This policy explains how CognasisAI (Pvt) Ltd ("we", "us"), the company behind Sello, collects, uses, shares, and protects personal data. It applies to the Sello service, our dashboard, and this website. CognasisAI (Pvt) Ltd is a company incorporated in Sri Lanka with its registered address at 100, Dewala Road, Maharagama, Sri Lanka.
1. Our role
- Our customers' account data: for information about the businesses that use Sello and their team members, such as account, billing, and support details, we are the controller.
- Their customers' messages: when a business uses Sello to talk to its own customers ("End Users") on WhatsApp or website chat, the business is the controller of that End-User data. We process it on the business's behalf, following its instructions and our Terms. If you are an End User, please contact the business you were talking to about your data. We will help them respond.
2. What we collect
From businesses and their team members
- Account details: name, email address, business name, and login information. Optionally also business website, industry, size, use case, and how you heard about us.
- Billing details: billing country and region, plan, payment history, and receipts. Your full card number is handled by our payment processors (payments.lk or Paddle) and never reaches us. We keep only the card brand, last four digits, and expiry date.
- WhatsApp connection details: the credentials needed to connect your WhatsApp Business account. These are stored encrypted.
- Your content: documents, FAQs, and settings you upload to train your assistant.
- Usage and technical data: activity logs, usage counts, error reports, IP address, and browser information when you use the dashboard.
- Communications: messages you send to our support, sales, or billing teams.
About End Users (on behalf of our customers)
- WhatsApp phone number and profile name.
- The content of messages exchanged with the business's assistant or team, and any details the End User chooses to share in them, such as a name or email.
- For website chat: device type, browser, operating system, IP address, and approximate country.
3. How we use it
| Purpose | Legal basis |
|---|---|
| Providing the Service: running your assistant, answering End Users, and storing conversation history | Performance of our contract with you |
| Billing, payments, receipts, and payment-failure notices | Contract; legal obligations (tax and accounting) |
| Service emails such as setup, usage warnings, and security notices | Contract |
| Security, fraud prevention, abuse detection, and error monitoring | Legitimate interests in keeping the Service safe and reliable |
| Improving the Service using aggregated, de-identified usage statistics | Legitimate interests |
| Complying with law and responding to lawful requests | Legal obligation |
We do not sell personal data. We do not use your content or End-User conversations to train AI models offered to other customers.
4. AI processing
To generate a reply, Sello sends the End User's message to an AI model provider (currently Google's Gemini API). It also sends relevant parts of the business's uploaded content and recent conversation context. The provider processes this data only to return the reply, under its terms for business API customers. Replies are generated automatically.
5. Who we share it with
We share personal data only with the service providers that help us run Sello, under contracts that protect it, and with Paddle.com for international orders:
| Provider | What they do |
|---|---|
| Meta Platforms (WhatsApp Business Platform) | Delivers WhatsApp messages between businesses and End Users |
| Google (Gemini API) | AI model that generates replies |
| Supabase | Database, sign-in, and file storage |
| Qdrant | Search index for uploaded business content |
| Railway | Application hosting |
| Cloudflare | Website hosting, DNS, and security |
| Resend | Sending service emails |
| Sentry | Error monitoring |
| Tavily | Web search, only for businesses that turn on web search for their assistant |
| payments.lk | Card payments for Sri Lankan (LKR) customers |
| Paddle.com | Online reseller and Merchant of Record for international (USD) orders. Paddle handles the buyer's billing details as an independent controller, under its own privacy notice. |
| Google Fonts | Serves the fonts on this website; your browser's IP address is sent to Google when the fonts load |
We may also disclose data where the law requires it, to protect our rights or users' safety, or to a successor in a merger or acquisition (which would be bound by this policy).
6. International transfers
We are based in Sri Lanka. Our main database is hosted in South Korea, and some providers process data in other countries, including the United States and the European Union. When data is transferred abroad, we rely on our providers' contractual commitments and security measures to protect it. We do this in line with Sri Lanka's Personal Data Protection Act, No. 9 of 2022, and, where applicable, the UK and EU GDPR.
7. How long we keep it
- Conversations and audit logs: retained according to the business's plan (Starter 30 days, Pro 90 days, Enterprise as agreed).
- Account data and uploaded content: kept while the account is active. After the subscription ends, the business can ask for an export within 30 days; we then delete the data within a reasonable period.
- Receipts and payment history: kept for as long as tax law requires, typically seven years in Sri Lanka.
- Support emails: kept as long as needed to resolve the request and for a reasonable period afterwards.
8. Security
We protect personal data with encryption in transit (HTTPS/TLS) and at rest, encrypted storage of WhatsApp credentials, strict separation between customer accounts, access controls, and monitoring. No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
9. Your rights
Depending on where you live, you may have the right to:
- access, correct, or delete your personal data;
- restrict or object to its processing;
- receive a portable copy;
- withdraw consent where we rely on it.
To use these rights, email [email protected] with the subject "Privacy request". We will respond within one month.
You may also complain to a data protection authority, such as the Data Protection Authority of Sri Lanka, the UK Information Commissioner's Office, or your local EU supervisory authority. We'd appreciate the chance to resolve your concern first.
End Users should send requests to the business they were chatting with. If you contact us directly, we will pass your request to that business.
10. Cookies
This website does not use analytics, advertising, or tracking cookies. It remembers your light/dark display choice in your browser's local storage, and asks Cloudflare (which hosts the site) for your country so the pricing page can show prices in your currency; the result is kept in your browser for that session only. The Sello dashboard uses only strictly necessary cookies to keep you signed in and secure. The website chat widget may store a small identifier in the visitor's browser so that a conversation continues across pages.
11. Children
Sello is a business service and is not directed at children. We do not knowingly collect personal data from children for our own purposes.
12. Changes and contact
We may update this policy. We will post the new version here, and if the changes are significant we will tell customers by email.
Contact: CognasisAI (Pvt) Ltd, 100, Dewala Road, Maharagama, Sri Lanka · [email protected]