Legal
Privacy Policy
Last updated: 1 August 2026
1. Who we are
Shopbook POS (“Shopbook”, “we”, “us”) provides offline-first point of sale software for retail shops, restaurants, supermarkets and cafes. This policy explains what data we process when you use our mobile apps, web terminal and cloud sync services.
2. Data you control (shop and customer data)
Products, prices, bills, invoices, stock movements, staff accounts and any customer details you enter belong to you. We process this data solely to operate the service on your behalf.
Each merchant account is logically isolated. Records are keyed to your organisation and outlet identifiers, and access is enforced at the database level so no other merchant can query your rows.
3. Offline device telemetry
While a device is offline, all transaction data is stored only in the device's local database. Nothing leaves the device until connectivity returns.
We collect limited diagnostic telemetry — app version, device model, operating system version, sync queue length, crash stack traces and error codes. Telemetry never contains bill line items, customer names, phone numbers or payment details.
Telemetry can be disabled from Settings → Privacy → Diagnostics on any device.
4. Cloud sync security
Sync traffic is transmitted over TLS 1.3. Each device authenticates with a per-device token that can be revoked instantly from your admin dashboard.
Data at rest is encrypted with AES-256 on managed cloud infrastructure. Automated encrypted backups are retained for 30 days for disaster recovery.
5. Payment information
Subscription payments made by bank transfer are verified from the deposit slip you send us. We store only the reference number, amount and date. We never store full card numbers or online banking credentials.
6. Retention and deletion
Active account data is retained for as long as your subscription is active. After cancellation, cloud data is retained for 90 days so you can reactivate or export, then permanently deleted.
You may request an export (CSV/PDF) or full deletion at any time by writing to shopbookoperations@gmail.com. Verified requests are completed within 30 days.
7. Sub-processors
We use a small set of infrastructure providers for cloud hosting, database storage, crash reporting and messaging. All sub-processors are bound by confidentiality and data protection obligations, and none are permitted to use your data for their own purposes.
8. Your rights
You may request access, correction, export or erasure of personal data we hold about you, and you may object to diagnostic telemetry processing. Contact shopbookoperations@gmail.com or our WhatsApp hotline +94 78 247 0168.
9. Changes to this policy
Material changes will be announced in-app and by email at least 14 days before taking effect. The date below records the last revision.
10. Account and Data Deletion for Shopbook POS
At Shopbook POS, we respect your privacy and provide full control over your data. Users can request the permanent deletion of their account and all associated personal and store data at any time.
1. How to Request Account Deletion
You can request account and data deletion using either of the following methods:
- Method 1 (Within the App): Log in to the Shopbook POS mobile app > Go to Profile / Settings > Tap Manage Business / Account > Select Delete Account / Data.
- Method 2 (Via Email Support): Send an email from your registered mobile number/email to support@shopbook.lk (or shopbookoperations@gmail.com) with the subject
"Account Deletion Request - [Your Registered Phone Number]". Our support team will verify your ownership and process the deletion within 7 business days.
2. Types of Data That Will Be Deleted
Upon account deletion, the following data is permanently removed from our active databases:
- Personal details (Name, Registered Phone number, Login sessions).
- Store and business branch configurations, custom categories, and product catalog details.
- Staff access credentials and employee permissions.
- Device identifier tokens and location logs.
3. Data Retention and Legal Exceptions
Certain historical sales receipts, transaction timestamps, and invoice records may be retained in anonymized form for a limited statutory retention period as required by local tax, accounting, and financial compliance regulations. Once this statutory retention period expires, these records are permanently purged.