Privacy policy
PodiBot is a WhatsApp assistant and shared inbox for small shops in Sri Lanka. This page explains, in plain words, what personal data PodiBot handles, why, who else sees it, and what rights you have. PodiBot is a product of CoreVezel Tech (“we”, “us”). It is in early access, and this policy describes how it works today.
1. Who is responsible for what
- Shops that use PodiBot (“shops”) decide why and how their customers' chats are used. For those chats, the shop is the one responsible for the data and PodiBot processes it on the shop's behalf and on its instructions.
- We are responsible for the data of the people who use the PodiBot dashboard (shop owners and their team), for this website, and for keeping the service secure.
If you are a shop's customer and want to know why a shop has your number, ask that shop first. You can also write to us and we will help (see section 9).
2. What we collect
Customers who message a shop on WhatsApp
- Your WhatsApp phone number and the name on your WhatsApp profile.
- The messages you send and receive in that chat: text, photos, videos, voice notes, documents and stickers.
- Payment slips (photos of bank transfer receipts) if you send one, and the amount and reference number read from them.
- The language you write in, and a note of the reason your details are kept (for example, “to answer your order enquiry”).
- Any request you make to have your data deleted.
Shop owners and their team
- Your name, email address, role (owner, admin, agent or viewer) and sign-in details, including your authenticator setup. Passwords are never stored in readable form.
- The shop information you write for the bot (opening hours, delivery, prices and so on) and your settings.
- A record of important actions in the dashboard (who did what, and when).
People who visit this website
The public pages use no advertising or tracking cookies and no analytics. Signing in sets the cookies needed to keep you signed in. Our servers keep short technical logs (for example, errors and timings) to run the service; phone-number-shaped values are masked in them and message text is not included.
3. Why we use it
- To deliver the service: receive a customer's message, reply, pass the chat to a person when needed, and show it in the shop's inbox. (Basis: the contract with the shop, and the shop's legitimate interest in serving its customers.)
- To read payment slips so the shop can approve payments. (Basis: the shop's contract with its customer, and legal record-keeping.)
- To keep the service safe: preventing abuse and floods, and keeping an audit trail. (Basis: legitimate interest and legal obligation.)
- To run accounts and talk to shop owners about their account. (Basis: contract.)
We do not sell personal data. We do not use customers' chats for advertising, and we do not combine one shop's data with another's.
4. AI-assisted replies
The bot can answer questions using AI. To do that, the text of a customer's message and the facts the shop has written down are sent to Google's Gemini service, and the same service reads payment slip photos to find the amount and reference. The bot is instructed to answer only from the shop's own facts and to hand over to a person when it is not sure. We use a paid (billing-enabled) Gemini account. A shop can switch AI replies off for one customer or for everyone at any time.
5. Who else handles the data
We use these services to run PodiBot. They act on our instructions and see only what they need.
- Meta (WhatsApp Business Platform): carries the messages between customers and shops.
- Google (Gemini): AI replies and slip reading, as described above.
- Supabase: the database and private file storage. Data is stored in Singapore.
- Cloudflare: hosting and delivery of the website and the service.
- Datadog: operational logs only (timings, errors, status codes). Message text, names, slip images and tokens are not sent; phone numbers are masked before leaving our servers.
Some of these providers run servers in other countries. Customer chat data is stored in Singapore, and we do not move personal data outside Southeast Asia or the European Union without first assessing the transfer. Authorities may also receive data where the law requires it.
6. How long we keep it
| Data | Kept for |
|---|---|
| Raw message event records | 90 days, then deleted automatically |
| Payment slip images | 90 days, then deleted automatically |
| Conversation history in the shop's inbox | Up to 12 months |
| Payment and tax records the shop must keep | Up to 7 years (without the customer's personal details once they ask for erasure) |
| Audit trail of important actions | 7 years |
| Operational logs (Datadog) | A short period set in Datadog, recommended 15 days or less |
7. How we protect it
- Each shop's data is kept separate from every other shop's, and enforced in the database itself.
- Payment slips sit in private storage and are opened only through short-lived links for the shop's team.
- Staff sign in with an authenticator. Our own staff can see a shop's chats only through a time-limited, logged support session.
- Connections are encrypted, and stored WhatsApp access tokens are encrypted.
No system is perfectly secure. If something goes wrong that puts your data at risk, we will tell the affected shops and the authorities as the law requires.
8. Your rights
Under Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (which is being phased in), you can ask to see the personal data held about you, to correct it, to withdraw consent, and to have it erased. A customer can ask in the WhatsApp chat itself to have their data deleted. The shop sees the request and tracks it, and it is completed within 30 days. Payment and tax records the shop is required to keep are kept without your personal details. If you are unhappy with how your data is handled, you may complain to Sri Lanka's Data Protection Authority.
9. Contact
For questions, requests to access or delete data, or concerns: hello@podibot.lk. Please include the shop you chatted with, if you are a customer.
10. Changes
We will update this page when the service or the law changes, and change the date at the top. For significant changes, we will tell shop owners directly.