Privacy Policy
What we collect, why we collect it, and how to ask us to delete it.
Effective 2 September 2026
Who we are
BakeArt BD is a home bakery run by a family in Rajshahi and Natore, Bangladesh. We bake to order and deliver across Rajshahi and Natore. This page explains what we collect when you visit bakeartbd.com or order a cake from us, and what we do with it. It is written to be read, not skipped.
What we collect when you order
There is no order form on this site. Every order starts as a conversation — on WhatsApp, on Messenger, or on the phone. In that conversation we take your name, your phone number and the delivery address. We keep those details so we can bake the right cake, get it to the right door, and recognise you next time.
What we collect when you visit
When you open a page we record which page it was, roughly when, and which link or ad brought you here. We also see the ordinary things every website is told by your browser: device type, browser, language and IP address. We use this to learn which pages help people and which ones do not. We do not try to work out who you are from it.
Cookies we set
The only cookies on this site are ours, set by our own server. They are HttpOnly, which means code running in your browser cannot read them — only our server can. No advertising company sets a cookie here.
A device cookie
A random code that tells us the same browser has come back, so two visits a week apart are not counted as two strangers. It is not your name, and it is not linked to one. It lasts about 2 years.
A session cookie
A random code for a single visit. It groups the pages you look at in one sitting. It expires after about 30 minutes of no activity.
An advertising cookie
If you arrive from an ad or a campaign link, we store the click ID and campaign tags carried in that link — the fbclid Meta adds, or the utm values used in campaign links. It tells us which ad brought you, so we know what is worth paying for. It lasts about 90 days.
Analytics
We use Google Analytics 4 to count visits and see which pages get used. Those events are sent from our server through Google's Measurement Protocol. No third-party analytics script runs in your browser on this site — nothing from Google is loaded onto the page you are reading.
Advertising
When we run ads on Facebook and Instagram, we need to know whether they actually led anywhere. To find out, our server sends event data to Meta through its Conversions API: which page was visited, which contact button was pressed, and when. If we already have your phone number or email from an order, a hashed version of it may be sent along so Meta can match the ad to a real order. None of this happens in your browser — it is server to server.
What hashing means
Before any contact detail goes to an advertising platform, it is hashed with SHA-256. Hashing turns a phone number into a fixed string of letters and numbers. The platform can compare that string against its own records, but it never receives your number in a readable form.
What we do not do
- We do not sell, rent or trade your personal information. Not to anyone, not ever.
- We do not let advertising companies drop their own cookies on this site.
- We do not take payments or card details through this website.
Children
This site is about cakes, and it is written for the person ordering one. It is not directed at children, and we do not knowingly collect anything about them. If you think a child has sent us their details, email us and we will delete them.
Your details are yours
If you want to know what we hold about you, correct it, or have it deleted, email contact@bakeartbd.com and tell us which phone number or email you ordered under. We will find it and take care of it. Deleting your details also means we can no longer look up your past orders — usually that is fine, and either way it is your call.
If this policy changes
We will update this page whenever the way we collect or use information changes. The date at the top always tells you when it last changed.