Privacy policy

EquityLK operates the website at equitylk.lk and is the controller of the personal data described on this page. We are an independent platform and are not affiliated with, endorsed by, or authorised by the Colombo Stock Exchange.

For any question about this policy, or to make any of the requests described under your rights, write to support@equitylk.lk.

• Account information. Your email address, the display name you choose, how you sign in, and when your account was created and last used.
• What you record. The transactions, portfolios and watchlists you enter, and anything you paste into the import tool. These are the holdings you choose to record, not data read from a broker or depository account.
• Your settings. Notification preferences and the alerts and prompts you have dismissed.
• Research requests. The text of any research report you ask us to generate, and the company it concerns.
• Technical information. Standard device and usage data, including your IP address, your browser and the pages you request. We use it to keep the service secure and to apply daily limits fairly.

• We run no advertising trackers. There is no advertising pixel, no remarketing tag and no cross-site advertising profile built from your visit.
• We do not sell, rent or trade your personal data, and we never will.
• We never ask for your CDS account credentials, your broker login or your bank details, and you should never give them to us or to anyone claiming to be us.
• What is in your portfolio is visible only to you. Nothing you record is published, shared or shown to another user.

To sign you in and keep you signed in; to show you your own portfolio, watchlists and notifications; to generate the research reports you ask for; to send you the transactional email the service depends on, such as verification and password reset; to apply daily limits fairly on a free service; and to keep the platform secure and working.

We do not use your holdings to make decisions about you, and no automated process produces a legal or similarly significant effect on you.

We use a session cookie that keeps you signed in. It is essential to the service: without it you would be signed out on every page.

We also use Google Analytics to understand how the site is used, which pages people read and where the product is confusing. It sets its own cookies and records the pages you visit and how you move through them, roughly where in the world you are, and what kind of device and browser you use. We use it to improve the product, not to identify you: we do not send it your name, your email address or anything about your portfolio. We set no advertising cookies.

Your browser also keeps some of your own preferences on your device rather than on our servers. That information stays on your device, and clearing your browser storage removes it.

We use a small number of providers to run the service: an authentication provider that handles sign-in and password security, hosting and email providers that run the application and send transactional mail, an AI provider that generates the research reports, and Google Analytics for usage measurement. Each sees only what it needs for that purpose, and none of them is permitted to use your data for its own.

Because these providers operate outside Sri Lanka, running the service involves transferring personal data abroad. We choose providers that offer contractual data protection terms and, where offered, we do not permit our data to be used to train their models. We may also disclose information where the law requires it.

We keep your account and the data attached to it for as long as your account exists. Sign-in codes expire within minutes, and technical logs are kept for a short operational period and then discarded. When you ask us to delete your account, we delete your account and the data attached to it, including the research reports you requested.

The company research published on the public parts of the site is not affected. Those reports are generated for listed companies rather than for any reader, and carry no record of who requested or read them.

Traffic to the site is encrypted in transit, credentials are held in managed secret storage, and access is limited to the people who operate the platform, and only where they need it to run the service or investigate abuse. Passwords are handled by our sign-in provider and are never stored by us.

No system is perfectly secure. Use a password you do not use anywhere else, and tell us at once if you believe your account has been accessed by someone else.

Under Sri Lanka's Personal Data Protection Act, you have the right to ask us for a copy of the personal data we hold about you, to have inaccurate data corrected, to have your data deleted, to object to or restrict certain processing, and to withdraw consent where our processing rests on it.

Email support@equitylk.lk from the address on your account and we will act on your request, normally within thirty days.

If a breach of security affects your personal data, we will tell the people affected by email without undue delay, explain what happened and what it means for you, and take reasonable steps to limit the damage, which may include ending active sessions and requiring a password reset. We will notify the authorities where the law requires it.

EquityLK is intended for adults. It is not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has created an account, tell us and we will remove it.

We may update this policy as the product changes. The date at the top always reflects the current version, and we will tell account holders by email before a change that materially reduces the protection described here.