Privacy Policy

Who we are

TeamCey is a multi-tenant HR and payroll platform for Sri Lankan businesses. Each company (a "workspace") is operated by its own HR administrators, who decide which employee data to store in TeamCey. For that data, the company is the data controller and TeamCey acts as a processor on the company's behalf.

This policy explains what we collect, why, and the choices you have. It is written with the requirements of the Sri Lanka Personal Data Protection Act, No. 9 of 2022 (PDPA) in mind.

Data we collect

• Account data — your name, work email, and password hash when you create an admin account or accept a portal invitation.
• Company data — legal name, address, business registration details, and EPF/ETF employer registration numbers entered by your HR admin.
• Employee records — details your employer stores to run HR and payroll: name, NIC, contact details, salary structure, attendance, leave, and payslips.
• Billing data — subscription status and invoices. Card details are collected and stored by Stripe, our payment processor; we never see your full card number.
• Support data — messages you send through our contact form or support channels.
• Technical data — logs required to keep the service secure and reliable, such as IP addresses and authentication events.

How we use data

• To provide the service: running payroll calculations, storing attendance, generating payslips and statutory exports.
• To operate accounts: authentication, password resets, portal invitations, and security notifications.
• To bill subscriptions through Stripe and send trial or billing reminder emails.
• To respond to support and sales enquiries.
• To keep the platform secure: fraud prevention, abuse detection, and audit logging.
• We do not sell personal data, and we do not use your workspace data for advertising.

Multi-tenant isolation

Every workspace is isolated at the database level with row-level security. Data belonging to one company is never visible to another company on the platform. Employees can only see their own records through the portal; HR administrators can only see records within their own workspace.

Processors we rely on

We share only the minimum data each processor needs to perform its function.

• Supabase — database hosting, authentication, and file storage (encrypted at rest).
• Stripe — subscription billing and payment processing.
• Our email delivery provider — transactional email such as invitations, password resets, and billing reminders.

Data retention

Workspace data is retained while your subscription is active. If your company deletes its workspace, the associated records are removed from production systems, with residual copies expiring from encrypted backups on a rolling schedule. Statutory payroll records may need to be retained by your employer under Sri Lankan law — export them before deleting a workspace.

Your rights

Depending on your relationship with us, you can request access to, correction of, or deletion of your personal data. Employees should direct requests about their HR records to their employer (the data controller); we support employers in fulfilling them. Account holders can contact us directly through the contact page and we will respond within a reasonable period.

Cookies

TeamCey uses only essential cookies: session cookies that keep you signed in to the dashboard or the employee portal, and security cookies that protect against request forgery. We do not use advertising or cross-site tracking cookies.

If we enable privacy-friendly product analytics in the future, it will be cookieless or clearly disclosed here first.

Changes and contact

If we make material changes to this policy, we will update this page and note the new revision date above. Questions about privacy? Reach us through the contact page and we'll be glad to help.