Privacy policy

Lamaa.lk ("we", "us") is an online marketplace for independent Sri Lankan makers, available at https://lamaa.lk. This policy applies to our website and to every account on it (customers, sellers and staff). By using the site you agree to it.

Who we are and how to reach us

Lamaa.lk is run by the Lamaa.lk team in Sri Lanka. For any question about your personal information, use the Contact page (https://lamaa.lk/contact) or message us on WhatsApp at +94 77 241 2522. We reply within a few working days.

Information we collect

- Account details: your name, email address, phone number and password. We never see or store your actual password, only a protected (hashed) version of it. - Orders and delivery: the delivery address and phone number you give at checkout, the items you order, order and payment status, and messages about your order. - Sign in with Google: if you choose "Continue with Google", Google sends us only your name, your email address and your profile picture. We do not request or receive anything else from your Google account, and we cannot read your email, files, contacts or calendar. - Payment slips: the photo or screenshot of your bank transfer that you upload to prove payment. - Seller information: for makers, the shop name, description, logo and cover image, product photos and descriptions, and shop contact details. - Reviews and support messages: reviews you write, and anything you send us through the contact or support forms. - Technical and security data: your IP address, browser and device type, the time of sign-ins and key account actions. We use this to keep accounts safe and to find abuse. Staff accounts also record two-factor authentication settings. - Cookies: only the cookies the site needs to keep you signed in, protect forms from forgery and remember basic choices. We do not use advertising cookies or third-party tracking and analytics tools.

How we use your information

- To create and manage your account and sign you in. - To take and reserve your order, check your bank transfer, arrange delivery with the maker, and handle returns. - To send emails the service needs: email verification, password reset, order confirmation and payment status. - To answer your questions and give support. - To keep the site secure, prevent fraud and abuse, and fix problems. - To meet legal, tax and accounting duties.

We do not sell your personal information and we do not use it for advertising.

Google user data

Information we receive from Google when you sign in (your name, email address and profile picture) is used only to create your account, sign you in and show your name and picture to you. We do not share it with anyone except the service providers listed below that we need to run the site, we do not use it for advertising, and we do not use it for anything unrelated to your account. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove our access at any time at https://myaccount.google.com/permissions, and you can ask us to delete your account (see "Your rights").

Who we share information with

- The makers you buy from: your name, delivery address, phone number and the items they sold you, so they can prepare and send your order. - Delivery companies: the details needed to deliver your parcel. - Service providers that help us run the site: our hosting provider (DigitalOcean, servers in Singapore), our email delivery provider (Gmail or Resend), and Google for "Continue with Google". They handle data only to provide their service to us. - Authorities, when the law requires it or to protect people from harm or fraud.

We do not share your information with anyone else.

Payment slips

Payment slips are stored privately, can be seen only by authorised staff, and are not shown to makers or other customers. After we verify your payment, the slip image is deleted from our storage. We keep the payment record (amount, reference, status and date) but not the image.

Where your data is kept and how we protect it

Our servers are in Singapore. We protect your information with encrypted connections (HTTPS), hashed passwords, two-factor authentication for staff, access limited by role, private storage for payment slips and encrypted backups. No online service is completely secure, so please use a strong, unique password and tell us at once if you think your account was misused.

How long we keep it

- Account details: for as long as your account is open. When you ask us to delete it, we delete or anonymise your personal information, except what the law requires us to keep. - Orders and payment records: for as long as Sri Lankan tax and accounting rules require. - Payment slip images: only until the payment is verified, then deleted. - Security logs: for a limited time, then removed. - Backups: encrypted backups are kept for about 14 days, so deleted data disappears from backups within that time.

Your rights

You can ask us to show you the personal information we hold about you, correct it, delete it, or stop using it for a purpose. You can also withdraw Google's access to your account at any time. Send your request through our Contact page or on WhatsApp, from the email address or phone number linked to your account so we can confirm it is you. This follows the rights described in Sri Lanka's Personal Data Protection Act, No. 9 of 2022.

Children

Lamaa.lk is not meant for children, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

When we change this policy we will update the date at the top of this page. If a change is important, we will also tell you by email or on the site.

Contact

Questions about this policy or your information: https://lamaa.lk/contact or WhatsApp +94 77 241 2522.