Privacy Policy
This explains what Elekwa (Pvt) Ltd keeps when your business uses Elekwa Ledger, who can see it, and what you can ask us to do. We follow Sri Lanka's Personal Data Protection Act No. 9 of 2022.
Who is responsible for the data
Your business decides what personal data about its customers goes into Elekwa Ledger, and why. So your business is the controller of that data. Elekwa (Pvt) Ltd, the provider of the service, processes it for your business and follows your business's instructions. For the sign-in details of the people your business invites, we are also responsible for keeping them safe.
What we store
- Your business records: jobs, payments, expenses, invoices, lists and settings.
- The names and email addresses of the people your business invites, and their Google sign-in identity.
- Details about your customers that your business types in, such as names, phone numbers and passport details.
- Documents and receipts your business uploads.
- A short log of who did what, and simple technical records such as errors, to keep the service safe and working.
Why we use it
We use this data only to run Elekwa Ledger for your business: to show your records, work out your figures, keep backups, give support and keep the service secure. We do not use it for anything else.
Where it is kept
You own your data. Everything you enter belongs to your business. To run the service we store it on our servers, and if you connect Google we keep a copy in your own Google Drive: your Google Sheets, plus a backup every day. You can download everything at any time. If you stop using the service, your Google Sheets and backups stay in your Drive, and we delete our copy on request.
Our database is kept at our hosting provider, Hostinger. Customer documents are kept in your own Google Drive when you connect it, otherwise in our private storage.
Outside Sri Lanka
Our hosting provider's servers may be outside Sri Lanka. Google's servers and the servers of an AI company you choose may be outside Sri Lanka too. When data is stored or sent abroad, we use providers that protect it with security measures and written terms, as the Personal Data Protection Act asks.
Who can see it
Only the people of your business, and only what their role allows. Elekwa staff look at your records only to give you support, and only with your permission. The software owner can use platform admin tools to run the service. Our hosting provider stores the data but is not allowed to use it for its own purposes. We share data with others only when the law requires it.
Keeping it safe
- People sign in only with Google. We never keep a password.
- Connections to the service are encrypted.
- Keys and tokens we store are encrypted.
- Every business sees only its own records.
- People can only do what their role allows, and changes are logged.
- Backups are kept for up to 30 days.
No system is perfectly safe, but we work to keep your data protected.
If something goes wrong
If personal data is lost, stolen or seen by someone who should not see it, we will tell the business owner without undue delay. We will say what happened, what data was involved and what we are doing about it. The business, as controller, then decides who else must be told, including the regulator and the people affected.
AI help
AI help is off unless your business owner switches it on in Settings, Privacy and AI. It works with the business's own Groq, OpenRouter or OpenAI key. When it is on, the question and the figures needed to answer it are sent to that AI company to write an answer. That company handles the data under its own terms, and it may be outside Sri Lanka. Please check the terms of the company you choose. The owner can switch AI help off again at any time.
We do not sell your data
We never sell your data or your customers' data, and we do not use it for advertising.
Keeping and deleting
We keep your records while your licence is active. When a licence ends, the business becomes read-only and the data is kept, so you can still see it and download it. If the business owner asks us in writing to delete the data, we will do so after the owner has exported a copy. Backups that still hold the data are kept for up to 30 days and then removed. We never hard-delete customer data on our own.
Your rights
Under the Personal Data Protection Act, you can ask to see the personal data held about you, ask for it to be corrected, ask for it to be deleted, and object to how it is used.
If you are a customer of a business, ask that business. It is the controller of your data, and we will help it answer you. If you are a person invited to use Elekwa Ledger, or the owner of a business, write to us using the contact below.
Cookies
We use only what is needed to run the service. A sign-in cookie keeps you signed in, and a small cookie may help recognise your browser for sign-in safety. Your browser also remembers your light or dark theme. We do not use advertising or tracking cookies.
Children
Elekwa Ledger is not for anyone under 18. We do not knowingly collect data about children for our own use.
Elekwa Ledger's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Changes to this policy
If we change this policy or the Terms, the version number changes and everyone is asked to read and agree again before they carry on.
Contact
Write to Elekwa (Pvt) Ltd through the person who invited you, or the email on your licence page.