Effective date: October 18, 2026
1. Two roles: Controller and Processor
Sentrixio handles personal data in two distinct capacities:
- For the records your organisation stores in Sentrixio (such as personnel, assigned equipment, certifications, maintenance logs, and audit logs), your organisation determines the purpose and lawful basis. We act strictly as a data processor on your behalf under our Terms of Service.
- For account registration, billing administration, technical telemetry, and contact inquiries, Sentrixio acts as a data controller. This policy explains our handling of that data.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account | Email address, encrypted password hash, name (if Google sign-in is used) | Provided by you |
| Organisation Records | Asset tags, serial numbers, equipment owners, expiry dates, maintenance history | Your users |
| Audit Log | Record changes, timestamps, actor identity, and connecting IP address | Recorded automatically |
| Billing | Plan tier, seat quantity, subscription status. Payment cards are processed directly by Stripe | Stripe |
| Inquiries | Name, email, message submitted via the contact form | Contact form |
| Analytics | Aggregated marketing page views, loaded only after explicit consent | Google Analytics |
3. Why we use it
- Providing the service: Authenticating users, storing compliance records, and dispatching expiry alerts.
- Security and auditability: Maintaining append-only audit trails, preventing unauthorized cross-tenant access, and enforcing rate limits.
- Billing: Managing subscription status and processing payments through Stripe.
- Responding to inquiries: Replying to technical and commercial questions submitted to our team.
- Site analytics: Measuring public website reach (only with visitor consent).
4. Sub-processors and infrastructure
We partner with established infrastructure providers to deliver Sentrixio:
| Provider | Role | Location |
|---|---|---|
| Supabase | PostgreSQL database and authentication | Seoul, South Korea |
| Render | Backend API and scheduled background workers | Oregon, USA |
| Vercel | Frontend application hosting and edge delivery | Washington, D.C., USA |
| Stripe | Payment processing and billing portal | USA / Global |
| Resend | Transactional and notification email dispatch | USA |
5. Data retention and deletion
- Active records: Maintained for the duration of your organisation’s subscription.
- After organisation closure: A 30-day grace period is provided to export records, followed by irreversible deletion from active databases.
- Audit log: Preserved during the organisation lifecycle to fulfill compliance tracking requirements.
- Financial transaction history: Kept as required by applicable commercial accounting laws.
6. Security controls
- Multi-tenant isolation: Every request is strictly authenticated and scoped by organisation identifier. Automated integration tests continuously verify cross-tenant boundaries.
- Database protection: Row Level Security (RLS) is enabled across database tables as defence-in-depth.
- Append-only audit trail: Critical entity changes record actor, timestamp, IP address, and previous/updated states without update or delete capabilities.
- Credential encryption: Passwords use salted cryptographic hashes; API keys are hashed with SHA-256 at rest; webhook secrets are encrypted.
- Transport security: All traffic requires TLS / HTTPS encryption.
7. Your rights
Subject to applicable law, including Sri Lanka’s Personal Data Protection Act No. 9 of 2022, you have rights to access, rectify, export, or request deletion of your personal data. You may withdraw analytics consent at any time via cookie settings.
To exercise these rights or make privacy inquiries, contact us at hello@sentrixio.com.
8. Cookies and browser storage
sb-*-auth-token: Secure session authentication cookie.sentrixio_consent: Stores your preference regarding marketing analytics cookies._ga,_ga_*: Google Analytics cookies, loaded strictly after explicit acceptance.localStorage: Retains interface preferences such as navigation drawer state.
9. Contact
For any questions regarding this Privacy Policy or data protection, please reach out to hello@sentrixio.com.