What we collect, and what we do not.

1Who this covers

KitGhor writes CVs, career documents and e-books for people applying for work in Bangladesh. This policy covers kitghor.com and everything attached to it — your account, your orders, and the files we deliver to you. It covers nothing else.

It says what actually happens, including the places where the answer is that we collect nothing at all.

2What we collect

Three things reach us: what you type, what an order needs in order to be fulfilled, and what every browser sends with every request. We buy nothing about you from anybody.

Your account

Your name, email address and mobile number, and where on the site you signed up — with the score of the CV check you signed up after, if there was one. Your password for this site is stored only as a one-way hash — nobody here can read it, and we will never ask you for it.

Your order

What you ordered and the amount, the names of the people it is for if you give them, the mobile wallet you paid from, the transaction ID you copy from the payment SMS, any note you write for the writer, and — if you cancel — the wallet number a refund should go to. The same applies to anything you add to the order later.

Recorded with the order

Your IP address, the browser and device string your browser sends, and the page that brought you here. These are written down automatically, so a disputed or duplicated payment can be traced back.

As you browse

Which pages and products you open, what you search for, and whether a checkout finished or was left unfinished. Each event is stored against a random visitor id, and against your account while you are signed in. With it go your IP address, your browser string, the approximate area that IP address belongs to, and the campaign tags of the link that brought you, if it had any.

If you check a CV

The CV is read inside your browser and is never uploaded. What reaches us is the result — the score and the grade — and a few facts about the file, such as its page count and the program that made it; never what the CV says.

If you refer someone

Your referral code, what it has earned, and — only when you request a withdrawal — the mobile wallet number you want it paid to.

If you leave a review

The name you type and the review itself. You choose that name; it does not have to be the one on your account.

We never see a card number, a bank account or a wallet PIN. There is no payment gateway on this site: you pay from your own bKash, Nagad or Rocket app to a number we show you, and the only part of that which reaches us is the transaction ID you copy across.

3What we keep in your browser

One outside service runs in your browser: the Meta Pixel, which measures our Facebook and Instagram ads. There is nothing else — no other advertising cookies, no other analytics, and even the fonts are served from our own domain rather than a font network.

What we do keep is a small amount of data inside your own browser:

Signed-in session

The tokens that keep you signed in. Remove them and you are signed out.

Theme and language

Light or dark, and whether you read in Bengali or English. Read before the page paints, so it never flashes the wrong one at you.

Referral code

The code you arrived with, kept until you close that tab so the person who referred you gets credit when you order. It is sent with the order when you check out.

File access

Short-lived credentials for downloading your files. Held for that tab only, and gone when you close it.

Visitor id

A random id for this browser, created the first time something needs one — leaving a review, or the counting described above — and a second random id for each visit, kept until you close the tab. Neither carries a name or an account, and clearing site data removes both.

Your order

The products you add to an order before checking out — how many of each and who they are for — kept so the list is still there if you come back. It is emptied when the order is placed, and you can remove anything from it yourself.

Campaign tags

If the link that brought you carried campaign tags, those tags — kept until you close the tab, so an order can be credited to the campaign that led to it.

CV check

The result of a CV check, and the name, email address and mobile number found in that CV — kept until you close the tab, so the result and the sign-up form are still there after you sign in. The CV file itself is never kept.

Banner

The offer shown at the top of the page, its size, and whether you closed it — kept until you close the tab, so it is fetched once per visit and a closed banner stays closed.

Meta’s cookies

Two cookies the Meta Pixel sets: a random id for this browser, and — if you arrived by tapping one of our ads — the id of that tap, which we also keep for 90 days. They are how Meta links a sign-up or an order back to the ad that led to it, and they go when you clear site data.

Clearing site data in your browser removes all of it. The site keeps working — you will simply be signed out, and the language and theme go back to their defaults.

4Why we use it

What it is used for:

• Creating your account and signing you in.
• Matching your transaction ID against the wallet statement, which is how an order is verified before any work starts.
• Writing and delivering what you ordered, and emailing you about your orders, refunds, wallet and account as things happen — when a payment is verified, when a file is ready, when your account is signed in to or its password changes.
• If you sign up after checking a CV here, emailing you about that score and what we can do about it.
• Answering you when you write in, which means having your orders in front of us.
• Working out referral commission and paying a withdrawal to the number you gave.
• Seeing which pages lead to orders, so the site gets better. That is counted in totals; nobody sits and reads one person browsing.
• Measuring which of our Facebook and Instagram ads lead to sign-ups and orders, and choosing who sees those ads — including people who have visited before. The next section says exactly what that involves.

5Who else can see it

We do not sell your information and we do not rent it. The one advertising company we share anything with is Meta, which runs Facebook and Instagram, and only so that our own ads can be measured and shown to the right people.

What Meta receives: which pages you open, which products you view, a CV check and its result, a tap on our WhatsApp link, a sign-up, a checkout you start, an order you submit, and a payment once we have verified it, with its amount. With each goes your IP address, your browser string, Meta’s two cookies and — as one-way hashes, so none of it travels as readable text — our random visitor id and, if you have an account, its email address and mobile number. If you type your name, email address or mobile number into one of our forms, the pixel may hash and send those too. Meta never receives your password, your CV or what it says, your files, or your transaction ID. What Meta does with what it receives is governed by Meta’s own privacy policy.

Apart from Meta, the people who see it are the KitGhor team — whoever is writing your document and whoever verifies your payment — and the services that run the site for us: the network that carries its traffic, the hosting our server and database sit on, the storage that holds your files, and the provider that delivers our email. Each one sees only what its job needs.

We would also disclose information where the law requires it of us, and we would tell you unless we were forbidden from doing so.

6Your files and their links

Every file you download from an order — your finished CV, an e-book you bought — is fetched through a link that is signed the moment you click and stops working 30 seconds later. Links are never made in advance, never emailed, and cannot usefully be forwarded to anybody.

The storage those files sit in is private. It is never open to the internet, and the site reaches it with temporary credentials that expire on their own.

7How it is protected

Passwords are stored as BCrypt hashes, never in a readable form. The site and the API are served over HTTPS only. The tracking page never shows who placed an order, who it is for, its transaction ID or its files — so an order number in the wrong hands is not a way into your details or your documents.

No site can honestly promise it will never be breached, and we are not going to. What we can say is that the amount we hold about you is deliberately small: no card details, no bank details, and no document you did not send us yourself.

8How long we keep it

Your account and your orders stay for as long as the account does. That is where your files are delivered and where your purchase history lives, and an order record is what a payment dispute is settled from.

Browsing events are kept as a record of what happened on the site. On our side each carries a random visitor id, and your account if you were signed in. The copies Meta receives are kept by Meta, under its own policy.

Ask us to close your account and we will close it, and remove what we do not have to keep as the record of a sale.

9What you can ask us to do

All of this is yours to control:

• Ask us to correct your name, email address or mobile number, whenever you like.
• Change your password from your profile. We email you when it changes, so one you did not make is visible immediately.
• Ask for a copy of what we hold about you, and we will send it.
• Ask us to close your account.
• Clear what the site keeps in your browser yourself, from the settings in your browser.
• Choose which ads you are shown, and clear what businesses have shared with Meta about you, from the ad and privacy settings of your Facebook or Instagram account.

All of it goes to the same place — the email address and WhatsApp number below. Mention the email address on the account so we can find you.

10Changes to this policy

When this changes, the new version appears here and the date at the top of the page changes with it.