Effective date: 16 September 2026
1. Scope
This Privacy Policy applies to the AppOsprey website, AppOsprey POS and related software subscriptions, custom development, hardware sales, installation, maintenance, support and consulting services provided by APPOSPREY. A signed customer agreement or project agreement may contain additional data-handling terms for a particular service.
2. Information we collect
Depending on how you interact with us, we may collect:
- Contact and identity information such as your name, business name, postal address, email address and telephone number.
- Account information such as usernames, access roles and records needed to administer an AppOsprey service.
- Commercial information such as quotations, orders, subscriptions, invoices, payments, support history and transaction references.
- Business data entered into our systems, which may include product, inventory, supplier, customer, sales, billing and reporting records.
- Documents and extracted information submitted for OCR or AI-assisted processing, including supplier invoices and stock-entry information.
- Messages, files and other information provided during enquiries, project delivery, installation or technical support.
- Basic technical and usage information such as IP address, browser, device information, visited pages and diagnostic records when these are produced by our website, hosting platform or analytics services.
3. How we use information
We use information where reasonably necessary to:
- Respond to enquiries and prepare quotations or service proposals.
- Create and administer customer accounts and subscriptions.
- Provide, configure, maintain, secure and support our services.
- Process orders, payments, billing and customer communications.
- Generate requested operational reports and provide customer support.
- Diagnose faults, prevent misuse and improve the reliability and usability of our website and software.
- Meet contractual, accounting and applicable legal obligations.
APPOSPREY does not sell personal information.
4. OCR and AI-assisted features
When a customer uses OCR or AI-assisted stock-entry features, submitted documents and extracted information may be processed to identify invoice details, match products and prepare records for human review. Customers should avoid submitting information that is unnecessary for the intended task and must review extracted information before accepting it into their business records.
We may use specialist technology providers to perform part of this processing. Information saved by a customer as a product, stock, invoice, payment or other business record is treated as customer business data and not merely as a temporary OCR result.
5. Payments
When online payments are offered, payment information may be submitted directly to a third-party payment gateway such as PayHere. The gateway processes payment credentials under its own terms and privacy practices. APPOSPREY may receive and retain information such as the payer name, amount, currency, transaction reference, payment status and information needed for accounting, support, fraud prevention or refunds.
Customers should not send full card details to APPOSPREY by email, telephone or support message.
7. Security
We use reasonable technical and organisational safeguards appropriate to the information and service involved, including access controls, managed infrastructure, backups and operational security practices. Customers are responsible for protecting their credentials, assigning appropriate user access and promptly reporting suspected unauthorised activity.
No internet transmission or storage system can be guaranteed to be completely secure. We do not claim that every security incident or service interruption can be prevented.
8. Retention and deletion
We retain information for as long as reasonably required to provide the relevant service, maintain business and transaction records, resolve support or security matters and meet contractual or applicable legal obligations. Different information may be retained for different periods depending on its purpose and any customer agreement.
When information is no longer reasonably required, we may delete, anonymise or remove it from active systems. Information removed from active systems may remain temporarily in backups until the applicable backup cycle completes. Customers should request any required export before ending a service because continued access after cancellation is governed by the applicable customer agreement and technical availability.
9. International processing
Some hosting, payment, email, analytics, OCR or other service providers may process or store information outside Sri Lanka. Where this occurs, we take reasonable steps to use established providers and handle information consistently with this policy and applicable requirements.
10. Your privacy rights
Subject to applicable Sri Lankan law and any valid exceptions, you may ask about personal information we hold about you and request access, correction or deletion. You may also raise a concern about how your information is used. We may need to verify your identity and may retain information where it is required for a contract, transaction record, dispute, security matter or legal obligation.
11. Policy changes
We may update this policy as our services, providers or legal obligations change. The updated version will be published on this page with a revised effective date. Material service-specific changes may also be communicated through the contact details associated with the relevant customer account.
12. Contact us
For a privacy question or request, email info@apposprey.com or call +94 77 176 1234. Our business postal address is available on the Contact page.