies of these technical records ourselves.
  • Through your browser's local storage. The chat assistant uses your browser's localStorage to retain the most recent chat session for up to one hour, and a small flag is stored to remember that you have dismissed our privacy notice. Both items live on your own device and are described in Section 9.

5) Why we use it (lawful basis)

For visitors in jurisdictions that recognise lawful-basis frameworks (such as the EU/UK GDPR), we rely on the following bases:

  • To respond to inquiries you initiate — lawful basis: legitimate interest, and where applicable, taking steps prior to entering a contract.
  • To operate, secure, and improve the Site — lawful basis: legitimate interest. This covers the edge-level processing carried out by Cloudflare on our behalf, abuse prevention, performance monitoring, and the operation of the chat assistant.
  • To send you service or administrative messages — lawful basis: legitimate interest, and where applicable, performance of contract.
  • To send you marketing or commercial communications (only when you have asked to be contacted in this way) — lawful basis: consent.
  • To comply with legal obligations and resolve disputes — lawful basis: legal obligation, and legitimate interest in defending and enforcing our rights.

You can object to or withdraw any consent-based processing at any time by emailing us. See Section 10.

6) When we share it

We share personal data only in the limited circumstances below. We do not sell personal data, and we do not share personal data with advertising networks, data brokers, or marketing-tech providers.

Service providers we rely on to deliver the Site. The Site is built and operated using a small set of third-party infrastructure providers. Each may process limited technical data (typically IP addresses) in the ordinary course of serving requests:

  • Cloudflare, Inc. (United States) — content delivery, edge hosting, and security/abuse-prevention infrastructure.
  • Google LLC (United States) — delivery of typefaces from Google Fonts when your browser requests them.
  • ReformedTech's own chat infrastructure at chatbot.reformedtech.org, which we operate ourselves. Messages you send to the chat assistant are processed there in real time to generate replies. The contact details you choose to share during the conversation (name, email, and optionally phone) are retained as a follow-up record; the conversation body itself is not retained as a permanent record on the chatbot service.

Professional advisers. We may share personal data with our accountants, auditors, and legal advisers where this is necessary for them to provide their services. They are bound by professional duties of confidentiality.

Legal compliance. We may disclose personal data where required by applicable law, court order, or a binding request from a governmental authority. We may also disclose personal data where necessary to investigate suspected fraud, protect the rights and safety of ReformedTech and others, or defend ourselves in legal proceedings.

Business transitions. If ReformedTech is involved in a merger, acquisition, financing, or sale of all or part of its assets, personal data may be transferred to the counterparty as part of that transaction. We will require the receiving party to honour this Privacy Policy.

7) International transfers

ReformedTech is established in Bangladesh, but the Site is reached by visitors and clients in many countries, and some of the third-party providers listed in Section 6 are based outside Bangladesh (for example, Cloudflare and Google in the United States).

Where personal data of visitors located in the European Economic Area, the United Kingdom, or other jurisdictions with international-transfer rules is transferred to a country that does not benefit from an adequacy decision, we rely on appropriate safeguards. These typically include the providers' own certifications under the EU–US Data Privacy Framework (where available) and standard contractual terms imposed by the providers' enterprise agreements. You may request a copy of the safeguards that apply to a specific transfer by contacting us.

8) How long we keep it

We retain personal data only for as long as needed for the purposes for which it was collected. Specific retention periods are:

  • Edge-level technical data: we do not maintain our own access logs. Any technical data processed at Cloudflare's edge is retained by Cloudflare in line with its own retention practices, not by us.
  • Chat assistant — local browser storage: up to 1 hour, after which the entry is automatically discarded by the assistant.
  • Chat assistant — contact details on our chatbot service: the name, email, and (optional) phone number you share with the assistant are retained alongside our other inquiry records, so we can follow up about the conversation. The conversation itself is not stored as a permanent record on the chatbot service.
  • Contact form and direct inquiry records (including chat assistant follow-up details): retained for the duration of any conversation that follows, and for up to 24 months after the last meaningful contact, so we can respond to follow-up inquiries from the same person.
  • Records relating to client engagements, invoices, and tax-relevant correspondence: retained for the duration of the engagement and for as long afterwards as required by Bangladesh tax and statutory law (typically 6 years), and may be retained for longer in our internal business records. Our archived business records run from 2018 onwards.
  • Marketing email subscribers: retained until you ask to be removed, plus a short suppression record so we honour your unsubscribe.

Where law requires us to keep certain records for a longer period (for example, tax records), we will retain them for that period and use them only for that purpose.

9) Cookies and local storage

The Site does not run third-party advertising trackers, behavioural-analytics platforms, or remarketing pixels. There are no Google Analytics, Meta Pixel, HubSpot, Segment, or similar tools running on the Site at this time.

The Site uses your browser's localStorage in two narrow ways:

  • The AI chat assistant stores your most recent conversation and a session identifier for up to one hour, so the conversation persists if you close and re-open the chat in the same visit.
  • A small entry records that you have dismissed our on-site privacy notice, so it does not reappear on every visit. You can clear this entry through your browser's site-data controls and the notice will appear again.

You can decline browser storage at any time by adjusting your browser's privacy and security settings, or by clearing site data. If you decline storage, the chat assistant may not be able to retain your conversation between page reloads, and the on-site privacy notice will appear on every visit.

10) Your rights

Subject to the law that applies to you, you have rights over the personal data we hold about you. We aim to honour these rights for all visitors, regardless of location.

  • Access. You can ask us to confirm whether we hold personal data about you and to provide a copy.
  • Rectification. You can ask us to correct personal data that is inaccurate or incomplete.
  • Erasure. You can ask us to delete personal data we hold about you, subject to limited exceptions (for example, where we are legally required to keep it).
  • Restriction. You can ask us to limit how we use your personal data while we resolve a query about it.
  • Portability. Where processing is based on consent or contract and is carried out by automated means, you can ask us to provide your personal data in a structured, commonly used, machine-readable form.
  • Objection. You can object to processing carried out on the basis of legitimate interest. If you do, we will stop unless we have compelling grounds to continue.
  • Withdraw consent. Where processing is based on your consent, you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
  • Lodge a complaint. If you are in the European Economic Area, the United Kingdom, or another jurisdiction with a supervisory authority, you have the right to file a complaint with that authority. We would appreciate the chance to address your concern first by writing to contact@reformedtech.org.

To exercise any of these rights, email contact@reformedtech.org with the words "Privacy request" in the subject line. We will respond within 30 days; if a request is complex or we receive a high volume of requests, we may extend the response period and let you know.

11) Children's privacy

The Site is intended for businesses and adult professionals. It is not directed at children under the age of 16, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided personal data to us, please contact us at contact@reformedtech.org and we will delete the records promptly.

12) Security

We use reasonable and proportionate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, and loss. These measures include HTTPS encryption in transit (delivered through Cloudflare's network), access controls on internal systems, and regular review of the third parties we rely on. No system on the public internet is 100% secure, and we cannot guarantee the absolute security of personal data at all times. If we ever become aware of a security incident affecting your personal data, we will notify affected users and, where required, the relevant supervisory authority.

13) Changes to this policy

We may update this policy from time to time to reflect changes to our practices, the third parties we rely on, or the law. The "Last updated" date at the top will always reflect the date of the most recent revision. For substantive changes, we will surface a notice on the Site so you have a clear opportunity to review the new version before it takes effect.

14) Governing law and jurisdiction

This Privacy Policy is governed by the laws of the People's Republic of Bangladesh. The courts of Dhaka, Bangladesh, will have exclusive jurisdiction over any dispute arising out of or in connection with this policy, except to the extent that mandatory consumer-protection rules in your country of residence give you a non-waivable right to bring proceedings before your local courts.

15) Contact us

If you have any questions about this policy, want to exercise your rights, or want to raise a concern, please contact us:

We aim to acknowledge privacy enquiries within 5 working days and resolve them within 30 days where possible.