Privacy Policy

ZEN SKY LABS ("we", "us") is a software company in Sri Lanka and part of Future Innovations LK. We build business software such as ZEN SKY Micro POS, custom ERP systems and automation tools.

This policy covers zenskylabs.com and the services that run on it, including Zen Sky accounts (auth.zenskylabs.com), billing (billing.zenskylabs.com) and our products. We handle personal data in line with Sri Lanka's Personal Data Protection Act, No. 9 of 2022.

Your account. Your name, email address and, if you add them, a phone number and a profile picture. We never store your password: we keep only a one-way scrambled form of it (argon2id). If you turn on two-step verification or passkeys, we keep what is needed to check them.

Google sign-in.If you sign in with Google, Google tells us your name, email address, profile picture and an ID for your Google account. We ask for nothing else, so we can't see your Gmail, Drive, contacts or anything else in your Google account.

Your business and billing. Business name, billing address, phone, tax or VAT number, the plans you choose, invoices, payments, and any bank deposit slips you upload.

Card payments.Card payments are handled by PayHere. Your card number goes straight to PayHere and never reaches our servers. We only receive whether the payment worked, the amount and PayHere's reference for it.

What you put into our products. Your products, sales, stock, customers, quotations and so on. We store this for your business and use it only to run the product for you (see section 5).

The contact form.Your name, business name, email, WhatsApp number and the plan you're interested in. The form uses Cloudflare Turnstile to stop spam.

Security and technical data. IP address, browser and device type, the times you sign in, and a log of important account actions (such as password changes, sign-ins and payments). This helps us keep accounts safe and investigate problems.

• To create your account, sign you in and keep it secure, including sending sign-in and confirmation codes.
• To provide our products and give you access to the plans you pay for.
• To issue invoices, take payments, send receipts and remind you about payments that are due.
• To answer your enquiries and give support, by email, phone, SMS or WhatsApp.
• To detect and prevent fraud, abuse and security incidents.
• To meet our legal duties, such as keeping tax records.

We use your data because we need it to provide the service you signed up for (our contract with you), because we must by law (for example, tax records), because we have a legitimate interest that doesn't override your rights (for example, keeping our systems secure), or because you agreed (for example, when you send us the contact form). Where we rely on your agreement, you can withdraw it at any time.

When a business uses our products, the business decides what data goes in, such as its own customers' names and phone numbers. For that data the business is responsible, and we process it only on its instructions and to run the service. If you are a customer of a business that uses our software, please contact that business first about your data. We'll help them answer you.

We don't sell your personal data and we don't use it for advertising. We share it only with providers that help us run our services:

• Hosting: the servers our services run on.
• Cloudflare: website delivery, security and spam protection.
• PayHere: card payments.
• Google: only if you choose to sign in with Google.
• Email, SMS and WhatsApp providers: to send you codes, invoices, receipts and messages you ask for.

We may also share data when the law requires it, or to protect our users or the public. If our business is sold or merged, your data would move with it under this same policy.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We use your Google name, email, picture and account ID only to sign you in and show who you are. We don't transfer it to anyone else, use it for advertising, or let people read it except for security, legal reasons, or with your permission.

We use only cookies that are needed to make our services work, mainly to keep you signed in. We don't use advertising or tracking cookies. Cloudflare may set a cookie to protect the site and the contact form from bots.

• Account data: for as long as you have an account. When you delete it, we erase it straight away.
• Invoices and payment records: for as long as Sri Lankan tax and accounting law requires, even after you delete your account.
• Security logs: for as long as they are useful for keeping accounts safe, then deleted.
• Contact form messages: until your enquiry is dealt with and for a reasonable time afterwards.

Everything travels over encrypted HTTPS connections. Passwords are stored only in scrambled form, secret keys are encrypted, sensitive actions need a recent sign-in and a code sent to your email, and only authorised Zen Sky staff can see your data. No system is perfectly secure. If a breach affects your data, we'll tell you and the authorities as the law requires.

Some of our providers, such as Cloudflare, Google and our hosting providers, may process data outside Sri Lanka. When that happens, we choose providers that protect data to a standard at least as strong as this policy.

You can ask us to:

• show you the personal data we hold about you, and give you a copy;
• correct anything that is wrong or out of date;
• delete your data (see the next section);
• stop or limit some uses of your data, or withdraw your consent.

Contact us using the details below and we'll reply as soon as we can, within the time the law allows. If you're not happy with our answer, you can complain to the Data Protection Authority of Sri Lanka.

You can delete your Zen Sky account yourself at any time:

1. Sign in at auth.zenskylabs.com/account.
2. Open Profile and choose Delete account.
3. Type your email address, then enter the code we email you to confirm.

Your name, email, phone, password, passkeys and connected Google account are erased straight away, and you're signed out of every Zen Sky app. Workspaces that only you belong to are closed and their plans canceled. We keep invoices we already issued, because the law requires it. You can also ask us to delete your account by email.

Our services are for businesses and aren't meant for children under 16. We don't knowingly collect their data.

If we change this policy, we'll update the date at the top. If the change is important, we'll also tell account holders by email before it takes effect.

For privacy questions or requests, email [email protected] or message us on WhatsApp at +94 76 066 9207.