The data controller responsible for your personal data is Winsoftmax (Private) Limited), the operator of Bcozap.

For any privacy question, data-access request, correction, or deletion request, contact our privacy contact at [email protected], or contact the business that onboarded you and they will route the request to us.

Information you provide

• Phone number. Collected in E.164 international format and used to create and secure your account with a one-time verification code.
• Profile information. Details you choose to add — display name, business name, category, and a short "about" line.
• Message content and attachments. Text messages plus any media you send — photos, voice notes, video, and documents.

Information collected automatically

• Push-notification token. A device token (via Firebase Cloud Messaging) so we can deliver alerts about incoming messages.
• Device preferences. Theme, optional biometric app-lock, and read-aloud language are stored locally on your device only.

Information we do not collect. Bcozap does not use analytics, advertising, or cross-device tracking SDKs. We do not build an advertising profile, we do not sell your data, and we do not engage in profiling or automated decision-making about you.

We process each category of your personal data for a specific purpose and on a specific lawful basis, as required by the PDPA:

You may withdraw your consent for optional profile information at any time by editing or emptying those fields, or by deleting your account. Withdrawing consent does not affect processing carried out before the withdrawal.

The messages and attachments you exchange with a business are delivered to that business. Media is stored on our secure cloud object storage and associated with the conversation it belongs to. Bcozap does not read the content of your one-time verification codes — you enter them yourself. Message content is not logged for analytics or monitoring.

Bcozap connects you with verified businesses (we call them "tenants"). When you message a business — or fill a form they have shared with you inside a conversation — the content you provide is shared only with that specific business, and with no one else:

• What is shared. Your replies (text, photos, voice notes, video, documents) and any form you fill within that conversation are delivered to the business you are messaging.
• How it reaches the business. Messages appear in that business's Bcozap inbox, where the business can read and respond to them. (In the future, a business may be able to connect its own system to receive messages there as well; where that is available, it will be a secure connection the business has configured.)
• No third parties. Your message content and form responses are not shared with any advertising network, data broker, or other third party. They go to the business you are talking to — and to us solely to operate the Service.
• Scope is limited. A business receives only the data from the conversations it is a party to. It cannot see your conversations with other businesses.
• The business is responsible for its own use. Once your data is delivered to a business, that business is responsible for how it handles, stores, and uses that data within its own systems, in line with its own privacy practices and its obligations under the law. We encourage you to ask the business about its privacy practices.
• You are responsible for what you choose to share. When you reply to a business or fill a form it has shared with you, you direct that content to that business. Please share only what you intend that business to receive.
• Why we share it. Sharing your messages and form responses with the business is necessary to provide the conversation and services you requested from that business.

We engage the following categories of processor — service providers who process personal data on our behalf under contract, solely to operate the Service. They are bound to protect your data and may not use it for their own purposes:

We do not share your personal data with any other third party, and we do not sell it.

We retain your personal data only for as long as necessary:

• Verification codes (OTP): expire 5 minutes after issue. Used and expired codes are retained briefly as a security audit trail, then removed.
• Upload links: expire after 5 minutes (direct) or 24 hours (pending).
• Messages and media: retained while your account is active. After 30 days, older messages may be moved to cold storage while remaining associated with your account. Permanently erased when you delete your account.
• Your session: retained for up to 1,095 days (3 years) from sign-in, then expires.
• Audit-log entries: administrative records retained (rolled to cold storage after 365 days) for security and accountability.
• Resolved moderation and request records: retained for 90 days after resolution.
• Billing records and data required by law: retained for the period required by that obligation.

When you delete your account, your profile, conversations, messages, attachments, and uploads are permanently removed. Only the limited records required by law are retained.

Under the PDPA you have rights over your personal data. With Bcozap today you can:

• Access and be informed — this policy tells you what we collect and why.
• Rectify (correct) your information — edit your profile fields at any time in the app.
• Erase (delete) your account — from Settings. Permanently erases conversations, media, and uploads and releases your phone number. Cannot be undone.
• Withdraw consent — for optional profile information, by editing or emptying those fields or deleting your account.
• Object / lodge a complaint — with us (see Contact) or with the Sri Lanka Data Protection Authority.

Not yet available: an in-app data-export (portability) download is not provided in the current version. If you need a copy of your data, contact our privacy contact and we will provide it.

Authentication is by one-time code — there are no passwords. Your session is stored in the device's secure keystore (Android Keystore). All network traffic uses HTTPS/TLS encryption. Administrative actions are recorded in a tamper-evident audit log with restricted, role-based access. You may optionally enable biometric (fingerprint/face) app-lock — biometric data is processed by your device's native system and never leaves your device or is transmitted to us.

Bcozap is not directed to anyone under 16, and we do not knowingly collect personal information from children. If you believe a minor has registered an account, please contact us and we will delete it. An administrator can also suspend or permanently erase an account where a minor is identified.

Your personal data is processed on secure cloud infrastructure that does not have a presence inside Sri Lanka. This means your data is transferred to, and stored in, countries other than Sri Lanka — typically the nearest available cloud regions (for example, Singapore or India). We permit such transfers only where they are necessary to operate the Service and where the processor applies safeguards consistent with the PDPA's cross-border transfer requirements.

We may update this Privacy Policy from time to time. Material changes will be surfaced in the app and reflected in the "Last updated" date above.

For privacy questions or data requests, contact our privacy contact at [email protected], or contact the business that onboarded you.