Loading...
Loading...
Legal
Effective August 16, 2026 (version 0.3)
Taxable is a personal tax management platform for individual taxpayers in Sri Lanka. It is operated by Kasun Kodagoda, trading as K2V Software Solutions, based in Sri Lanka, and it is a product under the WealthyIslander brand. Kasun Kodagoda decides what personal data this platform collects and why, and is therefore the controller of that data.
You can reach us about anything in this policy at privacy@taxable.lk. We do not publish a postal address.
If you have a question about this policy, or you want to exercise any of the rights described in section 9, write to privacy@taxable.lk. That address is the contact point for anything to do with your personal data.
We have not appointed a Data Protection Officer. Section 20 of the Act requires one in circumstances that depend on thresholds to be prescribed and on guidelines to be issued by the Data Protection Authority, and those have not been made. We are not in a position to say the duty applies to us, and we are not claiming it does not. Until that is settled, privacy@taxable.lk reaches the person responsible, which is the controller named above.
Data you give us directly.
Data we create about you.
Data we collect automatically.
Why we record your IP address and browser identification string. Under the Act these are personal data whenever they sit on a record that identifies you, because the definition of personal data expressly includes an online identifier. We put them on our own access and acceptance records for two purposes: to keep the platform secure and investigate misuse, and to be able to show that you accepted a particular version of a policy at a particular moment. Our analytics provider separately receives your IP address as part of what section 5 describes.
Data about other people. Some of what you enter is personal data about people other than you: co-owners of your assets and their relationship to you, people and organisations you paid, lenders, clients named as income sources, and the name and email address of any tax agent you share an export package with. You are the source of that data, and those people have not dealt with us directly. We use it only to prepare and present your tax position. If you share an export package, we also record the IP address and browser of whoever opens the link, including their passcode attempts.
If you are one of those people, this section is your notice. Schedule V to the Act says that where a controller obtains personal data other than directly from the person, it should tell them where the data came from. For almost everyone in the category above we hold no contact details at all, so reaching each of them individually is not something we can do. Schedule V item 6(b) excuses that notice where it proves impossible or would take disproportionate effort, and requires the controller instead to make the information publicly available. That is what this section is.
So, plainly: if a Taxable user has recorded you as a co-owner, a payee, a lender, a client, or a recipient of a qualifying payment, we hold that record because they entered it. They are the source. We use it only to prepare their tax position, we do not build a profile of you, and you can write to privacy@taxable.lk to ask what we hold about you. Where we do hold your email address, because a user shared an export package with you, we will tell you directly at the time we first contact you rather than relying on this section.
If instead you asked us directly to contact you about our tax agency portal, rather than being entered by a user as someone connected to their tax affairs, section 13 is your notice, not this one.
Whether you have to give us this data, and what happens if you do not. You are under no legal obligation to us to provide any of it. You give it to us so that the platform can do the thing you are paying it to do. Some of it is necessary for that: without your income, expense, and relief records there is nothing to calculate, and without your identity and tax numbers the result cannot be attached to you for a filing. Other fields are optional, and the platform works without them. If you withhold the necessary data, the consequence is simply that we cannot produce a tax position for you.
Providing this data is a requirement of our contract with you rather than something the law obliges you to give us. Section 3 explains the basis on which we process it.
We use your data to:
The basis on which we do all of this. Schedule I of the Personal Data Protection Act, No. 9 of 2022, sets out the conditions that make processing lawful. For everything in the list above except the last item, we rely on item (b), that the processing is necessary to perform our contract with you. That contract is your subscription to Taxable, and its whole substance is that you record your tax information and we calculate your position from it, produce your documents, remind you of your deadlines, and take payment for doing so. We cannot do any of that without processing this data.
For the last item, understanding how the platform is used, we rely instead on item (f), our legitimate interests in seeing how the product performs and where it fails, so that we can fix it. Item (f) does not apply where your interests override ours. Section 5 sets out what that processing involves, what we do to limit it, and how to tell us to stop.
As a user of the platform, we do not ask for your consent to any of the processing described in this policy, and consent is not the basis for any of it. That means there is no consent for you, as a user, to withdraw. The one exception is section 13, which is about a different group of people, those who are not Taxable users and have separately agreed to be contacted about our tax agency portal. Consent is the basis for that processing, and only that processing. Your right, as a user, to object is described in section 9, and it is a real route rather than a formality.
What the platform decides automatically. Two things happen without a person looking at them. The platform calculates your tax position from what you record, and it determines which features you can reach from whether your subscription is active. The tax figures are arithmetic applied to what you entered, and every one of them is shown to you so that you can check it; the platform does not decide whether you owe tax, it works out what your own entries imply. Beyond those two, we do not use automated processing to reach conclusions about you. The separate question of what our analytics provider infers from watching how you use the platform is dealt with in section 5.
The Act gives you a right, under section 18, to ask us to review a decision made solely by automated processing where it creates an irreversible and continuous impact on your rights. Neither of the two things above is that kind of decision. The tax calculation produces figures you can see and check, and it changes whenever you change what you recorded. The subscription check controls which screens you can open, and it reverses the moment you renew. Both are necessary to provide the service you are paying for, which section 18(2)(d) recognises. If you think an automated outcome in Taxable is wrong, write to us anyway and a person will look at it.
We do not sell your data, and we do not share it for advertising.
We use the following service providers to run the platform. Each one receives some of your data.
If you sign in using a Google, Facebook, or Microsoft account, that provider learns that you signed in to Taxable.
Those sign-in providers are not working to our instructions. They decide for themselves what to do with the fact that you signed in, which makes each of them a controller of that information in its own right, not our processor. What they then do is governed by their own privacy policy, and we do not control it. If you would rather not tell them you use a tax platform, sign in with an email address and password instead.
On our agreements with these providers. We use each of the providers above on their standard published terms, which is how services of this kind are normally bought. We have not separately negotiated or signed individual data processing agreements with any of them, and we have not completed a review of whether their standard terms contain everything the Act requires of a contract between a controller and a processor.
Two corrections to what we told you before. The version of this policy published on 27 March 2026 said that we used no third party analytics cookies and that taxable.lk used no cookies. Both statements were untrue. That text was later corrected without the version number or the effective date changing, so depending on when you read it you may have seen either wording. This section states what actually happens.
On our marketing site, taxable.lk, we run Google Analytics, which sets cookies and records your IP address and how you browse the site. It loads whenever you visit.
In the app, app.taxable.lk, we use cookies that are necessary to keep you signed in, and we run PostHog to understand how the product is used and to catch errors.
We record your sessions in the app. PostHog captures what happens on screen as you use Taxable, so that we can see how features are used and diagnose faults. You should understand what this means in practice.
The basis for this, and how to stop it. We do not ask your consent for analytics or session recording. We rely instead on item (f) of Schedule I to the Personal Data Protection Act, No. 9 of 2022, our legitimate interest in understanding how the product performs and where it fails. That basis does not apply where your interests override ours, so the masking and blocking described above are not courtesies; they are part of what makes this processing proportionate.
You can tell us to stop. There is no self-service switch today. Write to privacy@taxable.lk and we will exclude you from analytics and session recording. We will not ask you to justify it.
On profiling. The Act defines profiling broadly enough to include evaluating a person's economic situation, behaviour, or habits. Watching how you move through a tax product may fall within that definition. We do not use what we observe to make any decision about you: it is used to find faults and to see which features are used. No impact assessment of this recording has been carried out.
Your data is stored and processed outside Sri Lanka. Every provider named in section 4 except PayHere is located abroad. Specifically:
On what basis those transfers happen, including where we do not have a settled answer. Section 26 of the Personal Data Protection Act, No. 9 of 2022, governs sending personal data out of Sri Lanka. It was repealed and replaced in full by Amendment Act No. 22 of 2025, which removed the mechanism by which a country could be recognised as offering adequate protection. There is no longer any list of approved countries.
For the transfers that keep the platform running, our database, document storage, hosting, email, and payments, we rely on section 26(3)(b): the transfer is necessary to perform our contract with you. Taxable cannot store or calculate anything without them.
Analytics and session recording are different, and we would rather say so than blur it. That processing rests on legitimate interests, not on contractual necessity, so section 26(3)(b) does not cover sending it abroad. The Act's main route requires us to adopt binding instruments specified by a directive of the Data Protection Authority, and that directive has not been issued. The remaining route is your explicit consent, and we operate no consent mechanism. So we do not have a settled ground under section 26 for transferring analytics and session recording data to the United States. We have chosen to tell you that rather than assert a basis we cannot point to. We will revisit it when the Authority issues its directive, and in the meantime you can have yourself excluded from that processing entirely by writing to privacy@taxable.lk.
A note on what this policy can and cannot tell you. Everything above describes what the Act says and what we actually do. It is not a statement that we are compliant. The Act commences in stages, and much of its detail is left to rules and directives the Data Protection Authority has yet to make, so what is required of us at any given moment is not something this document can settle.
We take this seriously and some of it is genuinely well built. Accurately:
An earlier version of this policy claimed that user isolation was "enforced at the database layer, not just the application layer", and our in-app page claimed that we use "row-level security policies" and that our database is hosted by Supabase. None of those three statements was accurate, and we are quoting them rather than quietly dropping them because you may have read and relied on them. Isolation is enforced in our application code, as described above, and your tax data is not held by Supabase.
Not everything is encrypted at field level. The names of people you paid, recipients of qualifying payments, vehicle registration numbers, your relief descriptions, and free text you enter are stored without that additional layer.
No system is perfectly secure, and we do not claim that this one is.
If there is a breach. We do not have a written, tested procedure for identifying, investigating, and reporting a personal data breach. We are telling you that rather than describing a process we do not have. What we would do is investigate immediately, notify the Data Protection Authority, and tell you directly if your data was involved and the breach could affect you. The Act requires notification to the Authority and leaves the deadline and the form of it to rules the Authority has yet to make. Writing that procedure down properly is work we have not done.
We hold your data for as long as your account exists. Apart from the three exceptions below, we have not set a retention period for any category of data, and nothing in the platform deletes your data automatically because of its age.
Three time limits do exist today. An export package you generate for a tax agent has its contents deleted after 7 days. A document you delete is moved out of your library immediately and the file itself is removed 30 days later. And where someone who is not a platform user has asked us to contact them about our tax agency portal, described in section 13, we keep their details for 24 months from their last contact with us rather than indefinitely.
Your own record-keeping duty is separate from ours, and it runs longer than you might expect. Under section 120(6) of the Inland Revenue Act, No. 24 of 2017, a person required to prepare or retain records of a transaction must keep them for five years from the date on which the transaction took place, and for longer than five years where the time limit for assessing tax for a relevant period has not expired or related proceedings have not been completed. That duty is yours rather than ours. We hold copies so that you have what you need to meet it, which is one reason we are cautious about deleting anything on a fixed schedule.
The criteria we use, since we have not set fixed periods for everything else. The Act accepts that a controller may not always know a period in advance, and asks in that case for the criteria instead. Ours are these. We keep your tax records, uploaded documents, and account and identity data for as long as your account exists, because they are what the service is, and for as long as they remain useful to the years of assessment they cover. We keep access and audit logs, notification records, and payment records for as long as they serve the purpose we made them for, which is security investigation, proving what we sent you, and our own accounting.
We are not publishing a fixed schedule for those categories, and the honest reason is that nothing in the platform would enforce one. Apart from the three limits above, no data is deleted because of its age. We would rather tell you that than print a timetable that nothing keeps to. If we do adopt fixed periods, we will say so in a new version of this policy, and only once the platform actually applies them.
When you close your account. Deleting your account is a two-step process rather than an instant one. You request deletion from Settings and we email you a confirmation link. Using that link starts a 14-day grace period, during which your account becomes read-only and you can cancel at any point by returning to the deletion screen. Once the grace period has ended and an administrator has authorised the purge, we permanently delete your income and expense records, tax payments, reliefs, assets and liabilities, co-owner details, every uploaded document, generated export packages, feedback you submitted, and the sign-in itself. We also hold ourselves to an internal target of completing the whole process within 30 days of your original request; that target has not previously been stated to you, and it is longer than the grace period because the purge is authorised by a person rather than run automatically.
What survives that. Three things outlast an account purge, and you should know about them.
Those acceptance records are kept indefinitely at present. We have not set an end date for them, because the agreement they evidence has no fixed expiry either, and a record that proves what you agreed to is worth nothing if it is destroyed before the question arises. If you want to know what we hold in yours, ask us.
You have rights over your personal data. Here is what each one means and, honestly, what we can actually do today.
Access. You can ask for a copy of the data we hold about you. There is no self-service export today, so write to privacy@taxable.lk and we will assemble it by hand.
Correction. You can correct your data yourself, at any time, in your account settings. Your tax profile, your tax identity, your bank accounts, and your co-owners are all directly editable. This one works well.
Erasure. You can delete your account yourself, from Settings. Section 8 describes what that does and what survives it. One limit is worth stating separately: the purge reaches our own systems and your sign-in, but we have no automated way to make our analytics provider or our payment provider delete what they already hold about you.
If you want those two providers to delete what they hold as well, write to privacy@taxable.lk and we will pass the request to them by hand. We cannot promise what they will do with it, because we do not control their systems, but we will make the request and tell you what came back.
Objection. You can object to our processing your data. This matters most for analytics and session recording, which is the only processing we base on our own legitimate interests, and there you do not need to give a reason: tell us and we will exclude you. For everything else we rely on the necessity of performing our contract with you, so an objection to that is effectively a decision to stop using Taxable, and closing your account is the way to do it.
There is no consent for you, as a user, to withdraw here, because we do not rely on consent for anything else described in this policy. Section 13 concerns a different group of people, those who have separately consented to being contacted about our tax agency portal, and describes their consent and how they withdraw it. We would rather say that than list a right that has nothing to attach to.
Portability. You can ask for your data in a machine readable format. The export package feature partly serves this, but it covers one Year of Assessment at a time and is built for handing work to a tax agent, so it is not a complete copy of everything we hold.
Appeal. If we refuse a request, the Act as amended requires us to tell you that you may appeal to the Data Protection Authority.
Complaint. Separately from that appeal, the Act provides for a data subject to complain to the Data Protection Authority about how a controller is handling personal data, whether or not we have refused you anything. You do not have to come to us first.
The Act as amended requires us to answer a request without undue delay and within one month. That period can be extended by a further two months where we give you reasons before the first month expires, and it can never exceed three months in total. Requests must be answered free of charge.
How to make a request, and what we do with it. Send it to privacy@taxable.lk. That mailbox is where these requests are received, and we log each one with the date it arrived and the date we answered, so that the one month period above is something we can actually show rather than only assert. We handle this by hand; there is no self-service portal.
For the appeal and complaint routes, the Act gives you the right but leaves the contact details, the form, and the manner of making them to the Data Protection Authority to set. We have not been able to confirm those details, so we have described the rights rather than printed a procedure that may turn out to be wrong. Ask us and we will tell you what we know at the time.
To exercise any of these, write to privacy@taxable.lk.
Taxable is for individual taxpayers and is not intended for children. Our Terms of Service require you to be at least eighteen to hold an account.
We do not ask your age when you sign up and we do not verify it, so we cannot tell you that we never hold a child's data. We are not going to claim otherwise, because we would have no way of knowing. A child's personal data is a special category under the Act, which is why this matters more than it might seem. If you tell us an account belongs to someone under eighteen, we will close it and delete the records held in it.
If we change this policy in a way that matters, we will publish it as a new version, tell you what changed, and ask you to accept it before you carry on using the platform. Your acceptance of each version is recorded, as described in section 2.
The version published on 27 March 2026 did not work that way. Its text was rewritten twice while the version number and the effective date stayed the same, so a reader had no way to tell that what they were looking at had changed. That is one of the failures this version exists to correct.
What counts as a change that matters. We will publish a new version and ask you to accept it whenever we change what we do with your data, what you pay, or your rights and our obligations to you. That includes adding a purpose, adding a provider who receives your data, changing the basis on which we process anything, changing how long we keep it, or narrowing a right described here.
We will not ask you to re-accept for a change that does not alter any of that: correcting a typo, making a sentence clearer, or reformatting. Those are republished quietly, and the version number still changes so you can tell something moved.
When we do ask, we will tell you by email and in the platform itself, and you will see a summary of what changed rather than being left to compare two documents yourself.
For any privacy question, or to exercise your rights, email privacy@taxable.lk. We do not publish a postal address, so email is the way to reach us about your data.
The controller is Kasun Kodagoda, trading as K2V Software Solutions, in Sri Lanka.
This section is about you if you are a tax agent, an accountant, or someone at a tax agency who has asked us to contact you about Taxable's tax agency portal, whether by filling in the interest form at taxable.lk or by responding to a prompt shown inside a tax return export package a Taxable user shared with you. You are not a Taxable user, and nothing else in this policy is written with you in mind. This section is.
Who is responsible for your details. The controller is Kasun Kodagoda, trading as K2V Software Solutions, the same controller named in section 1.
Why we hold your details, and what we do not do with them. We use your name, email address, and phone number for one purpose: to contact you about Taxable's tax agency portal, including occasional email updates about it. We do not add you to any other mailing list, and we do not use your details for anything else.
Consent is the basis for this, and only this. Everywhere else in this policy we rely on our contract with our users or on our own legitimate interests, not on consent. Here we rely on your consent, because contacting you by electronic means for this purpose requires it under section 27 of the Act. You give that consent by ticking an unticked box before you submit your details, it is not bundled with anything else you may be agreeing to at the same time, and you are told, before you give it, that you can withdraw it at any time.
Who receives your details. Resend sends the emails; it receives your name and email address. Microsoft Azure stores your submission in our database; it receives your name, email address, and phone number.
Your details leave Sri Lanka, and here is what that risks. Resend and Azure both hold your details outside Sri Lanka. If you responded to our tax agency prompt from inside a shared export package, our analytics provider, PostHog, also records that you did, and PostHog's servers are in the United States. Sending personal data abroad means it becomes subject to the laws of wherever it is held, which may not protect it the way Sri Lankan law does, and we cannot promise you that a foreign court or authority will never compel disclosure of it. We are telling you this so that your consent to this cross-border element is genuinely informed, not because we have a specific reason to expect it. Whether the Data Protection Authority has issued the safeguard instruments the Act otherwise requires for a transfer like this is not something we can confirm; if you would rather your details stayed in Sri Lanka, do not submit them to us.
How long we keep your details. We keep your details for 24 months from your last contact with us, whether that is your original submission or a later reply. Section 8 explains why every other category of data in this policy does not have a fixed period yet; this is the exception.
How to stop hearing from us. Every email we send you carries a one-click unsubscribe link, free of charge, and using it stops the emails immediately. That is separate from withdrawing your consent outright. To withdraw your consent altogether, write to privacy@taxable.lk. Withdrawing does not make anything we did with your details before the withdrawal unlawful, and once you withdraw we stop using your details for this purpose.
If you ask us to withdraw, or make any other request about your details. We will answer without undue delay and within one month of receiving it. We can extend that by a further two months if we tell you why before the first month is up, but we will never take more than three months in total, and we will never charge you for it. If we refuse a request, we will tell you why, and we will tell you that you can appeal to the Data Protection Authority.
Your right to complain. Separately from any request you make to us, you can complain to the Data Protection Authority about how we handle your details, whether or not we have refused you anything.