Privacy policy
1. Who we are
Nongor is operated by Anirar 360 (proprietorship, Bangladesh). The data controller for all personal data described here is the operator. Contact: privacy@nongor.link.
2. What we collect and why
| Data | When | Why | Legal basis |
|---|---|---|---|
| Name, email, phone, country | Sign-up (L0) | Create the account, send one-time codes | Contract with you |
| Passport or NID, selfie, liveness video | L1 verification | Prove you are who you say; screen against sanctions lists | Legal obligation (AML), contract |
| Credit consent result, references, source of funds | L2 verification | Required before money moves through escrow | Legal obligation, legitimate interest in preventing fraud |
| Beneficial ownership, site visit notes, audit | L3 verification | Partner and high-volume accreditation | Contract, legal obligation |
| Contracts, milestones, messages, files | Deal room | Run the contract, resolve disputes | Contract |
| Bank account details, remittance records | Payout | Instruct the partner bank; issue withholding certificates | Contract, legal obligation (tax, FX) |
| Degrees, past clients, day rate | Expert profile | Show a verified profile to buyers; rate shown only after enquiry | Consent, contract |
| Server logs, IP address, browser | Every visit | Security and keeping the site up | Legitimate interest |
We do not run advertising trackers, analytics pixels or social plugins. The only third-party request on the marketing pages is Google Fonts.
3. Who sees what
Other users see your name, verification level, lane and, for experts, the profile you chose to publish. They never see your documents, your bank details or your officer notes. Our verification vendor processes your document and selfie to return a match score and screening result. Partner banks receive what the law requires to open an escrow account and to remit. Registration partners (law firms, co-working hosts) see only the clients assigned to them, under a signed standard that bars export. The Invest Bangladesh Authority seat, when active, sees aggregates only and never a named record. If you are an expert and switch on sharing in Settings, your profile also goes to Notish, a tender platform, so firms bidding there can find you. Your rate is never sent, and the profile is removed when you switch sharing off.
4. Where data lives
Our database is hosted on Supabase in Singapore (AWS ap-southeast-1). Files are stored in the same region. Copies for backup stay in that region. If the government OSS later requires hosting inside Bangladesh, we will migrate and update this policy. Data leaves the region only when a partner bank, a tax authority or a verification vendor needs it for the purposes in section 2.
5. How long we keep it
| Record | Kept for | Reason |
|---|---|---|
| Account and profile | Until you delete it | Your choice |
| Identity documents and screening results | 5 years after the last transaction | Anti-money-laundering rules of Bangladesh Bank and BFIU |
| Contracts, invoices, withholding certificates | 6 years after the tax year | Income Tax Act 2023, VAT rules |
| Escrow and remittance records | As the partner bank requires | Foreign exchange regulations |
| Server logs | 90 days | Security |
6. Your rights
You can see, correct, download and delete your data from Settings, or by writing to privacy@nongor.link. Deletion removes your account and profile at once and puts the records in section 5 into a sealed archive until their retention period ends. You can withdraw consent for anything based on consent (for example, showing a past client) and it stops from that moment. You can complain to the Data Protection Authority of Bangladesh, the Office of the Privacy Commissioner of Canada, the UK ICO or your EU supervisory authority; we would rather you wrote to us first.
7. Security
Encryption in transit and at rest. Two-factor login for every admin seat. An append-only audit log of every change to your record. Officers see identity documents only inside the verification queue, never as downloads. We will tell you within 72 hours if a breach affects your data.
8. Children
Nongor is for people aged 18 and over. We do not knowingly hold data about anyone younger.
9. Changes
We will post every change here with a new version number and email you if a change reduces your rights.