Privacy Policy

Last updated: 7 October 2026

This policy explains how Nveloop handles personal information on our website and in our products, including Nveloop POS and the Nveloop GemHub marketplace. It is written to meet the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka and, for people in the European Union, the United Kingdom and other places with similar laws, the data protection laws that apply there.

1. Who we are

Nveloop develops and supplies software for the gem and jewellery industry, the Nveloop GemHub marketplace and Nveloop POS. Our registered office is at 467/1 L1, Galle Road, Kalutara South 12000, Sri Lanka, and we have a further office at 2310 North Henderson Avenue, Dallas, TX 75206, USA. For any privacy matter, including anything for our data protection officer, write to info@nveloop.com.

2. When we are the controller, and when your business is

Nveloop is the controller — the organisation that decides how and why information is used — for: visitors to our website and people who contact us; our customers’ account, billing and support records; the accounts of Buyers and Suppliers on GemHub and the running of the marketplace; and the security and usage logs of our Services.

Our customer is the controller, and Nveloop is its processor, for the information a business records about its own customers, patients, staff and suppliers inside Nveloop POS, the Gem Merchant System, Gem ERP, the Gem Lab Management System or a website we host for it. We handle that information only on the business’s instructions and under our Terms & Conditions. If you are, for example, a shopper, diner, patient or client of a business that uses our software, please contact that business about your information; if you contact us, we will pass your request to it and help it respond.

3. Website visitors and enquiries

What you give us. When you use our contact form, request a demo, or contact us by email, phone or WhatsApp, we collect your name, company, email address, telephone number, country, business type, the products you are interested in and anything you tell us in your message, together with your agreement to this policy.

What is collected automatically. Our hosting provider records standard server logs, such as IP address, browser type, the page requested and the time, to deliver the site and protect it from abuse. nveloop.com does not currently use analytics, advertising or social-media tracking cookies. If we add them, we will update this policy and ask for your consent where the law requires it.

4. Our customers and their users

When a business subscribes to a Nveloop product we collect the business’s name, address, tax registration details and billing contacts; the quotations, invoices and payment records for our fees; and support conversations. We do not collect or store full card numbers for our own billing: payments to us are made through banks or payment providers, which handle card and bank details under their own terms.

For each person who uses our products on the customer’s behalf we hold a name, work email or user name, role and permissions, the branches or locations they can access, and a one-way hash of their password. Our products also keep security and audit records — sign-ins, IP address, device and browser, approvals and important changes — so that the business and Nveloop can investigate problems and misuse.

5. Nveloop POS

A business using Nveloop POS decides what to record. Depending on its settings and business type, this can include:

End customers: name, mobile number, email, address, tax identification number for business buyers, loyalty tier and points, gift cards, credit balance and purchase history;
Sales and payments: items, prices, taxes, invoices, receipts, refunds and the payment method, amount and any reference the cashier enters. Nveloop POS records payments but does not process them, and it has no field for card numbers;
Pharmacy sales of prescription-only medicines: the patient’s name, the doctor’s name and Sri Lanka Medical Council registration number, and the prescription date and number;
Staff: names, roles, shifts, cash-drawer counts, approvals, supervisor PINs and access cards — access-card numbers are stored only as a keyed hash; and
Devices: when a register works offline, sales are held in the browser’s storage on that device until they synchronise. Cached register pages are cleared when a user signs out.

End-of-day reports can be emailed to the owners and staff the business chooses. The business is the controller of all of this information (see section 2), and Nveloop processes it only to provide the service.

6. Nveloop GemHub

Buyers. When you sign in we collect your WhatsApp number, which we use to send a one-time sign-in code. If you choose to sign in with Google or Apple, we receive the account identifier, name and email address that provider shares with us. You may add your name, company, email, delivery address and buying preferences to your profile. We also hold your wishlist, orders, access requests to private stock and the messages and notifications we send you.

Suppliers. We collect the company’s legal and trading details, registration, licence and tax numbers, addresses, contact people, website and social links, trade terms, and verification documents such as a trade licence, tax certificate, company registration and identity document, together with the details of the supplier’s staff users. Company details that appear on a supplier’s storefront are visible to Buyers.

How the marketplace is used. GemHub records actions such as stones seen in results, stones viewed, searches and filters used, wishlist saves, items added to an order, enquiries, orders, the type of device and the page a visit came from. These are linked to a pseudonymous visitor identifier held in a first-party cookie, or to your Buyer account when you are signed in. We do not store your IP address for this purpose, only a keyed, non-reversible hash of it, and we derive country from your profile or from our content-delivery network. Suppliers see this information only as totals and trends, never who you are. The Nveloop trade desk can see the engagement of signed-in Buyers so that it can help them source stones. Analytics records are deleted after two years.

Orders and messages. When you submit an order or an access request, the details needed to deal with it — your name, company, contact details, delivery details and the stones concerned — are shared with the Supplier or Suppliers involved. Each Supplier is then responsible for how it uses that information for its own sale. We keep records of the WhatsApp messages and emails GemHub sends, including delivery status, to operate and troubleshoot notifications.

7. Sensitive information

Prescription details recorded in Nveloop POS are health information. Identity documents and tax numbers uploaded by GemHub Suppliers are also sensitive. We use this information only to provide the relevant service — prescription details on the pharmacy’s instructions, and supplier documents to verify suppliers — restrict who can see it inside our products and within Nveloop, and never use it for marketing, profiling or any other purpose. A business that records health information in our software is responsible for having a lawful basis to do so and for telling the people concerned.

8. Why we use information, and our legal bases

To provide the Services you or your business signed up for, including sign-in, support, training, backups and fault fixing — because it is necessary for our contract with you or your business.
To run GemHub: showing listings, passing orders and access requests to Suppliers, verifying Suppliers, moderating content and measuring how the marketplace is used — for our contract with Buyers and Suppliers and our legitimate interest in a trustworthy, useful marketplace.
To keep the Services secure, prevent fraud and misuse, and keep audit records — our legitimate interest, and that of our customers.
To invoice and keep accounts, and to meet tax, legal and regulatory duties — legal obligation.
To reply to enquiries and arrange demos — your request, and our legitimate interest in responding.
To improve our products using usage information and support history — our legitimate interest. Where possible we use aggregated information for this.
To send product news and offers — only with your consent, which you can withdraw at any time.

We do not make decisions that produce legal or similarly significant effects about anyone based solely on automated processing.

We do not sell personal information, and we do not share it for advertising. We share it only with:

Service providers who help us run the Services — cloud hosting and content delivery, email delivery, WhatsApp messaging through Meta, sign-in through Google and Apple, and banks and payment providers for our own billing. They may use the information only to provide their service to us and must protect it.
Other GemHub users, as described in section 6: order and access-request details go to the Suppliers involved, and Supplier storefront details are shown to Buyers.
The business that controls the data, where we process information on a customer’s behalf.
Authorities, courts and advisers, where the law requires it, to establish or defend legal claims, or to protect the safety and rights of people and of Nveloop.
A successor business, if all or part of Nveloop is reorganised, merged or sold, under the same protections.

10. International transfers

We operate from Sri Lanka and the United States, GemHub serves buyers and suppliers worldwide, and our service providers may store or access information in other countries. When information moves across borders we use the safeguards the law requires, such as transferring it only to countries or recipients permitted under the Personal Data Protection Act of Sri Lanka and using standard contractual clauses or equivalent contractual protections where data protection laws in the European Union, the United Kingdom or elsewhere require them.

11. How long we keep it

Enquiries that do not lead to a customer relationship: up to two years after our last contact.
Customer account, contract and billing records: for the relationship and then for as long as tax, accounting and limitation laws require.
Data held in our products for a business: while the subscription is active, as the business directs. When the Services end, the business may request an export within 30 days; we then delete it from live systems, and it is removed from backups as they are routinely overwritten. Businesses should export the records they must keep, such as tax invoices, before then.
GemHub accounts: while the account is open. Order records are kept for as long as needed for the transaction, disputes and legal requirements. Supplier verification documents are kept while the Supplier is active and afterwards only as long as needed for legal, compliance or dispute purposes.
GemHub usage analytics: deleted after two years.
Security, audit and messaging logs: for as long as needed to protect the Services and investigate problems, then deleted or anonymised.

12. Your rights

Depending on where you live, you have the right to: be told how your information is used; get a copy of it; have it corrected or completed; have it deleted; object to, or ask us to restrict, how we use it; receive it in a portable format; withdraw any consent you have given; and ask for a review of a decision made solely by automated means. You will not be treated less favourably for exercising your rights.

To use these rights, write to info@nveloop.com. We may need to confirm your identity first, and we will reply within the time the law allows. If your information is held in our software by a business you deal with, we will refer your request to that business and help it respond.

13. Cookies and device storage

nveloop.com uses only what is strictly necessary for the website to work and for our contact form to be protected from spam.

GemHub uses a session cookie to keep you signed in, where used, security cookies that protect forms, a first-party analytics cookie that holds a pseudonymous visitor identifier for up to one year (see section 6), and your browser’s local storage to remember your chosen currency, your order basket and similar preferences.

Nveloop POS uses a session cookie, a cached copy of the register so that it opens offline, and browser storage for sales waiting to synchronise.

You can delete cookies and site data in your browser settings, but some features will then stop working, and clearing data on a POS register with unsynchronised sales will lose those sales.

14. Security

We protect information with encryption in transit (HTTPS), passwords stored only as one-way hashes, keyed hashes for access cards and for IP addresses used in GemHub analytics, encryption of stored connection credentials, permissions enforced on our servers for every page and request, separation of each customer’s and each Supplier’s data, sign-in rate limits and account lockout, two-step sign-in for the Nveloop POS Console used by our staff, audit logs and regular backups. Only Nveloop staff who need access for support or operations have it.

No system is perfectly secure. If a personal data breach is likely to affect you, we will notify the affected customers, individuals and authorities as the law requires and without undue delay.

15. Messages and marketing

We send service messages — sign-in codes, order and account updates, invoices, security notices and end-of-day reports you have set up — because they are needed to provide the Services. We send product news and offers only if you have agreed to receive them, and every marketing email tells you how to unsubscribe. On WhatsApp you can reply STOP to opt out of business-initiated messages and START to opt back in.

16. Children

Our Services are business software and a trade marketplace, and they are not directed at children. We do not knowingly collect information from anyone under 18 for our own purposes. Information about minors recorded by a business in our software, such as a patient’s prescription, is the responsibility of that business as controller.

17. Changes to this policy

We may update this policy as our products and the law change. The date at the top shows the latest version, and we will notify customers and GemHub users directly of material changes before they take effect.

18. Contact and complaints

Questions, requests and complaints about privacy can be sent to info@nveloop.com, or by post to Nveloop, 467/1 L1, Galle Road, Kalutara South 12000, Sri Lanka, marked for the attention of the data protection officer. We will try to resolve any concern directly. You also have the right to complain to the Data Protection Authority of Sri Lanka or to the data protection authority where you live or work.