தனியுரிமைக் கொள்கை

• Your name and mobile number, so we can identify you and reach you about an order.
• Your delivery address, and the map location you pin, so a delivery partner can find you.
• Your orders: the items, the amounts, the substitutions you approved, and what you paid.
• Messages you send us, including on WhatsApp, and photographs attached to a complaint.
• If you join the waitlist: your name, mobile number and the area you live in.
• Basic technical data when you use the site or the app — device type, app version, and anonymous usage statistics.

We do not store card details. Card payments, when they are available, are handled by a licensed payment service provider that receives those details directly.

We do not track your location when you are not using the app. A delivery partner’s location is tracked only while they are on an active delivery.

We do not use advertising cookies, and the site has no third-party advertising trackers.

• To take, shop and deliver your order, and to contact you about it — because that is necessary to perform our contract with you.
• To take payment and keep accurate financial records — contract, and our legal obligations.
• To send you the one message you asked for when you join the waitlist — your consent, which you can withdraw at any time.
• To investigate complaints, prevent fraud and keep partners and customers safe — our legitimate interests.
• To understand, in aggregate, how the service is used so we can improve it — our legitimate interests. This analysis does not identify you.

• The delivery partner assigned to your order, who sees your first name, your delivery address and your order, and nothing else about you.
• Our SMS provider, to deliver the one-time code that signs you in.
• Our payment service provider, when you pay by card.
• Our hosting and database provider, which stores the data on our behalf under contract.
• A public authority, where the law requires us to disclose it.

We do not sell personal data, and we do not share it for anyone else’s marketing.

Our database and file storage are operated by Supabase. Data may be processed on servers outside Sri Lanka. Where that happens we rely on the provider’s contractual data-protection commitments, and we take reasonable steps to ensure the protection travels with the data.

• Order records and the financial record attached to them: seven years, because tax and accounting rules require it.
• Your account and addresses: while your account is open, and for one year after you close it.
• Waitlist entries: until we have opened in your area and told you, or until you ask us to remove you, whichever comes first.
• Support messages and complaint photographs: two years.

Under the Personal Data Protection Act you may ask us to show you the personal data we hold about you, correct it if it is wrong, delete it where we have no continuing reason or legal duty to keep it, or stop a particular use of it. You may withdraw consent at any time where consent is the basis we rely on.

To exercise any of these, contact us using the details on the contact page. We will respond within the period the Act requires. If you are not satisfied, you may complain to the Data Protection Authority of Sri Lanka.

Access to customer data is restricted to the staff who need it, and the database enforces those limits itself through row-level security rather than relying on application code. Traffic is encrypted in transit. Delivery partners see only the order they are delivering.

No system is perfectly secure. If a breach affects your personal data and is likely to harm you, we will tell you and the Authority as the Act requires.

The service is not for children. We do not knowingly collect personal data from anyone under 18. If you believe we have, tell us and we will delete it.

If we change this policy, the date at the top of this page changes with it. Where a change materially affects your rights we will tell you directly.

Questions about this policy can go to the contact page, or on WhatsApp to the number published there.