Privacy policy

Last updated: 11 November 2026

Kripson (Pvt) Ltd ("we") provides Kripson ERP. This policy explains what personal data we process and why, in line with Sri Lanka's Personal Data Protection Act, No. 9 of 2022.

Two kinds of data

Your account data. This is the name, email, phone and billing details of the people who sign up and use the service. We are the controller of this data.

Your business data. This is the customers, suppliers, employees, products and transactions you enter. You are the controller; we process it only to provide the service, on your instructions.

What we use it for

• Running the service, keeping it secure and preventing abuse.
• Billing and support.
• Service emails (password resets, invoices, important changes). We send marketing only with consent, and you can opt out at any time.

Where it is stored

Data is hosted with reputable cloud providers, which may be outside Sri Lanka, and is encrypted in transit and at rest. Each business's data is isolated at the database level. Backups are encrypted and kept for 30 days.

Who we share it with

Only with sub-processors needed to run the service: hosting, email delivery and the payment gateway. We share it with authorities only when the law requires. We never sell personal data.

Your rights

You can access, correct, export or delete your data. Business owners can export everything from the app. To exercise your rights, email privacy@kripson.lk.

Retention

Business data is kept while your subscription is active, then for 90 days after cancellation so you can return or export it, and then deleted. Where tax law requires us to keep billing records, we keep them for the period it sets.

Cookies

The app uses one essential sign-in cookie. This website uses no tracking cookies.