Privacy Policy

1. Who this policy covers

There are two kinds of personal information in Invotron:

• Our customers' information: details of the businesses that subscribe to Invotron and the people who log in to it. For this information we are the controller.
• Information our customers record: the shoppers, suppliers and staff that a business enters into Invotron (for example a customer's phone number for loyalty points, or an employee's salary for payroll). For this information the business is the controller and we are its processor: we store and process it only on that business's instructions, to provide the Service. If you are one of a shop's customers or staff, please contact that business first about your information.

2. What we collect

• Account details: business name, business type, contact email and phone number, and the names, email addresses and roles of the people who use the account. Passwords are stored only as one-way hashes.
• Billing details: your plan, payment amounts, dates and status, and the payment reference from PayHere. Card numbers and banking details are entered on PayHere's secure page and are never sent to or stored by us.
• Business records you enter: products, stock, sales, purchases, customers, suppliers, staff, payroll and accounting entries.
• Technical information: the information our servers need to run the Service securely, such as IP address, browser type, and the times and pages of requests, which may appear in security and error logs.

3. How we use it

• to provide, maintain and secure the Service and keep each business's data separate;
• to create and manage your account and process your subscription payments;
• to answer support requests and send service messages, such as payment receipts and notices of changes;
• to find and fix faults, and to prevent fraud and misuse;
• to meet our legal, tax and accounting obligations.

We do not sell personal information, and we do not use the business records you enter for advertising or to build profiles of your customers.

4. Who we share it with

We share personal information only with service providers that help us run the Service, under contract:

• PayHere (PayHere (Private) Limited, Sri Lanka): processes subscription payments.
• Cloud hosting and database providers: our application is hosted on Vercel, and our database runs on TiDB Cloud in the Asia-Pacific (Singapore) region.

We may also disclose information where the law requires it, for example in response to a valid order from a Sri Lankan court or authority, or to protect the rights and safety of our users and the public.

5. Storage outside Sri Lanka

Because our hosting providers operate data centres overseas, your information is stored and processed outside Sri Lanka, primarily in Singapore. We choose providers that protect data with strong security measures and contractual safeguards, as the Personal Data Protection Act requires for cross-border transfers.

6. How we protect it

• All traffic between your browser and the Service is encrypted with HTTPS (TLS).
• Database connections are encrypted, and each business's records are separated at the data layer.
• Passwords are hashed; access within each account is limited by role (owner, supervisor, stock manager, cashier).
• Access to production systems within our team is restricted to the people who need it.

No system is completely secure. If a breach affects your personal information, we will tell you and the relevant authority as the law requires.

7. How long we keep it

• Account and business records are kept while your account is open.
• After an account is closed or left unpaid, its data is kept for at least 90 days so it can be reactivated. After that it may be permanently deleted. You can ask us to delete it sooner.
• Billing records are kept for as long as Sri Lankan tax and accounting law requires, which may be longer than the above.

8. Cookies and local storage

We use only essential cookies and browser storage needed for the Service to work: a secure cookie that keeps you signed in, a cookie that remembers which POS counter a device belongs to, and browser storage for device settings such as the cash drawer setup. We do not use advertising or third-party tracking cookies.

9. Your rights

Under the Personal Data Protection Act you may ask us to:

• confirm whether we hold personal information about you, and give you a copy;
• correct information that is inaccurate or incomplete;
• delete your information, or stop or restrict processing of it, where the law allows;
• withdraw consent you have given, without affecting processing that took place before.

Email support@invotron.store to make a request. We will reply within the time the law allows, and may need to confirm your identity first. If you are not satisfied with our response, you may complain to Sri Lanka's Data Protection Authority.

10. Children

The Service is for businesses and is not directed at anyone under 18.

11. Changes to this policy

We will post any changes on this page with a new “Last updated” date, and tell account owners about significant changes by email or in the Service. See also our Terms & Conditions.