Privacy Policy

Welcome to Posify (“we,” “our,” or “us”). Posify is a Point-of-Sale (POS) and Inventory Management System operated by PosifyLK, based in Colombo, Sri Lanka. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our mobile application, web dashboard, and related services (collectively, the “Service”).

By accessing or using our Service, you agree to this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

Personal Information

When you register for and use our Service, we may collect:

• Account Information: Name, email address, phone number, password (encrypted)
• Business Information: Shop name, business address, branch locations, business registration details
• Team Member Data: Names, email addresses, and roles of staff members you add to your account
• Customer Data: Customer names, phone numbers, email addresses, and purchase history that you choose to store

Business Data

To provide our POS and inventory services, we collect and process:

• Product Information: Product names, descriptions, categories, SKUs, barcodes, prices, and images
• Inventory Data: Stock quantities, batch information, supplier details, purchase records
• Transaction Data: Sales orders, payment records, returns, exchanges, and refunds
• Financial Data: Cash registry entries, daily balances, payment methods used
• Warranty Information: Warranty records and claim details

Automatically Collected Information

• Device Information: Device type, operating system, unique device identifiers
• Usage Data: Features accessed, time spent, actions performed within the app
• Log Data: IP address, browser type, access times, pages viewed
• Camera Data: When you use barcode scanning, we access your camera temporarily but do not store images

We use the collected information for the following purposes:

• Service Provision: To operate and maintain our POS and inventory management system
• Account Management: To create, maintain, and secure your account
• Authentication: To verify your identity through two-step OTP verification
• Communication: To send OTP codes, service notifications, and important updates
• Analytics: To generate sales reports, inventory insights, and business analytics for your use
• Improvement: To understand usage patterns and improve our Service
• Support: To respond to your inquiries and provide customer support
• Security: To detect, prevent, and address technical issues and fraudulent activity
• Legal Compliance: To comply with applicable laws and regulations

We implement industry-standard security measures to protect your data:

• Encryption: All data is encrypted in transit using TLS/SSL and at rest using AES-256 encryption
• Password Security: Passwords are hashed using bcrypt algorithm and never stored in plain text
• Multi-Tenant Architecture: Your business data is isolated in a separate database schema from other customers
• Access Controls: Role-based access control (RBAC) ensures only authorized personnel can access specific data
• Secure Infrastructure: Our servers are hosted on secure cloud infrastructure with regular security audits
• Session Management: JWT tokens with expiration for secure authentication

While we strive to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to implementing best practices.

We do not sell your personal information. We may share your data only in the following circumstances:

• Service Providers: With trusted third-party providers who assist in operating our Service (e.g., cloud hosting, email delivery) under strict confidentiality agreements
• Legal Requirements: When required by law, court order, or governmental authority
• Business Protection: To protect our rights, privacy, safety, or property, and that of our users
• Business Transfers: In connection with a merger, acquisition, or sale of assets (with notice to you)
• With Your Consent: For any other purpose with your explicit consent

• Active Accounts: We retain your data for as long as your account is active and as needed to provide our services
• After Account Deletion: Upon account deletion request, we will delete or anonymize your data within 30 days, except where retention is required by law
• Transaction Records: Financial and transaction data may be retained for up to 7 years for legal and tax compliance purposes
• Backups: Data in backups will be deleted according to our backup rotation schedule (typically within 90 days)

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Data Portability: Request your data in a structured, commonly used format
• Withdraw Consent: Withdraw consent for data processing where consent is the legal basis
• Object: Object to processing of your data for certain purposes

To exercise any of these rights, please contact us at support@posify.lk.

Our web application uses cookies and similar technologies:

• Essential Cookies: Required for authentication and basic functionality
• Preference Cookies: Remember your settings (e.g., theme preference, branch selection)
• Analytics Cookies: Help us understand how you use our Service to improve it

You can control cookie settings through your browser preferences. Note that disabling certain cookies may affect Service functionality.

Our Service is intended for business use and is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly.

Our Service is primarily operated from Sri Lanka. If you access our Service from outside Sri Lanka, your information may be transferred to, stored, and processed in Sri Lanka or other countries where our service providers operate. By using our Service, you consent to such transfers. We ensure appropriate safeguards are in place for international data transfers.

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date. For significant changes, we will provide additional notice via email or in-app notification. We encourage you to review this Privacy Policy periodically.

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: support@posify.lk
• Phone: +94 74 119 4056
• Address: PosifyLK, Colombo, Sri Lanka