Privacy Policy
Last updated
CounterDesk is order management for online sellers in Sri Lanka. This policy explains what information we handle, why, and how we protect it, across this website, the CounterDesk dashboard, our sellers' online stores and the services behind them. We never sell personal information.
Who this policy covers
- Sellers: businesses and people who use CounterDesk to run their online business.
- Shoppers: people who buy from a seller's online store, or whose orders a seller records in CounterDesk.
- Website visitors: people who visit counterdesk.lk.
Information we collect
- Seller account information: name, email address, phone number and password (stored securely, never in plain text).
- Business information: business name, address, logo, products, prices, costs, stock, delivery rates, payment settings and store design.
- Order and shopper information: what a seller's shoppers enter at checkout or what a seller records for them, such as name, phone number, email, delivery address, order details, payments and uploaded bank transfer slips.
- Messages to us: what you send when you contact us on WhatsApp or by email, including the Launch Offer message.
- Technical information: device and browser type, IP address, pages used and error reports, which help us keep the service working and secure.
The Launch Offer form on this website does not send anything to our servers. It only opens WhatsApp with a message already written, and nothing is shared until you send it.
How we use information
- To run CounterDesk: process orders, update stock, work out delivery charges and profit, and show each seller their store.
- To send messages: order alerts to sellers, and order updates to shoppers by SMS and email.
- To provide support and answer questions.
- To manage subscriptions and billing.
- To keep the service secure, prevent misuse and fix problems.
- To understand how CounterDesk is used, so we can improve it.
Shoppers' information belongs to the seller
Each seller decides what to do with their own shoppers' information. CounterDesk stores and processes it on the seller's behalf, only to provide the service to that seller. Sellers cannot see other sellers' data. If you bought from a store that uses CounterDesk and have a question about your information, please contact that store first. We will help the seller with any request.
Who we share information with
We share information only with service providers that help us run CounterDesk, and only what they need:
| Provider | What they do |
|---|---|
| Vercel | Hosts this website, the dashboard and the online stores |
| Render | Runs the CounterDesk servers (Singapore) |
| Supabase | Database and file storage (Singapore) |
| Resend | Sends emails |
| SMSlenz | Sends SMS messages |
| Sentry | Reports errors so we can fix them |
| PostHog and Vercel Analytics | Help us understand how CounterDesk and this website are used |
| PayHere | Card payments, through each seller's own PayHere account |
Some of these providers store or process information outside Sri Lanka. We choose providers with strong security. We may also share information when the law requires it.
Payments
Card payments in a seller's store go through the seller's own PayHere account. CounterDesk does not see or store full card numbers. A seller's PayHere secret key is encrypted when stored and is never sent back to the browser, so not even the seller can view it again; they can only replace or remove it.
How we protect information
- All connections use HTTPS encryption.
- Sensitive settings, such as payment secrets, are encrypted when stored.
- Each seller's data is kept separate, and the database cannot be reached directly from the internet.
- Bank transfer slips are kept private and shown only through short-lived secure links.
- Passwords are stored securely and are never visible to us.
Cookies and similar tools
- This website does not use advertising or tracking cookies. Its analytics are cookieless.
- The dashboard uses a secure login cookie to keep sellers signed in. Analytics tools may also use small cookies to understand how features are used.
- Online stores keep the shopping cart in the shopper's own browser.
How long we keep information
- Seller and store data is kept while the subscription is active.
- If a subscription lapses, the data is kept so the seller can come back.
- After a seller cancels, we keep their data for 90 days, and they can ask for a copy. After that, we delete it.
- Messages to us are kept as long as we need them to reply or to provide the service.
Your rights
You can ask us what information we hold about you, and ask us to correct or delete it, in line with Sri Lanka's Personal Data Protection Act, No. 9 of 2022. Shoppers should contact the store they bought from first. Sellers can contact us directly.
Children
CounterDesk is a service for businesses. It is not meant for children, and we do not knowingly collect children's information.
Changes to this policy
If we change this policy, we will update this page and the “Last updated” date. For important changes, we will also tell sellers directly.
Contact us
Questions about privacy? Email us at counterdesk.hq@gmail.com or message us on WhatsApp.