Effective date 9 October 2026

Privacy Policy

Pepulux (Pvt) Ltd ("Pepulux", "we", "us") is a product engineering company based in Jaffna, Sri Lanka. We build and run software products including Omkaarya (temple management) and DiamondOar (jewellery business management), together "the Services".

This policy explains what personal information we collect, why, and the choices you have. It applies to our websites (pepulux.com and our product websites), our apps, and the messages we send, including on WhatsApp.

1. Who is responsible for your data

Our own customers’ accounts. When a business, temple or organisation signs up for one of our products, Pepulux is responsible for the account information of that organisation and its staff users.
Data our customers put into the Services. When a temple records a devotee’s booking, or a shop records a customer’s bill, that temple or shop decides what information is collected and why. We process that information on their behalf and only to provide the Service to them. If you are a devotee or customer of one of these organisations, please contact them first about your data. We will help them respond to your request.

2. What we collect

Information you give us

Name, email address, phone number and role, when you create an account or are invited as a staff user.
Business details such as organisation name, address and tax or registration details.
Information entered into the Services by our customers, for example bookings, donations, receipts, invoices, sales, stock and customer ledgers.
Messages you send us, such as support requests or replies on WhatsApp.

Information collected automatically

Log and device information such as IP address, browser type, pages visited and times of access, used for security and to keep the Services working.
Cookies that keep you signed in and remember your preferences. We do not use cookies to sell advertising.

Information from others

Delivery status of messages we send (for example "delivered", "read" or "failed") from messaging providers such as WhatsApp.

3. Why we use it

To provide, operate and secure the Services, including signing you in and verifying your identity.
To send service messages you or the organisation you deal with have requested, such as one-time login codes, booking confirmations, reminders, receipts, invoices, staff invitations and password resets.
To provide customer support.
To prevent fraud, abuse and security incidents.
To meet legal, accounting and tax obligations.
To improve the Services using usage information, in aggregated or de-identified form where possible.

We do not sell personal information, and we do not use it for third-party advertising.

4. WhatsApp messages

WhatsApp messages from a temple to its devotees (such as booking confirmations and receipts) are sent from that temple’s own WhatsApp number, and only when the temple has recorded the devotee’s consent.

Pepulux uses its own WhatsApp Business number (display name "Pepulux") only for account and billing messages with temples, such as verification codes, demo confirmations, invoices, and payment receipts.

You can stop WhatsApp messages at any time by replying STOP to any message, and turn them back on by replying START.

5. Who we share data with

We share personal information only as needed to run the Services, with:

Infrastructure and hosting providers (for example Vercel and Supabase) that store and serve our applications and databases.
Messaging providers (for example Meta’s WhatsApp Business Platform, SMS and email providers) to deliver messages.
Payment providers, where a payment is made through the Services.
AI service providers, where a product offers an AI assistant. Only the information needed to answer the request is sent, and it is not used by us to train AI models.
Authorities, where the law requires us to, or to protect the rights and safety of our users and the public.

These providers may store data outside Sri Lanka. We use providers that apply appropriate security measures and contractual protections.

6. How long we keep data

Account information is kept while your account is active.
Records our customers keep in the Services (such as receipts, invoices and accounting entries) are kept for as long as the customer needs them, and as required by tax and accounting laws.
Logs are kept for a limited period for security purposes.
When data is no longer needed, we delete or anonymise it.

7. Security

We protect data using encrypted connections (HTTPS), access controls so each organisation only sees its own data, hashed passwords and tokens, audit logs and regular backups. No system is completely secure, but we work to protect your information and will notify affected customers of a security incident as required by law.

8. Your rights

Depending on where you live (including under Sri Lanka’s Personal Data Protection Act No. 9 of 2022 and India’s Digital Personal Data Protection Act, 2023), you may have the right to:

access the personal information we hold about you,
correct inaccurate information,
ask us to delete your information,
withdraw consent, for example to WhatsApp messages,
object to or restrict certain processing.

To make a request, email hello@pepulux.com. See our Data Deletion page for how to delete your data. We may need to verify your identity before acting on a request.

9. Children

The Services are intended for organisations and adults. We do not knowingly collect personal information from children except where an organisation records it as part of its normal activities (for example a family booking at a temple), in which case the organisation is responsible for it.

10. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and change the effective date. For significant changes we will notify customers by email or in the Services.

11. Contact us

Pepulux (Pvt) Ltd

No. 15 Murugesar Lane, Nallur, Jaffna, Sri Lanka

Email: hello@pepulux.com

Website: www.pepulux.com