Privacy Policy
This policy explains what personal data SLBis Books handles, why, and what your rights are. We keep it short and plain. We do not sell personal data and we do not use advertising trackers.
1. Who is responsible
SLBis Books is operated by SLBis IT Solutions, Sri Lanka. We follow the Personal Data Protection Act, No. 9 of 2022 ("PDPA").
There are two kinds of data, and our role is different for each:
| Data | Examples | Who decides how it is used |
|---|---|---|
| Account data | Your name, e-mail, phone, login and security details | SLBis IT Solutions (we are the "controller") |
| Business records | What a Company enters: its clients, suppliers, employees, invoices, salaries, receipts | The Company that uses the Service (it is the "controller"; we only process the data on its instructions, as its "processor") |
If you are a client, supplier or employee of a business that uses SLBis Books, please contact that business first about your data. We will help them respond to you.
2. What we collect
- Account details: name, e-mail address, phone number (optional), language and display preferences, your role in each Company.
- Security details: your password (stored only as a one-way hash, never readable), two-step verification secret and backup codes (encrypted / hashed), the devices and browsers you sign in from, IP addresses, sign-in times, and failed sign-in attempts.
- Company details: business name, address, phone, e-mail, Taxpayer Identification Number (encrypted), logo, plan and subscription dates.
- Business records entered by the Company: income, expenses, invoices, client and supplier contact details, and — when payroll is used — employee names, NIC numbers, EPF numbers, bank details and salaries. Sensitive fields such as NIC, bank account numbers and salaries are encrypted.
- Documents you upload: for example receipt photos. Location and camera information hidden inside photos is removed when you upload them.
- Activity records: an audit log of who created, changed or exported what, and when. This protects you against mistakes and fraud.
- Messages: what you send us when you ask for support.
We do not collect card numbers; we do not buy data about you from others; we do not build advertising profiles.
3. Why we use it, and the legal basis
| Purpose | Legal basis |
|---|---|
| Providing the Service: your account, your Company's books, invoices, reports, support | Performing our contract with you |
| Security: two-step verification, new-device alerts, lockouts, audit log, preventing fraud and abuse | Our legitimate interest in keeping your data safe; legal obligations |
| Service e-mails: invitations, password resets, security alerts, subscription notices | Performing our contract |
| Billing and our own accounts | Contract; legal obligations (tax and accounting law) |
| Improving the Service using totals that do not identify anyone | Legitimate interest |
| Anything else, such as marketing messages | Only with your consent, which you can withdraw at any time |
We make no decisions about you by automated means alone that have legal or similarly significant effects.
4. Cookies
We use only cookies that are necessary for the Service to work. There are no advertising or analytics cookies.
- Session cookie — keeps you signed in; deleted when you close the browser or after 30 minutes without activity.
- Device cookie — lets us recognise your device so we can alert you about sign-ins from a new device, and remember a device you chose to trust for two-step verification (up to 12 months).
- Preferences on your device — light/dark mode, and the app files stored so it opens quickly. Your financial data is never stored on your phone.
5. Who we share it with
Only those who need it to run the Service, under contracts that require them to protect it:
- our hosting provider (servers and e-mail delivery);
- our own authorised staff, who must use two-step verification and whose access is logged;
- professional advisers (for example auditors or lawyers) where necessary;
- authorities, when the law requires us to.
We never sell or rent personal data. Users in your Company see the Company's data according to the roles the owner gives them.
6. Where data is stored
Data is stored on the servers of our hosting provider.If data is stored or accessed outside Sri Lanka, we make sure it is protected as the PDPA requires.
7. How we protect it
- All connections are encrypted (HTTPS).
- Passwords are stored as one-way hashes; sensitive fields are encrypted in the database.
- Two-step verification (required for Company owners and our staff), automatic lockout after repeated failed sign-ins, and automatic sign-out after 30 minutes without activity.
- Each Company's data is separated from every other Company's.
- A tamper-evident audit log records important actions.
- Regular encrypted backups.
No system is perfectly secure. If a personal data breach happens that is likely to harm you, we will inform the affected Companies and the Data Protection Authority as the law requires, without undue delay.
8. How long we keep it
- Account and business records: for as long as the Company's account is open.
- After an account is closed: the Company can request an export for 30 days; then the data is deleted from our live systems and disappears from backups as they expire (normally within 30 days more).
- Security and audit logs: up to 12 months after the account is closed, to investigate misuse.
- Our billing records: for the period tax and accounting law requires.
Businesses are themselves required by law to keep accounting and payroll records for certain periods. Each Company is responsible for exporting and keeping what it needs.
9. Your rights
Under the PDPA you have the right to:
- know what personal data we hold about you and receive a copy;
- have inaccurate or incomplete data corrected (you can change most details yourself under "My profile");
- have your data erased where the law allows;
- withdraw consent, and object to processing based on legitimate interest;
- ask for a human to review any decision made only by automated means;
- complain to the Data Protection Authority of Sri Lanka if you believe your rights have been infringed.
To use these rights, write to us. We may need to confirm your identity. We answer within the time the law requires and free of charge unless a request is clearly excessive. For business records, please contact the Company that entered them; we will assist that Company.
10. Children
The Service is for businesses and is not intended for anyone under 18.
11. Changes to this policy
When we change this policy we publish the new version here with its date. For important changes we tell you in the app or by e-mail before they apply.
12. Contact
SLBis IT Solutions
Version 1.0 · in force from 04/10/2026 · Back to the app