Privacy Policy

SmartKhata (“SmartKhata”, “we”, “us”) provides a digital khata, point-of-sale, and inventory app for small and medium businesses in Sri Lanka. This policy explains what information we collect through the SmartKhata mobile app and web portal, why we collect it, and how you can control it.

• Account information — your name and email address, used to sign in and identify your account.
• Business information — business name, type, contact phone, address, bank name/account number, and VAT/business registration details you enter, used to generate invoices and statements.
• Your customers’ data — names, phone numbers, and transaction records you enter for the customers of your own business, used to maintain their ledger and to send them payment reminders by SMS on your behalf.
• Photos — your business logo and bill/receipt images you choose to upload, stored on Amazon S3 and delivered via Amazon CloudFront.
• Subscription payment data — subscription payments are processed directly by our payment partner, PayHere. SmartKhata does not receive or store your card details.
• Device information — a device token may be collected to enable push notifications, where supported.

We use the information above to:

• Provide and operate the khata, POS, invoicing, and reporting features of the app.
• Send OTP codes, receipts, statements, and payment reminders.
• Process subscription billing and manage your plan.
• Maintain the security and reliability of the service.

We do not sell your personal information. We share data only with the service providers that help us run SmartKhata, strictly to perform the tasks below on our behalf:

• Amazon Web Services (S3 / CloudFront) — storage and delivery of uploaded images.
• PayHere — subscription payment processing.
• Resend — delivery of login OTP codes and transactional emails.
• Text.lk — delivery of SMS payment reminders to your customers.

Within a business account, data you enter is visible to other members of that business (e.g. staff you invite as Manager or Cashier), according to their assigned role.

Your data is stored in a managed PostgreSQL database. We use industry-standard security practices to protect it, but no method of transmission or storage over the internet is 100% secure, and we cannot guarantee absolute security.

You may request access to, correction of, or deletion of your personal data, or withdraw consent for its processing, at any time by contacting us (see Section 9).

You can request deletion of your account and business data at any time. See our Data Deletion page for how to request it and what happens next.

SmartKhata is a business tool and is not directed at, or knowingly used to collect information from, children.

We may update this policy from time to time. Material changes will be posted on this page with an updated “Last updated” date.

Questions about this policy or your data? Email rivvntech@gmail.com.