Privacy Policy

1. Who we are

Talab ("we", "us") is an online tool that lets small businesses in Sri Lanka run a storefront link, take orders and manage payments over WhatsApp. This policy explains how we handle personal data under Sri Lanka's Personal Data Protection Act, No. 9 of 2022.

This policy covers two groups of people:

• Merchants — businesses that sign up to Talab. For your account data, we decide how it is used, so we are the controller.
• Customers — people who order from a shop that uses Talab. Your order details belong to that shop: the shop is the controller and we process the data on the shop's behalf, only to run their orders.

2. What we collect

From merchants

• Email address (used to sign in with a one-time code — we never store a password).
• Business name, shop link name, WhatsApp phone number and logo.
• Bank account details you add for customers to pay you (bank, account number, account holder, branch).
• Your products and photos, shop settings, delivery zones and plan.

From customers (entered at checkout, or by the shop on your behalf)

• Name, phone number and delivery address.
• What you ordered, notes you add, the date you need it by and how you'll pay.
• Payment slip images you upload after paying the shop by bank transfer.

Technical data

• Standard server logs (such as IP address, browser type and time of request), kept for security and to fix problems.
• Error reports: when something breaks, the technical details (which page, what failed, browser and device type) are sent to our error-monitoring provider so we can fix it. These reports leave out names, phone numbers, addresses, order details and IP addresses.
• Small items saved in your own browser: your sign-in session (merchants), your cart, the last few orders you placed on a shop so you can find them again, and your display theme. These stay on your device. We don't use advertising or tracking cookies.

3. How we use it

• To run the service: show storefronts, take and track orders, create invoices and check payment slips.
• To send sign-in codes by email.
• To prepare WhatsApp messages about an order. Talab only prepares the message — the shop sends it from its own WhatsApp.
• To keep Talab secure, prevent fraud and abuse, and fix problems.
• To support you when you contact us, and to bill merchants for their plan.
• To meet legal obligations, such as keeping billing records.

We use data because it's needed to provide the service you asked for, because we have a legitimate interest in keeping Talab secure and working, because the law requires it, or — where none of these apply — with your consent. We never sell personal data, use it for advertising, or share a shop's customers with anyone else.

4. Who can see it

• The shop sees the details of customers who order from it, including payment slips.
• Anyone visiting a storefront sees the shop's public details: business name, logo, WhatsApp number and products.
• Anyone with an order-tracking or invoice link can open that page. It shows the order details and, on invoices, the shop's bank details for payment. The links are long and hard to guess, but treat them like a receipt and only share them with people you trust. Payment slips are never shown on these pages — only the shop can view them.
• Service providers that host and run Talab for us, under contracts that require them to protect the data: Supabase (database, sign-in and file storage), Vercel (website hosting), Railway (our application server), Sentry (error reports, stored in the EU), and our email delivery provider. They may only use the data to provide their service to us.
• WhatsApp (Meta) handles any message a shop sends you through WhatsApp, under WhatsApp's own privacy policy.
• Authorities, only when the law requires it or to protect people from harm or fraud.

5. Where it's stored

Our database and files are stored primarily in Singapore. Some of our providers also operate in other countries. Wherever data goes, we make sure it is protected by the provider's security commitments and by contracts, as Sri Lankan law requires for transfers outside the country.

6. How long we keep it

• Merchant account data: for as long as your account is open.
• Customer and order data: for as long as the shop keeps its account, or until the shop deletes it.
• When a merchant closes their account, we delete their shop data, including their customers' data, within 90 days — except billing records we must keep by law.
• Server logs: kept for a short period, then deleted.

7. How we protect it

• All traffic is encrypted (HTTPS).
• Each shop can only reach its own orders, customers and invoices.
• Payment slips are stored privately and opened only through short-lived links given to the shop.
• Sign-in uses one-time email codes, so there are no passwords to leak.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

8. Your rights

Under Sri Lankan law you can ask to:

• see the personal data we hold about you;
• correct data that is wrong or incomplete;
• have your data deleted;
• withdraw consent you gave, or object to how your data is used.

Merchants can change some details in Settings, or contact us for anything else, including closing the account. Customers should first contact the shop you ordered from, since it controls your order data; if you can't reach them, contact us and we will help. We'll reply within the time the law requires and may need to confirm who you are first.

If you're unhappy with how we handle your data, you can complain to the Data Protection Authority of Sri Lanka.

9. Children

Merchant accounts are for people aged 18 or over. Talab isn't aimed at children, and we don't knowingly collect their data.

10. Changes to this policy

If we change this policy we'll update the date at the top. If a change is significant, we'll tell merchants by email or in the app before it takes effect.

11. Contact us

For privacy questions or requests, email info@talab.lk.