Privacy Policy

1. Who we are

Naventric Technologies (Pvt) Ltd, a private limited company incorporated in Sri Lanka under the Companies Act No. 07 of 2007 ("Naventric", "we", "us"), is the data controller for the naventric.com website, customer accounts, and the customer portal. This policy explains what personal data we collect through the corporate site, how we use it, and the choices you have.

Questions about this policy or your data can be sent to us at any time via our contact page at naventric.com/about/contact.

2. Data we collect

We collect only the data needed to operate the site and serve you. We do not run any third-party product analytics today — no analytics tooling is active on naventric.com, and we will update this policy and our cookie policy before that changes.

The data we hold is:

• Account data — your name, email address, and a securely hashed password when you register.
• Session records — when you sign in we store a session record containing your IP address and browser user-agent string against your account, so we can keep you signed in and notice unusual access.
• Quotation requests — your name, email, phone number, company details, and project information when you request a quote or custom solution.
• Contact inquiries — your name, email, the reason you are contacting us and your message, plus your phone number and business name if you provide them. You do not need an account to send one.
• Support requests — the subject, category, and full message thread of any support case you open from the customer portal, including our replies.
• Knowledge Base activity — the articles you like or bookmark while signed in, stored against your account so we can show your saved reading. Article views are counted as anonymous totals with no identifier attached.
• Technical logs — server logs and error reports generated while operating and securing the service.

3. How we use your data

We use the data above to:

• Create and authenticate your account, including email verification and password resets.
• Respond to quotation requests and contact inquiries.
• Receive, triage, and respond to support requests you open from the customer portal.
• Show you the Knowledge Base articles you have saved, and count how often each article is read.
• Operate, secure, and improve the website and customer portal.
• Send transactional email such as verification links and password reset links. We do not send marketing email without your consent.

4. Legal bases

Where the EU/UK General Data Protection Regulation (GDPR) applies, we rely on the following legal bases:

• Performance of a contract — creating and maintaining your account and providing the customer portal.
• Legitimate interests — securing the service, preventing abuse, responding to the inquiries and support requests you send us, and understanding in aggregate how our published articles are read.
• Consent — where required, for example if we introduce marketing communications.

5. Service providers (sub-processors)

We use a small number of service providers to operate the site. Each processes data on our behalf under its own data processing terms. Two of them — Sentry and PostHog — are wired into our codebase but not switched on: no data has ever been sent to either, and we will update this list and our cookie policy before that changes.

• Vercel — website hosting and content delivery (global edge network).
• Supabase — managed database hosting (AWS ap-northeast-2, Seoul).
• Resend — transactional email delivery.
• Cloudinary — image storage and delivery for Knowledge Base articles (United States). Article images are uploaded to Cloudinary by our authors, and your browser loads those images directly from Cloudinary, so your IP address and browser information reach Cloudinary when an article image is displayed.
• Sentry — error monitoring. Wired but not active; no data has been sent.
• PostHog — product analytics. Wired but not active; no data has been sent.

6. International transfers

Our providers may process data outside the country in which you live. Where GDPR applies, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses implemented by each provider. We do not sell personal data, and we do not share it with third parties for their own marketing.

7. Data retention

• Account data — kept while your account is active and deleted upon verified account deletion requests.
• Session records — the IP address and user-agent stored with a session are held for the life of that session. Sessions expire after 30 days, and are removed when you sign out or when your account is deleted.
• Quotation requests and contact inquiries — kept for as long as needed to respond and to maintain business records.
• Support requests — the full message thread is kept for as long as needed to support your account and to maintain business records, and is deleted with your account.
• Knowledge Base likes and bookmarks — kept until you remove them or your account is deleted.
• Logs — kept for limited periods appropriate to security and to operating the service.

8. Your rights

Depending on where you live, you may have the right to access, rectify, erase, or receive a portable copy of your personal data, to restrict or object to its processing, and to lodge a complaint with your supervisory authority. To exercise any of these rights, contact us via the contact page — we respond within the timeframes required by applicable law.

9. Security

All traffic is encrypted in transit (TLS). Passwords are stored using modern one-way hashing. Access to production data is restricted by role-based access control.

10. Naventric products (Helm)

Naventric products such as Helm run as separate services on their own subdomains. Data you upload into a product — including any employee or payroll data processed in Helm — is governed by that product's service terms and data processing agreement, available to subscribers. This policy covers the corporate website, account registration, and the customer portal.

11. Changes to this policy

We may update this policy from time to time. Material changes will be announced on this page with an updated effective date.