Privacy policy
Last updated: · বাংলায় পড়ুন
This policy explains how Abroadesk ("we") handles personal data when you use the Abroadesk website, the Abroadesk software and the websites and student portals we host for agencies.
Contact: Abroadesk is run from Dhaka, Bangladesh. Write to us through the contact form on our website.
Who is responsible for what
- Our own data. For people who visit our website, contact us or sign up, and for agency owners and staff who use Abroadesk, we decide how the data is used. We are the controller.
- Agencies' student data. When an agency adds students, leads, documents and payments to Abroadesk, the agency decides why and how that data is used. The agency is the controller and we process the data on its behalf, following its instructions and this policy. Students with questions about their data should contact their agency first; we will help the agency respond.
What we collect
| Who | What | Why |
|---|---|---|
| Website visitors | Pages visited, device and browser details, the contact or demo form you send | To answer you and to improve the website |
| Agency owners and staff | Name, email, phone, role, login and two-step login settings, activity in the app | To provide the service, secure accounts and support you |
| Agencies | Agency name, address, logo, website settings, plan and billing records | To run your account and bill for it |
| Students and leads (for the agency) | Contact details, education history, test scores, passport details, documents uploaded, applications, visa progress, fees and payments, messages | To let the agency provide its services to the student |
We do not sell personal data, and we do not use agencies' student data for our own marketing.
Payments
- Subscriptions to Abroadesk are paid through SSLCommerz or bKash. We receive the payment result and a transaction reference; card and wallet details stay with the payment provider.
- Student fees paid to agencies go to the agency's own merchant account. We record the amount, status and reference so the agency and student see the payment and receipt.
Services we use
To run Abroadesk we share data with these providers, only as far as each one needs:
- Hosting and storage: ExonHost, on a server in Dhaka, Bangladesh, where the database and uploaded files are kept.
- Email delivery: Abroadesk doesn't send email through an outside provider yet. When it starts, to send invitations, reminders and receipts, we will name the provider here.
- WhatsApp (Meta): when an agency connects WhatsApp, messages it sends to students go through Meta's WhatsApp Business platform.
- OpenAI: when someone uses an AI feature (for example, drafting a statement of purpose or estimating an IELTS writing band), the text needed for that task is sent to OpenAI to produce the result.
- Payment providers: SSLCommerz and bKash, as described above.
Cookies and local storage
We use your browser's storage to keep you signed in and to remember settings such as the theme. We do not use advertising cookies or analytics tools.
How we protect data
- Each agency's data is kept separate from every other agency's.
- Uploaded documents are not public; they open through links that expire after a few minutes.
- Passwords are stored as hashes. Payment gateway secrets are encrypted.
- Staff can use two-step login, and agency owners can make it compulsory.
- Sensitive actions are recorded in an audit log.
No system is perfectly secure. If a breach affects your data, we will tell the affected agencies and people without undue delay.
How long we keep data
- Account and agency data: while the account is active, and for 90 days after it is closed, unless the law requires longer.
- Students' data: as long as the agency keeps it in Abroadesk; the agency can delete it.
- Billing records: as long as tax and accounting law requires.
Your choices and rights
You can ask us for a copy of your personal data, to correct it, or to delete it, subject to legal requirements. Agency owners can delete records in the app and can ask us for a copy of their agency's data. Students should contact their agency, which controls their records. To make a request, use the contact form on our website.
Children
Abroadesk is for agencies and the students they serve. Some students may be under 18; agencies are responsible for getting a parent's or guardian's consent where required.
Changes to this policy
We will post changes on this page and update the date at the top. If a change is significant, we will tell agency owners by email or in the app before it takes effect.