Privacy policy

1. Who is responsible

SYSTO (PVT) LTD, registered in Sri Lanka at 01, Bauddhaloka Mawatha, Colombo, Sri Lanka, runs SYSTO and is responsible for the personal data described here. Questions and requests go to support@systo.lk.

2. What we keep

• Your account: your name, your email address and when you last signed in. Your password is handled by Google Cloud Identity Platform and never reaches us. If you sign in with Google, Google gives us your name and email address.
• Your workspace’s records: whatever you and your staff enter — products, stock, sales, suppliers, staff roles and settings — including the names, phone numbers and addresses of customers you choose to record. You decide what goes in; we store it for you.
• Technical records: server logs with the address your browser connects from, the time, the page or API call and any error, kept so we can keep the service running and secure; and the rate-limit counters that protect sign-in.
• Support messages: what you send us on WhatsApp or by email, and our replies, so we can follow up.

We do not collect payment card details (SYSTO does not take card payments), do not run advertising and do not use analytics or tracking services.

3. Why we use it

• to run SYSTO for you: sign you in, show the right workspace, keep your records;
• to help you when you contact support, and to tell you about changes to the service or these documents;
• to keep the service secure: spotting abuse, limiting repeated sign-in attempts, investigating faults;
• in aggregated, non-identifying form, to understand how SYSTO is used and improve it.

We do not sell personal data, do not use it for advertising and do not make automated decisions about you.

4. Where it is kept and who else sees it

SYSTO runs on Google Cloud, in the asia-southeast1 (Singapore) region. Google processes data on our behalf as our hosting, database, file storage and sign-in provider, under its own data-processing terms. Verification and password-reset emails are sent through the same sign-in service. If you message us on WhatsApp, that conversation also passes through WhatsApp under its terms.

No one else receives your data, except where the law requires us to hand it over. Our own staff open a workspace’s records only when you ask us for help and tell us to, and we say what we looked at.

5. Cookies and browser storage

• systo_session — keeps you signed in. Set only after your identity is checked, readable by the server only, cleared when you sign out.
• systo_workspace — remembers which workspace you are working in. Every request re-checks that you still belong to it.
• Preferences stored in your browser (whether the sidebar is collapsed, light or dark theme, the last filters you used). They never leave your browser.

There are no advertising, analytics or cross-site tracking cookies.

6. How long we keep it

• Your account, for as long as it exists.
• A workspace’s records, for as long as the workspace exists.
• Server logs, for 30 days.
• Backups, on a rolling schedule: a backup that still holds deleted data expires within 30 days of the deletion.
• Records that tax or accounting law requires us to keep (for example invoices a workspace issued), for as long as that law says.

7. Deleting your data

Email support@systo.lk from the address on your account and say what you want deleted: your account, or, if you are the owner, a whole workspace. We confirm the request with you, then delete within 30 days. A workspace’s owner can also remove a staff member, which ends that person’s access at once; their name stays on the records they created (for example the sales they rang), because those records belong to the workspace.

You can also ask us for a copy of your data, to correct something you cannot change yourself in SYSTO, or to ask a question about how it is handled. We answer within 30 days. These are the rights Sri Lanka’s Personal Data Protection Act gives you, and we honour them whether or not it applies to you.

8. Security

Every connection to SYSTO is encrypted. Each workspace’s records are separated in the database, so the application can only ever read the workspace you are signed in to. Passwords are never stored by us. Secrets and keys are kept in a managed vault, not in code. If we ever learn of a breach that affects you, we tell you without undue delay and say what happened and what we did.

9. Children

SYSTO is for businesses and for people aged 18 or over. We do not knowingly keep data about anyone younger.

10. Changes to this policy

We may change this policy. The date at the top says when it last changed. We tell signed-in users about a material change inside SYSTO, or by email, before it applies.

11. Contact

SYSTO (PVT) LTD, 01, Bauddhaloka Mawatha, Colombo, Sri Lanka · support@systo.lk. The Support page lists the other ways to reach us and when we answer.