Who handles your information
SHALANKA DOT COM (PVT) LTD. operates the platform. Use Contact SHALANKA to ask about privacy or request access, correction, deletion or assistance. Businesses using SHALANKA may have separate responsibilities for information they use to fulfil your order. This notice describes platform practices; legal rights and remedies depend on applicable law and the provisions in force at the relevant time.
Information we process and why
Account information includes your name, email, mobile number, verification status, password hash, settings and account history. It supports sign-in, account recovery, security and your selected profile features. Optional profile information, photos and education/work details are used to display the profile you choose to create. SHALANKA's account passport is a platform identifier, not a government identity or travel document.
Business and transaction information includes listings, business assignments, stock, orders, bookings, delivery details, payment references, wallet movements, refunds, tips and earnings. It is used to operate and reconcile transactions, handle complaints and maintain required records. Payment providers process card details through their own payment flow; do not put card details or OTP codes into posts or chat.
Social information includes your posts, media, reactions, comments, shares, connections, reports and messages. It is used to deliver the chosen community features, enforce access rules and address abuse. Necessary technical records may include sessions, device or network information, verification attempts and operational audit events. We use them to keep the system working and investigate misuse. We do not publish passwords or verified mobile numbers as profile fields.
Your location and cookies
With your browser's permission, approximate or precise location helps show nearby results, maps, directions and available services. You can decline location permission or choose a location manually. Live-location features require the applicable trip or delivery controls and their additional notice. A public listing pin describes the business or listing location; avoid using a private home position unless you intend to publish it. The site uses a sign-in session cookie and browser storage for preferences such as theme, selected location and saved items. Clearing storage may reset those choices. New optional advertising or analytics services require an appropriate notice and choices before activation where applicable.
Audiences and messages
Choose Public, Friends or Only me for your personal profile and post audience. A post's own audience and your account-level ceiling apply together. Choose Everyone, Friends or Nobody for incoming personal messages; the restriction also applies to replies in existing personal threads. Business Place conversations follow authorized business roles so customers can still contact the business. Blocking provides additional personal interaction controls. A public post can be seen, copied or linked by others; copies already made outside the platform cannot be recalled by changing a setting. Previously public media URLs may remain accessible until reviewed or removed; new non-public post attachments use protected delivery.
Who can access data
Content is shown to the audience and participants permitted by the relevant feature. Business owners, authorized managers, delivery partners and other transaction parties receive information needed for their assigned task. Administrators can inspect operations for support, security, moderation, reconciliation and compliance. Audited member support sessions are read-only, time-limited and do not change a member's verification status. Operational access is separate from social visibility; private does not mean inaccessible to authorized platform administration.
Configured infrastructure and specialist providers may process information to deliver hosting, payments, OTP verification, routing and optional AI assistance. Sri Lankan SMS may use Notify.lk; international phone verification may use Google Firebase. Google processes and stores verification numbers for spam and abuse prevention as disclosed in the verification notice. Optional AI assistance may send the relevant query or conversation context to the configured provider and can hand over to authorized business staff. Do not send unnecessary sensitive information. Some providers may process data outside Sri Lanka under their terms and applicable safeguards. SHALANKA should identify newly activated providers and material changes in this notice.
Deactivation, deletion and retention
Deactivation hides your personal profile and personal posts while allowing later reactivation. A deletion request starts a one-calendar-month recovery period with a displayed deadline. Sign in, prove account access and explicitly cancel deletion before that deadline to reactivate. After the deadline the account cannot be recovered; scheduled processing removes the live profile's direct identifiers and sign-in credentials. Financial, order, business, purchased-content, dispute and audit records may remain for settlement, accountability, legal obligations or claims. Previously purchased paid posts remain available to their authorized buyers unless removed through moderation or a refund review. Existing messages and business publications are not automatically erased from other participants' records. Historical imported records and restored source history are access-controlled archives, not a live wallet. Backups and retained files require the retention-review process and are not all erased at the recovery deadline. Ask support about a specific record or retention purpose.
Choices, concerns and updates
Edit your information, use audience and message controls, block or report members, deactivate your account or request deletion from account settings. Contact SHALANKA for requests the interface cannot fulfil, including retained records, copies or corrections. We may need proportionate proof of identity and may retain information required for another lawful purpose. These voluntary platform controls do not limit any statutory right that applies to you. If needed, use the relevant regulator or legal complaint process available under applicable law. Security controls reduce risk but cannot guarantee that no incident will occur. Policy revisions show their version and update date.
Questions about this policy? Contact SHALANKA.