Plain-language summary. We use personal data to provide and secure Apexfinancer, process subscriptions, support users, and enable the business features you choose. We do not sell personal data and do not use workspace financial records for third-party behavioural advertising.
1. Scope and our privacy roles
This Privacy Policy applies to the Apexfinancer website, web application, related portals, communications and support services (together, the “Service”). “Apexfinancer”, “we”, “us” and “our” refer to Apexfinancer Technologies.
When we are the controller
We decide why and how personal data is processed for account registration, authentication, subscription administration, billing records, security, fraud prevention, product operations, support and our own service communications.
When we are a processor or service provider
Organizations use Apexfinancer to enter and manage information about their customers, vendors, salespeople, employees, prospects and other individuals (“Workspace Data”). For that data, the organization is normally the controller and Apexfinancer processes it on the organization’s instructions. If your data was entered by an Apexfinancer customer, please direct your request to that organization first. We will assist the organization where required.
2. Personal data we collect
| Category | Examples |
|---|---|
| Account and profile data | Name, email address, telephone number, profile image, password hash, job or role information, account status and verification records. |
| Organization and Workspace Data | Organization details; contacts; customer, vendor and salesperson records; billing and shipping addresses; tax identifiers; invoices, quotes, receipts, bills, expenses, banking records, inventory, projects, timesheets, notes, documents and uploaded files. |
| Subscription and transaction data | Plan, trial, renewal and payment status, transaction references, amounts, currency, billing cycle and payment-provider responses. We do not collect or store full payment-card details entered on PayHere’s hosted checkout. |
| Communications | Support inquiries, email, SMS and WhatsApp message content and recipients, delivery records, attachments, campaign activity and communication preferences when those features are used. |
| Device, log and usage data | IP address, browser and device information, timestamps, authentication and security events, activity logs, referring page, pages or features used, error records and cookie identifiers. |
| Configuration and credentials | Settings and encrypted credentials that an organization supplies for optional email, SMS, WhatsApp or other connected services. |
Please avoid entering sensitive personal data unless it is necessary for a legitimate business purpose and you have authority to process it.
3. Where personal data comes from
- Directly from you when you register, update a profile, subscribe, contact support or use the Service.
- From your organization and its authorized users when they create accounts, assign permissions or enter Workspace Data.
- From your customers, vendors and other contacts when they use a portal, respond to a communication or provide information to an organization using Apexfinancer.
- Automatically through cookies, server logs and security technologies when you use the Service.
- From service providers, such as payment status from PayHere and message-delivery status from a connected communications provider.
4. How we use personal data
- Provide, operate, maintain and improve the Service and its accounting, invoicing, inventory, reporting, project and communication features.
- Create accounts, authenticate users, maintain sessions and enforce organization roles and permissions.
- Process subscriptions, verify payment outcomes, issue service records and administer trials, renewals and plan access.
- Generate documents, reports and dashboards requested by authorized users.
- Deliver transactional email, SMS or WhatsApp communications when an organization configures and requests those features.
- Respond to support requests and important administrative or security communications.
- Detect, investigate and prevent fraud, abuse, unauthorized access, service disruption and other security incidents.
- Monitor reliability, diagnose errors, preserve audit trails and improve usability and performance.
- Comply with legal obligations, enforce agreements, establish or defend legal claims and protect users, the public and our rights.
We do not make decisions that produce legal or similarly significant effects about individuals solely through automated processing.
5. Legal grounds for processing
Depending on the context and applicable law, we process personal data because:
- it is necessary to enter into or perform a contract with you or your organization;
- it is necessary for our legitimate interests or those of another party, including securing, administering and improving the Service, provided those interests are not overridden by individual rights;
- it is necessary to comply with a legal obligation;
- you have given consent, which you may withdraw for future processing; or
- another lawful ground applies, including the establishment, exercise or defence of legal claims.
7. Subscription payments
Apexfinancer uses PayHere for hosted subscription checkout. When you continue to checkout, information needed to process and reconcile the payment—such as your name, email, organization, amount, currency and transaction reference—is sent to PayHere. Payment-card details are entered directly into PayHere’s environment and are not collected or stored by Apexfinancer. PayHere processes payment information under its own privacy notice and terms.
9. International data transfers
Some providers or connected services may process data outside Sri Lanka or the country where you live. Where a restricted international transfer occurs, we use safeguards appropriate to the applicable law, such as contractual commitments, security measures, risk assessment and data minimization. Organizations are responsible for assessing transfers caused by providers and integrations they independently configure.
10. How long we keep data
We keep personal data only for as long as reasonably necessary for the purposes described here, including providing the Service, maintaining legitimate business and financial records, resolving disputes, enforcing agreements and meeting legal, tax, accounting and security obligations.
- Account and Workspace Data is generally retained while the relevant account or organization is active and for a limited period after closure or termination.
- Subscription, payment and accounting records may be retained for the period required by tax, company and financial-record laws.
- Security, activity and communication logs are retained for a limited period appropriate to audit, fraud prevention, dispute resolution and system integrity.
- Backups rotate on a controlled schedule; deleted information may remain in protected backups until overwritten and will not be restored except for disaster recovery or legal necessity.
We may retain data longer where preservation is required by law, a legal hold, a dispute or a valid authority request. We may also retain aggregated or de-identified information that can no longer reasonably identify an individual.
11. How we protect personal data
We use administrative, technical and organizational safeguards designed for the nature of the data and risks involved. These include access controls and organization separation, role-based permissions, password hashing, secure session cookies, transport security in production, input validation, audit and security logging, restricted configuration access, encryption of supported integration credentials, backups and incident-response procedures.
No online service can guarantee absolute security. Users must protect their passwords, use unique credentials, restrict access to authorized personnel, review permissions, and promptly notify us of suspected unauthorized activity.
12. Your privacy rights and choices
Subject to applicable law, verification and permitted exceptions, you may have the right to:
- ask whether we process your personal data and request access to it;
- request correction or completion of inaccurate data;
- request erasure in qualifying circumstances;
- withdraw consent where processing relies on consent;
- object to or request restriction of certain processing;
- request review of a qualifying decision based solely on automated processing;
- receive certain data in a usable format where applicable; and
- appeal or complain to the competent data-protection authority.
You can update some profile and organization information inside the Service. To make another request, email us using the contact details below. Describe the request and the account or organization involved. We may ask for information needed to verify your identity and authority, and we may coordinate with the relevant organization if it controls the data. We will respond within the period required by applicable law.
Sri Lanka’s privacy framework includes the Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025. The commencement dates of its provisions are set by Gazette orders. This policy is intended to provide transparent practices and rights handling irrespective of staged commencement; it does not limit any rights available under applicable law.
13. Children’s privacy
The Service is designed for businesses and authorized professional users, not children. You must be at least 18 years old, or the age of legal majority where you live, to create an account. We do not knowingly solicit personal data directly from children. If you believe a child has provided personal data to us without proper authorization, contact us so we can investigate and take appropriate action.
14. Changes to this policy
We may update this Privacy Policy to reflect changes in the Service, our practices, providers or legal requirements. We will publish the revised version here and update the “Last updated” date. If a change materially affects how we use personal data, we will provide additional notice through the Service, by email or by another appropriate method before the change takes effect where required.
15. Contact us
For privacy questions, requests or complaints, contact Apexfinancer Technologies using the details below. If your request concerns data managed by an organization using Apexfinancer, please identify that organization.
Apexfinancer Technologies
[email protected]
You may also have the right to contact the Data Protection Authority of Sri Lanka or another competent supervisory authority in your jurisdiction.