Privacy Policy
Last updated: 22 September 2026
This policy describes how the Ran Core mobile app and Buntalk ERP at erp.buntalk.lk handle personal information. Ran Core is published by Cyntrek Solutions Private Limited and connects authorised users to their organisation's ERP workspace.
Request account or data deletionInformation we handle
- Account information: name, email address, user identifier, account status, business memberships, roles and permissions. Passwords and, when enabled, two-factor authentication codes are used to verify your identity. Server passwords are stored as hashes.
- Business and supplier records: organisation details, supplier and contact names, email addresses, phone and WhatsApp numbers, postal addresses, tax and registration numbers, payment terms, credit limits, bank and account details, and notes that authorised users enter.
- Session and technical information: an access token, selected business, device name or model, and operational information such as IP address, request time and errors used to deliver and protect the service.
- Support information: your contact details and information you choose to provide when asking us for help.
How we use information
We use this information to sign you in, enforce access permissions, display and maintain business records, support your organisation's workflows, deliver account-related emails, respond to support requests, and investigate errors or misuse. The current app does not include advertising or advertising-tracking SDKs. We do not sell personal information or use it for targeted advertising.
Who can access information
Your organisation's authorised users and platform administrators can access records according to their roles. Administrators may link or copy supplier records between businesses when their permissions allow it. Your organisation determines the business information it enters and who should have access. Only enter information you are authorised to manage.
Service providers and external links
Hosting and backup providers process information to operate the service. Cloudflare processes network traffic for delivery and security, and Resend processes recipient details and email content for account-related email delivery. These providers may process information outside your country.
If you choose a WhatsApp, phone, email or maps action, the relevant number, address or message is passed to the app or service you open. Those services handle information under their own privacy policies. Ran Core does not read your device contacts or collect your device's GPS location for these actions. Information may also be disclosed where required by law or necessary to protect the service and its users.
Storage and security
Production connections use HTTPS. On supported mobile devices, the app stores its access token and selected business using the operating system's secure storage. The web app uses session cookies and browser storage for sign-in and preferences. Access controls, password hashing and optional two-factor authentication help protect accounts. No system can guarantee absolute security; protect your device and do not share your login details.
Retention and deletion
Account and business records are kept while needed to provide the service to your organisation and meet operational, accounting, security or legal needs. Retention depends on the type of record and your organisation's requirements. Signing out or uninstalling the app does not delete server records. Deleted information may remain in backups until those backups are replaced or expire.
To request access, correction, account deletion or deletion of personal information, contact your organisation's administrator or email [email protected]. Include your account email, organisation and the request, but never send your password or two-factor codes. We may verify your identity and coordinate with your organisation. If some records must be retained, we will explain the reason when responding.
Children
Ran Core is a business tool intended for authorised workplace users, not a service directed to children. If you believe a child has provided personal information inappropriately, contact us so we can investigate and address it.
Changes and contact
We will update this page when our data practices change and revise the date above. For privacy questions, data requests or support, email [email protected].