Privacy Policy

Your account — your email address, your name if you give one, and which workspace you belong to. If you sign in with Google we receive your email address, name and profile picture from Google, and nothing else.

Your business records — everything you enter: clients, suppliers, invoices, expenses, payments, ledger entries, and files you upload. Some of this is other people's personal data, which you are responsible for having the right to hold.

Two things you told us at signup — which parts of the product you said mattered to you, and how you heard about us. We use these to decide what to build next. They change nothing about your account.

We do not use tracking cookies, and there is no advertising network in the product.

The database and file storage are hosted by Supabase, and the application runs on Vercel. Both are outside Sri Lanka, so your records are stored abroad.

Email — sign-in codes, invoices you send from the app — goes through Resend. Google is involved only if you choose to sign in with it.

These four are our only processors. Each holds your data to provide its service to us and for nothing else.

The people in your workspace, according to the role you gave them. Nobody in another workspace can — every table is separated at the database level, not by application code.

We can reach your data when you ask us for support, or where we must to keep the service running. We do not read it otherwise, and we do not sell it, share it for advertising, or use it to train AI models.

For as long as your workspace exists. Accounting records are meant to be kept — Sri Lankan law expects some of them for years — so we do not quietly delete old data.

If you close your workspace we delete it within 30 days. Backups roll off within 90 days after that.

A copy of your data, a correction, or deletion. Write to hello@pepulux.com and we will answer within 30 days.

If someone whose details are in your books asks you the same thing, that request is yours to answer — they are your records. We will help you find and change what you need.

Traffic is encrypted in transit and data is encrypted at rest. There are no passwords to leak, because there are none: sign-in is a code to your email address or through Google.

If a breach ever affects your data, we will tell you what happened and what it means for you — not a notice that says as little as possible.

Veblore is for businesses. It is not for anyone under 18, and we do not knowingly create accounts for them.

If we change something that matters, we will say so in the app or by email rather than only moving the date at the top of this page.

Pepulux (Private) Limited, No.15 Murukesar Lane, Nallur, Jaffna, Sri Lanka. hello@pepulux.com