DRAFT for legal review. Not yet in force.

Privacy Policy

This policy explains what personal information Athkai collects, why, who can see it, and your rights. It is written with Sri Lanka's Personal Data Protection Act, No. 9 of 2022 in mind.

1. Who is responsible

[BUSINESS NAME], [REGISTERED ADDRESS], Sri Lanka, is responsible for your personal information on Athkai. Contact for privacy questions: [DATA PROTECTION CONTACT / EMAIL].

Each seller is also responsible for how they use the order details they receive from Athkai.

2. What we collect

From buyers (no account needed)

• Your name, mobile number, delivery address and district.
• Your email address, only if you choose to give it.
• What you ordered, the total, the payment method you chose, and any note to the seller.
• Problem reports you send, and the seller's replies.

From sellers

• Your name and email address, and a password (stored only in scrambled form by our login provider).
• Your shop details: name, web address, story, district, logo, WhatsApp number, social media link, delivery fee and payment options.
• Your bank account details, if you accept bank transfer.
• Your products and photos.

Automatically

• A scrambled (hashed) code made from your internet connection when you place an order. We use it only to limit spam and delete it after one day.
• Basic technical logs kept by our hosting provider for security and to fix errors.

3. Why we use it

• To handle your order: the seller needs your name, phone and address to deliver, and to contact you.
• To send emails you asked for: order confirmation and updates, if you gave an email.
• To keep Athkai safe: spam limits, checking new shops, and acting on problem reports.
• To meet legal duties, where the law requires us to keep or share information.

We do not sell personal information, and we do not use it for advertising.

4. Who can see it

• The seller of your order sees your order and delivery details and your problem reports. Sellers can only see their own orders.
• Athkai administrators can see shops, orders and problem reports to run the marketplace and handle complaints.
• Buyers who place a bank-transfer order see that seller's bank account details.
• Service providers who run parts of Athkai for us:
• Supabase (database, login and photo storage; servers in Mumbai, India)
• Vercel (website hosting)
• Resend (sending emails)

Some of them process data outside Sri Lanka. [CROSS-BORDER TRANSFER WORDING AND SAFEGUARDS TO BE CONFIRMED BY LAWYER]

• Public authorities, when the law requires it.

5. Cookies and storage on your device

• Sellers who log in get a login cookie so they stay logged in.
• Your cart is saved only in your own browser on your device.
• Athkai uses no advertising or tracking cookies.

6. How long we keep it

• Order and problem report details: [RETENTION PERIOD], then deleted or anonymised. [TO BE CONFIRMED, including any tax or legal record-keeping period]
• Seller accounts: while the account is open, then [RETENTION PERIOD].
• Spam-limit codes: one day.

7. Security

Data is sent over encrypted connections. Strict database rules stop sellers from seeing other sellers' orders, and buyers can only see their own order through their private link. Only a scrambled version of each order link is stored.

8. Your rights

Under the Personal Data Protection Act you may ask to:

• see the personal information we hold about you;
• correct it if it is wrong;
• delete it, or stop or limit how we use it, where the law allows;
• withdraw consent you gave (for example, for emails).

To use these rights, contact [DATA PROTECTION CONTACT / EMAIL]. Buyers: please include your order link so we can find your order. If you are not satisfied with our answer, you may complain to the Data Protection Authority of Sri Lanka.

9. Children

Athkai is not meant for children under [AGE]. [TO BE CONFIRMED]

10. Changes

We may update this policy. The date at the bottom shows the latest version.

Last updated: November 5, 2026