Privacy Policy
How Mudcrafts (Pvt) Ltd collects, uses and protects personal information when you visit our website or use Entirova.
Who we are
Entirova is provided by Mudcrafts (Pvt) Ltd, a company registered in Sri Lanka (“we”, “us”). This policy follows the Personal Data Protection Act No. 9 of 2022 of Sri Lanka, and we apply the same standards to visitors and customers in other countries, including those covered by the EU and UK GDPR.
Our two roles
- Controller for your account details, our website and our own customer records. This policy covers that information.
- Processor for the business records your organisation keeps in Entirova: your customers, suppliers, employees, payroll and transactions. Your organisation decides what goes in and why, and we handle it only on its instructions, as set out in the data processing terms in our Terms of Service. If you are, for example, an employee or customer of a business that uses Entirova, please contact that business first.
What we collect
| Information | Examples | Why |
|---|---|---|
| Account details | Name, work email, password (stored only as a one-way hash by our sign-in provider), two-factor settings | To create your account and sign you in securely |
| Organisation details | Organisation name, plan, members and their roles | To run the service and control who can see what |
| Business records | Contacts, invoices, bills, bank lines, employees, payslips, bank and tax numbers you enter | To provide Entirova to your organisation (we act as processor) |
| Sign-in records | Email, time, success or failure, IP address, approximate location (country, region, city) and browser | To block password guessing, lock accounts after repeated failures and show you recent sign-ins |
| Activity and error logs | Who changed what and when; technical errors with the page and browser they happened in | To keep an audit trail for your organisation and to find and fix problems |
| Messages to us | What you send through the contact form or by email | To reply and give support |
| Website comments | Comments you post on blog articles, handled by Disqus | Only if you accept comment cookies; see our Cookie Policy |
We do not use advertising trackers or analytics on our website, and we never sell personal information.
Why we are allowed to use it
- Contract: to provide the service you or your organisation signed up for.
- Legitimate interests: to keep Entirova secure, prevent fraud and abuse, and improve the service.
- Consent: for optional cookies such as blog comments. You can withdraw it at any time.
- Legal obligation: where the law requires us to keep or share information.
Who we share it with
We use a small number of service providers who process information for us under contract:
| Provider | What they do | Location |
|---|---|---|
| Supabase | Database, sign-in and sign-in emails | [hosting region] |
| Cloudflare | Hosting our website and app, network protection, and the human check on sign-in when it is on | Global network |
| Google Fonts and cdnjs | Delivering fonts and code libraries to your browser (they see your IP address) | Global network |
| Disqus | Blog comments, only after you accept comment cookies | United States |
| YouTube | Our product video, only when you press play | United States |
When you use the app, your browser fetches currency exchange rates from open.er-api.com and country flags from flagcdn.com. No account or business information is sent, only the request itself.
We may also share information if the law requires it, to protect our rights or users’ safety, or with a buyer if our business is sold, who must then keep to this policy.
International transfers
Some providers process information outside Sri Lanka. Where they do, we rely on their contractual commitments and recognised safeguards (such as standard contractual clauses) so that it stays protected to the standard in this policy.
How long we keep it
- Account details: while your account exists. When you delete your account, your login and sign-in records are deleted straight away. Your name stays on past entries in the activity logs of organisations that carry on, because those are their accounting records.
- Business records: while your organisation uses Entirova. When an owner deletes the organisation, its records are deleted from our live database straight away and drop out of backups as those expire.
- Sign-in records: 90 days.
- Error logs: 90 days.
- Activity log: as long as the organisation exists, because it forms part of your accounting records.
- Support messages: up to 2 years after the conversation ends.
Your organisation may have its own legal duty to keep accounting and payroll records for a number of years. Download a backup before you delete anything you still need.
How we protect it
Data is encrypted in transit and at rest, each organisation’s records are kept apart by the database itself, and every save is checked on our servers against your role. Two-factor sign-in, lockout after failed attempts and a full audit trail add further protection. Read more on our Security page.
Referrals
If you create your organisation through another organisation's referral link, that organisation can see your organisation's name, when it signed up and whether it became a paying customer, so its rewards can be worked out. It never sees anything inside your Entirova. If you refer others, we keep the referral records and rewards for as long as your organisation exists.
Your rights
You can ask us to:
- give you a copy of your personal information;
- correct information that is wrong;
- delete your information, or stop or limit how we use it;
- give you your information in a format you can take elsewhere;
- withdraw consent you gave, without affecting what we did before.
You can delete your account yourself at any time in Entirova under My account › Leave or delete. For anything else, email privacy@mudcrafts.com. We reply within 21 working days and may ask you to confirm who you are. For business records in Entirova, we will pass your request to the organisation that controls them. You can also complain to the Data Protection Authority of Sri Lanka, or to the authority where you live.
Children
Entirova is a business service and is not meant for anyone under 18. We do not knowingly collect information from children.
Changes to this policy
When we make important changes we will update the date at the top and tell account owners by email or in the app before they take effect.
Questions about this policy? Email privacy@mudcrafts.com.