Privacy Policy

1. Data Collection

We collect the following categories of data:

• Identity data: Name, email address, and account credentials provided during registration via Supabase Auth.
• Financial data: Income records, expense records, tax payments, reliefs, assets, and liabilities that you enter into the platform.
• Documents: Files you upload (payslips, receipts, invoices) stored securely in encrypted cloud storage.
• Technical logs: IP address, browser type, and access timestamps for security monitoring.

2. How We Use Your Data

Your data is used exclusively to provide and improve the Taxable service:

• Calculate your tax liability based on Sri Lankan tax law
• Generate your Statement of Estimated Tax (SET) and annual tax return
• Track quarterly payment deadlines and send reminders
• Store and organise your tax-related documents
• Communicate service updates and account notifications

3. Data Security

All data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption. Our infrastructure is hosted on enterprise-grade cloud platforms with 24/7 security monitoring. Database-level row-level security (RLS) ensures that each user can only access their own data this is enforced at the database layer, not just the application layer. Authentication is managed by Supabase Auth with JWT token verification on every API request.

4. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of all data we hold about you
• Correction: Request correction of inaccurate data
• Erasure: Request deletion of your account and all associated data
• Portability: Request your data in a machine-readable format
• Restriction: Request that we limit processing of your data

5. Cookies

Taxable uses only essential cookies required for authentication and session management. We do not use advertising cookies, tracking cookies, or third-party analytics cookies on your financial data. The landing site (taxable.lk) uses no cookies.

6. Third-Party Services

We use the following third-party services to operate Taxable:

• Supabase: Authentication and identity management
• Cloud Infrastructure: Enterprise-grade hosting, database, and encrypted storage
• Resend: Transactional email delivery (waitlist confirmation, account notifications)

We do not share your financial data with any of these providers beyond what is strictly necessary for the service to function.

7. Data Retention

We retain your data for as long as your account is active. Tax records are retained for a minimum of 5 years from the relevant Year of Assessment, consistent with IRD record-keeping requirements. When you delete your account, all personal data is permanently removed within 30 days. Anonymised, aggregated data may be retained for service improvement purposes.

8. Contact Information

For privacy-related inquiries, data access requests, or to exercise any of your rights, contact us at: privacy@taxable.lk

K2V Software Solutions (Pvt) Ltd
Colombo, Sri Lanka