Privacy policy

Privacy Notice

Last Updated: September 25, 2026

nopStation respects the privacy of its customers and recognizes the need to protect valuable personal information, as well as the importance of consent for any information shared with us. This policy explains our privacy practices. It applies to nopStation, the ERP and eCommerce unit of Brain Station 23, its employees, and any partner bound by contract with us.

We process personal data in accordance with the General Data Protection Regulation (GDPR), the UK GDPR, applicable US state privacy laws such as the CCPA, and other applicable data protection laws. For our apps, we also follow the requirements of the Shopify App Store and Microsoft AppSource.

nopStation has implemented technical and organizational measures to protect personal data. However, internet-based transmissions may have security gaps, and absolute protection cannot be guaranteed.

1. Definitions

Personal data
Any information about an identified or identifiable person, such as a name, email address, IP address or online identifier.

Processing
Any action performed on personal data, such as collecting, storing, using, sharing or deleting it.

Controller
The organization that decides why and how personal data is processed.

Processor
An organization that processes personal data on behalf of a controller.

Merchant or customer organization
A business that uses our nopCommerce, Shopify or Microsoft Dynamics 365 products. It is the controller of its own customers' and employees' data.

Consent
A freely given, specific, informed and clear agreement to the processing of personal data, which can be withdrawn at any time.

2. Name and Address of the Controller

Brain Station 23 is the legal entity responsible for the processing described in this policy. nopStation is its ERP and eCommerce unit and trading name.

nopStation (Brain Station 23)
8th Floor, 2 Bir Uttam AK Khandakar
Mohakhali C/A, Dhaka 1212, Bangladesh
Email: [email protected]
Website: https://www.nop-station.com

3. Privacy Contact

For any question or request about your personal data, contact our privacy team at [email protected].

4. Data Collection and Consent

Usage information/data

nopStation may collect data on how a service is accessed and used. This includes IP address, browser type, browser version, user agent string, pages visited, visit activities and diagnostic information.

Tracking information/data

Like many websites, nopStation uses cookies, analytics services and similar trackers to improve our service. Essential cookies are always active. Analytics and marketing cookies are used only after you accept them, and you can change your choice at any time. You can also reject cookies or use anti-tracking tools in your browser at any time.

Personal information/data

When using our services, nopStation may ask you to provide personal information for identification, verification and contact. This includes email, full name, company, billing address, state, country and postal information. We do not store payment card details; these are handled by our payment provider, Stripe.

How we use collected data

nopStation may use collected data for:

• Customer services and order and license management
• Product updates and policy updates
• Diagnostics and security
• Product suggestions, newsletters and marketing

We process data to fulfil our contract with you, for our legitimate business interests, to meet legal obligations, or with your consent. Marketing and newsletters are sent only with your consent, and you can unsubscribe at any time. nopStation does not sell personal data.

5. Our Products

When a merchant or customer organization uses our products, it is the controller of its data, and nopStation acts as a processor, working only on that organization's instructions. Some of our products may also process data belonging to that organization's own customers or end users; we process this data only to provide the relevant product or integration, and in line with that organization's instructions and applicable agreements.

nopCommerce plugins, themes and mobile apps

These run on the merchant's own server, and store data stays there. For license validation, our products send us only the store domain, license key and product version.

Shopify apps

Our apps access only the store data allowed by the permissions the merchant approves at installation, and use it only to provide the app's features. We follow Shopify's requirements for handling customer data, including its mandatory privacy webhooks for customer data and deletion requests, and applicable data retention requirements.

Microsoft Dynamics 365 apps

Our apps run inside the customer's Microsoft tenant, and business data stays within that environment. Only technical diagnostic data, such as errors and usage logs, is sent to nopStation, to support and maintain the app.

Support and professional services

If you give us access to your store, systems or data, only the assigned team uses it, under confidentiality, and only for the work you asked us to do.

6. Your Privacy Rights

You have the right to know what personal data we hold about you, and to:

• Access a copy of your data
• Correct it if it's wrong or incomplete
• Delete it
• Move it to another provider (data portability)
• Object to or limit how we use it, including for marketing
• Withdraw consent at any time
• Opt out of the sale or sharing of your data. nopStation does not sell personal data

To use any of these rights, email [email protected]. We may need to verify your identity first. We will respond within one month (or 45 days if you are in the US), and we will not treat you differently for making a request. If you're not satisfied with our response, you may also complain to your local data protection authority.

If your data reaches us through a store or organization that uses our products, please contact that organization first, as it controls your data.

7. Data Retention Guidelines

nopStation keeps personal data only as long as needed for services, identification and legal requirements. After that, we delete or anonymize it. You can ask us to remove or modify your data at any time.

8. Data Transfer Policy

Your information may be stored, maintained or transferred to servers outside your region or country. Details of our hosting regions are available on request. For data from the EU, UK or Switzerland, we protect these transfers with the European Commission's Standard Contractual Clauses and the UK Addendum.

9. Data Security Policy

nopStation works to ensure the security of your data through encryption, access controls and staff confidentiality agreements. We are responsible for personal data stored on our systems and by our service providers. We are not responsible for data you share on third-party platforms outside nopStation's control. If a data breach affects your data, we will notify you and the relevant authority as required by law.

10. Service Providers

nopStation may use services from third parties or group companies of Brain Station 23 to:

• Facilitate our services
• Provide the service on our behalf
• Perform service-related tasks
• Help us analyze how our service is used

These providers may access personal data only to perform these tasks, under written data protection agreements. Our current list of service providers is available on request.

11. Analytics

nopStation uses third-party services such as Google Analytics, Google Tag Manager and Algolia. These may collect information such as email, browser information, country and region to provide or improve our services. Analytics and personalization services are used only with your consent, and you can opt out at any time as described in Sections 4 and 6.

12. Interlinking with External Sites

nopStation's website and services may contain links to other sites, such as Shopify, Microsoft and nopCommerce. These sites are not operated by nopStation or Brain Station 23. We have no control over, and assume no responsibility for, their content or privacy practices. Please review their privacy policies.

13. Children's Privacy Policy

nopStation's services are not directed at children: under 13 in the United States, and under 16 in the European Economic Area and UK. We do not knowingly collect personal information from children. If we discover that a child has provided us with personal information, we delete it immediately from our servers. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

14. Change of Policy Notice

nopStation may update this policy from time to time. We will update the date above and notify customers of important changes by email or on our website. Where a change requires your consent, we will ask for it.

15. Contact Us

If you have any questions or suggestions about our Privacy Policy, do not hesitate to contact us or email [email protected].

nopStation (Brain Station 23)
8th Floor, 2 Bir Uttam AK Khandakar
Mohakhali C/A, Dhaka 1212, Bangladesh