Security Policy

All traffic to and from luckystore1947.com is protected with TLS 1.3, the latest encryption standard. Your connection is verified with a valid SSL certificate — look for the padlock 🔒 in your browser.

We enforce HTTPS-only access. HTTP requests are permanently redirected to their secure counterparts.

We operate on a strict Cash on Delivery (COD) model. We do not store, process, or transmit any card numbers, banking credentials, or digital wallet tokens on our servers.

No payment data ever touches our database. You pay the delivery agent only after inspecting your goods — zero digital payment risk.

Our platform runs on a hardened, multi-layered architecture:

• Cloudflare — DDoS mitigation, Web Application Firewall (WAF), and bot protection at the edge.
• Neon PostgreSQL — Encrypted-at-rest database with row-level security policies.
• Supabase — Auth and real-time APIs with JWT token validation.
• Cloudflare R2 — Immutable object storage for product images with signed access.

User sessions are secured via JWT tokens with short expiry and automatic rotation. Passwords (where applicable) are hashed with industry-standard algorithms — we never store plain-text credentials.

Internal admin access requires role-based validation against our users table. UI gating alone is never sufficient; every sensitive operation is verified server-side.

We collect only what is necessary to fulfill your order: name, phone number, delivery address, and order items. We do not sell, rent, or share your personal data with third parties for marketing.

We use Google Analytics (G-K5JLJNSW6D) to understand site traffic patterns. All data is anonymized and aggregated. You can opt out via your browser's Do Not Track settings.

We use minimal first-party cookies and browser localStorage solely for:

• Cart persistence across sessions
• Session authentication tokens
• Analytics and performance monitoring

No third-party advertising cookies are deployed.

Every order is assigned a unique order number and logged with full audit trails. Delivery personnel are verified and operate under strict identity protocols. If anything feels off, contact us immediately.

Found a vulnerability? We welcome responsible disclosure. Please email us at security@luckystore1947.com with details. We commit to:

• Acknowledging receipt within 48 hours
• Investigating and fixing verified issues promptly
• Publicly crediting researchers (with permission)
• No legal action against good-faith researchers

Lucky Store operates under the laws of the People's Republic of Bangladesh. We comply with applicable data protection regulations including the Digital Security Act, 2018 and Bangladesh Telecommunication Regulation Act, 2001.

For privacy-related questions, contact hello@luckystore1947.com.