Legal

Privacy Policy

Last updated: 26 June 2026

This policy explains what personal information kodo collects, how we use and share it, and the choices you have. It covers both the sellers who use kodo and the customers who buy from kodo stores.

1Who we are

kodo is a commerce platform that helps sellers in Sri Lanka turn their Instagram and WhatsApp conversations into a real online store — managing products, orders, deliveries and payments in one place.

kodo is owned and operated by Tensho Labs LLC, a limited liability company registered in the State of Wyoming, United States, with a mailing address at 1441 Woodmont Ln NW #2118, Atlanta, GA 30318, USA ("kodo", "we", "us" or "our"). For any privacy question, contact us at dev@tensholabs.com.

2How kodo works (our two roles)

kodo is a multi-tenant platform, so the same information can involve us in two different ways:

As a controller — for sellers: When a seller signs up for and uses kodo, we decide how their account information is handled. For that data, kodo is the data controller.
As a processor — for a seller's customers: When a customer places an order or sends a message to a seller's store, that information belongs to the seller's business. The seller is the controller of their customers' data, and kodo acts as a processor that stores and handles it on the seller's behalf, under the seller's instructions.

If you are a customer of a kodo store and want to know how a particular seller uses your information, please contact that seller directly. We will help where we can.

3Information we collect

Information sellers give us

Account and contact details (name, email address, phone and WhatsApp number), business details (store name, category, location, description), store configuration, the bank or payment details a seller chooses to display to their buyers, and — where a seller completes identity verification — identity information such as a national identity card number, which we store in encrypted form.

Information about a seller's customers (collected on the seller's behalf)

Customer name and contact details, delivery address, order contents and history, payment confirmation slips or screenshots uploaded at checkout, and messages exchanged through connected channels.

Information from connected channels

When a seller connects a WhatsApp or Instagram account, we receive the messages customers send to that account, the sender's profile name and identifier (phone number or Instagram handle), any media shared, and basic message metadata such as timestamps. See section 6.

Information we collect automatically

When you use kodo we collect technical and usage data — for example IP address, device and browser type, pages viewed and actions taken — through cookies and similar technologies. See our Cookie Policy.

4How we use information

We use personal information to:

provide, operate and maintain the kodo platform and a seller's storefront;
create and manage accounts and authenticate logins;
process and track orders, deliveries and payment confirmations;
route deliveries to courier partners a seller chooses to use;
send transactional messages such as order confirmations and account emails;
power assistant features that read and organise messages and orders (see section 5);
detect, prevent and investigate fraud, abuse and security incidents — for example checking payment slips for duplicates;
provide support and respond to requests;
understand and improve how the platform performs; and
comply with legal obligations.

We do not sell personal information, and we do not use the content of customers' messages for advertising.

5AI and automated processing

kodo uses automated and AI-assisted features to help sellers run their shop. These may read incoming messages to draft replies, extract order details (such as items, quantities and addresses) from conversations, and read uploaded payment slips to identify the amount and reference. These features assist the seller; a seller reviews and confirms important actions such as accepting an order or verifying a payment. Sellers can adjust how much automation they use in their kodo settings.

6WhatsApp, Instagram & Meta data

When a seller connects their WhatsApp Business or Instagram account, kodo accesses information through Meta's APIs solely to deliver the messaging and commerce features the seller has asked for — showing their conversations inside kodo, helping turn them into orders, and letting the seller reply. We use this information only to provide those features to that seller.

Our access to and use of information received from Meta's platforms complies with the Meta Platform Terms and Developer Policies, and with the WhatsApp Business and Instagram terms. We do not share this information with unrelated third parties, and we do not use it for advertising or to build profiles. You can ask us to delete data obtained through these channels at any time — see Data Deletion.

We share personal information only as needed to run the service, and with providers who are bound to protect it:

Messaging platforms: Meta (WhatsApp and Instagram) to send and receive messages on a connected account.
Delivery partners: Courier services a seller chooses to use (for example Koombiyo) receive the delivery details needed to ship an order.
Email delivery: Our transactional email provider sends order and account emails.
Infrastructure: Cloud hosting and storage providers that run the platform and store files such as images and slips.
Payments: Cash on delivery and bank transfers happen directly between a customer and the seller; kodo does not collect those payments. If online payment options are added in future, the relevant provider will be disclosed at that time.
Legal and safety: Authorities or advisors where we are required by law, or to protect our rights, users or the public.
Business transfers: If kodo is involved in a merger, acquisition or sale of assets, information may transfer as part of that transaction.

8International data transfers

kodo is operated by a US company and uses service providers that may store or process information in countries other than Sri Lanka. Wherever information is processed, we take steps to protect it consistent with this policy.

9How long we keep information

We keep personal information for as long as an account is active and as needed to provide the service. After an account is closed, or after a valid deletion request, we delete or anonymise personal information within a reasonable period (generally within 30 days), except where we must keep certain records — such as transaction and tax records — for longer to meet legal obligations. Residual copies in encrypted backups are removed within 90 days.

10How we protect information

We use technical and organisational measures to protect personal information, including encryption in transit, encryption at rest for sensitive fields such as identity numbers, strict access controls, and isolation that keeps each store's data separate from every other store's. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly if something goes wrong.

11Your choices and rights

Subject to applicable law, you may ask to access, correct, update or delete your personal information, object to or restrict certain processing, or withdraw consent you have given. Sellers can manage much of their information directly in their kodo settings. To make a request, email dev@tensholabs.com.

If you are in Sri Lanka, you may have rights under the Personal Data Protection Act, No. 9 of 2022. If you are a customer of a kodo store, the seller is the controller of your data; you can contact the seller, or contact us and we will assist or pass the request to the seller.

12Deleting your data

You can ask us to delete your information at any time. We have a dedicated page that explains exactly how, for both sellers and customers, including data received through WhatsApp and Instagram: see Data Deletion.

13Children

kodo is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we will delete it.

14Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, take reasonable steps to notify sellers. Continued use of kodo after an update means you accept the revised policy.

15Contact us

Questions about this policy or your information? Email dev@tensholabs.com, or write to Tensho Labs LLC, 1441 Woodmont Ln NW #2118, Atlanta, GA 30318, USA.