Privacy Policy

1. Who we are

PromoX (“we”, “us”) operates a cloud-based point-of-sale and business management platform for retail stores in Sri Lanka. Our website is promox.lk and the service is provided through our admin dashboard and POS applications.

2. Information we collect

We collect the following categories of information:

• Account information — name, email address, phone number, and role of store staff and administrators.
• Business data — store details, products, inventory, pricing, suppliers, and transaction records entered into the platform.
• Customer data — where a store collects customer details (e.g. for digital receipts or loyalty), that data belongs to the store and is processed by us on the store’s behalf.
• Usage and device data — IP address, browser type, and basic telemetry used for security and service improvement.

3. How we use information

• Provide, operate, and secure the POS platform.
• Process transactions, sync data between devices, and generate reports.
• Send transactional emails — receipts, password resets, invitations, and scheduled reports — via Amazon SES.
• Respond to support requests and communicate service updates.
• Detect fraud, abuse, and security incidents.

We do not sell personal information and do not use your data for advertising or marketing emails.

4. Transactional email (Amazon SES)

We use Amazon Simple Email Service (SES) to deliver transactional emails such as digital receipts, password resets, staff invitations, and scheduled business reports. These emails are sent only to recipients who have a direct relationship with a store using PromoX — either staff registered on the platform or customers who provided their email at the point of sale. We maintain bounce and complaint suppression lists and do not send marketing email through SES.

5. Data storage and security

Data is hosted on AWS infrastructure in the ap-south-1 (Mumbai) region. We use encryption in transit (TLS), encrypted storage, and role-based access controls across the platform.

6. Data retention

Account and business data is retained while your organization’s account is active. Audit logs and transaction history are retained for the life of the account for compliance and reconciliation. Contact us to request export or deletion of your organization’s data — deletion requests are completed within 30 days, subject to legal retention requirements.

7. Third-party processors

• Amazon Web Services — hosting, database, storage, and email delivery (SES).
• Slack — internal operational alerting only; no customer personal data is sent.

8. Your rights

You may request access to, correction of, or deletion of your personal information by emailing hello@promox.lk. Stores act as the data controller for their own customers — customer requests should go to the store first.

9. Contact

Questions about this policy or your data: hello@promox.lk