Privacy Policy
We are committed to protecting your privacy and handling your data with transparency and care — across both GemColony SaaS and the Hub marketplace.
Last updated: March 25, 2026
This Privacy Policy explains how GemColony ("we", "us", or "our") collects, uses, shares, and protects information about you when you use our gemstone ERP platform (app.gemcolony.com), the GemColony Hub marketplace (app.gemcolony.com/hub), and all related services (collectively, the "Service"). Payments across all GemColony platforms are processed by PayHere, our licensed payment gateway partner. By using GemColony, you agree to the collection and use of information in accordance with this policy.
1. Information We Collect
Information You Provide
When you register for GemColony or the GemColony Hub marketplace, we collect your name, email address, business name, phone number, billing address, and account credentials. You may also provide additional information such as gemstone inventory data, customer records, sales transactions, laboratory certificates, and other business data you input into the platform.
Payment Information
When you make a purchase through GemColony — including subscription fees, Hub marketplace transactions, and one-time add-ons — payments are processed by PayHere, our licensed payment service provider. GemColony does not store your full card number, CVV, or bank account details. We receive and store only transaction reference IDs, payment status, and masked payment method information (e.g., last 4 digits of a card) provided by PayHere for billing and reconciliation purposes.
Hub Marketplace Data
If you participate in the GemColony Hub marketplace as a buyer or seller, we collect additional information including your business registration details, gem listing data (photos, descriptions, grading information, certificates), transaction history, shipping addresses, and buyer/seller ratings and reviews.
Automatically Collected Information
We automatically collect certain technical information when you use our services, including your IP address, browser type, operating system, referring URLs, device identifiers, and usage data such as pages visited, features used, search queries, and time spent on the platform.
Cookies and Tracking
We use cookies and similar tracking technologies to enhance your experience, maintain your session, remember your preferences, and analyze platform usage. Please see our Cookie Policy for full details on how we use these technologies and how you can manage them.
2. How We Use Your Information
Service Delivery
We use your information to provide, maintain, and improve GemColony — including processing subscription payments via PayHere, facilitating Hub marketplace transactions, managing your account, generating invoices and receipts, providing customer support, and delivering the features you use.
Payment Processing
Your payment information is shared with PayHere solely for the purpose of processing transactions. PayHere processes payments in compliance with PCI-DSS standards. By making a payment on GemColony, you also agree to PayHere's privacy policy and terms of service. Transaction data is retained by GemColony for accounting, tax compliance, and dispute resolution purposes.
Hub Marketplace Operations
For Hub marketplace participants, we use your information to facilitate transactions between buyers and sellers, display listings to potential buyers, send order notifications and shipping updates, manage dispute resolution, calculate and disburse seller payouts, and maintain marketplace integrity through fraud detection.
Communications
We may send you service-related emails (account confirmations, security alerts, billing notices, payment receipts, order updates) and, with your consent, marketing communications about new features, updates, and promotions. You can opt out of marketing emails at any time via the unsubscribe link or your account notification settings.
Analytics & Improvement
We use aggregated and anonymized data to analyze usage patterns, diagnose technical problems, improve our platform features, and inform business decisions. This analysis never identifies individual users.
Legal Compliance & Fraud Prevention
We use transaction data and account information to detect and prevent fraudulent activity, unauthorized access, money laundering, and other illegal activities. We may share information with law enforcement or regulatory bodies when required by applicable law.
3. Data Sharing & Disclosure
We Do Not Sell Your Data
GemColony does not sell, rent, or trade your personal information or business data to third parties for their own marketing purposes.
PayHere (Payment Processor)
To process payments, we share necessary billing information (name, email, billing address, transaction amount) with PayHere, our payment gateway partner. PayHere is a licensed payment service provider regulated in Sri Lanka and complies with applicable financial regulations and PCI-DSS standards. PayHere's handling of your payment data is governed by their own privacy policy.
Hub Marketplace Participants
When you complete a transaction on the Hub marketplace, necessary information is shared between buyer and seller to fulfill the order (e.g., shipping address shared with seller, seller business name and contact shared with buyer). This sharing is limited to what is necessary to complete the specific transaction.
Service Providers
We share information with trusted third-party vendors who help us operate the platform, including cloud hosting providers, email delivery services, customer support tools, and analytics platforms. These providers are contractually bound to protect your data and may only use it to perform services on our behalf.
Legal Requirements
We may disclose information if required by law, court order, regulatory authority, or tax authority, or if we believe disclosure is necessary to protect the safety, rights, or property of GemColony, our users, or the public.
Business Transfers
In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email or prominent in-app notice before your personal data is transferred and becomes subject to a different privacy policy.
4. Data Security
Security Measures
We implement industry-standard security measures including TLS 1.2+ encryption in transit, AES-256 encryption at rest, multi-tenant data isolation, regular security audits and penetration testing, role-based access controls, and two-factor authentication support to protect your information.
Payment Security
All payment transactions are processed through PayHere's PCI-DSS compliant infrastructure. GemColony never transmits raw card data through its own servers. Payment pages use HTTPS with extended validation certificates and are hosted on PayHere's secure environment.
Breach Notification
In the event of a data breach that affects your personal information, we will notify you and relevant authorities in accordance with applicable law within 72 hours of becoming aware of the breach. We will provide information on what data was affected and the steps we are taking to mitigate harm.
5. Data Retention
Account & Business Data
We retain your account and business data for the duration of your active subscription plus 90 days after cancellation, allowing you to export your data. After this period, data is permanently deleted from our systems.
Financial & Transaction Records
Payment transaction records, invoices, and financial data are retained for a minimum of 7 years to comply with Sri Lankan tax laws and financial regulations. This retention period applies regardless of account cancellation.
Hub Marketplace Records
Hub marketplace transaction records, including buyer/seller information for completed transactions, are retained for 7 years for legal and tax compliance purposes. Dispute records are retained for 3 years after resolution.
Aggregated Data
Aggregated, anonymized data may be retained indefinitely for analytical and business intelligence purposes.
6. Your Rights
Access & Portability
You have the right to access your personal data and export your business data in a machine-readable format (CSV/JSON) at any time through your account settings or by contacting us at [email protected].
Correction & Deletion
You may update or correct your personal information at any time through your account settings. You may request deletion of your account and associated personal data by contacting [email protected]. We will process deletion requests within 30 days, subject to legal retention requirements for financial records.
Opt-Out of Marketing
You may opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email or by updating your notification preferences in account settings. You cannot opt out of essential service communications (billing, security alerts, transaction confirmations).
GDPR Rights
If you are located in the European Economic Area, you have additional rights under GDPR, including the right to object to processing, restrict processing, and lodge complaints with your local supervisory authority. Contact our Data Protection Officer at [email protected] to exercise these rights.
7. Cookies & Tracking Technologies
Essential Cookies
We use essential cookies that are strictly necessary for the platform to function, including session management, authentication tokens, and security features. These cannot be disabled.
Analytics Cookies
With your consent, we use analytics cookies to understand how users interact with our platform, which features are most used, and where users encounter difficulties. This data is aggregated and anonymized.
Payment Cookies
PayHere may set cookies on payment pages to facilitate secure payment processing, detect fraud, and maintain the payment session. These cookies are governed by PayHere's cookie policy.
Managing Cookies
You can control non-essential cookies through your browser settings or our cookie consent manager. Disabling certain cookies may impact platform functionality. For full details, see our Cookie Policy at gemcolony.com/cookies.
8. International Data Transfers
Cross-Border Transfers
GemColony operates globally. Your data may be transferred to and processed in countries other than your own, including countries where our cloud infrastructure and service providers are located. We ensure such transfers comply with applicable law through Standard Contractual Clauses or other approved transfer mechanisms.
9. Children's Privacy
Age Restriction
GemColony is a business platform not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a minor has provided us with personal information, we will delete it promptly. If you believe a minor has registered, please contact us at [email protected].
10. Third-Party Links
External Sites
Our platform may contain links to third-party websites or services. This Privacy Policy does not apply to those external sites. We encourage you to review the privacy policies of any third-party sites you visit. We are not responsible for the privacy practices or content of third-party sites.
11. Changes to This Policy
Policy Updates
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. We will notify you of material changes via email or a prominent notice on our platform at least 30 days before changes take effect. Continued use of GemColony after changes become effective constitutes your acceptance of the revised policy.
12. Contact Us
Privacy Inquiries
For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at: Email: [email protected] | General: [email protected] | Address: GemColony, Colombo, Sri Lanka. We aim to respond to all privacy inquiries within 5 business days.