Privacy Policy

This policy explains how Sri Sinharaja collects and uses personal data. It is written to meet the Personal Data Protection Act No. 9 of 2022 of Sri Lanka, whose main obligations apply from 1 January 2027, and we follow it from now.

What we collect

• Account: name, email, phone, preferred language, password (hashed).
• Orders: delivery name, address, district, phone; order and payment references. We never receive your card number.
• Authors: payout bank details and an identity number for payout verification. Shown only to administrators.
• Printers: company and contact details, bank details for settlement.
• Technical: IP address and browser type in security logs, for fraud prevention and to protect manuscript files.

Why we use it

• To fulfil orders: your address and phone are shared with the printer that prints your book and the courier that delivers it, and with no one else.
• To pay authors and printers.
• To send order updates by email (and SMS if you opt in).
• To keep the platform secure and comply with law.

Who sees it

Printers see the delivery details of their assigned orders only. Authors see the district of a sale, never the customer's name or address. Our payment gateway (PayHere) and email provider (Resend) process data on our behalf under their own terms. Google Analytics measures how the site is used (pages viewed, approximate country, device type); it never receives your name, email, address or payment details. We do not sell personal data.

Where it is stored

On servers operated by Supabase and Netlify. (Legal review: confirm cross-border transfer rules under Part V of the Act once regulations are issued.)

How long

Account data while the account exists. Order and financial records for 6 years for tax purposes. Security logs for 12 months. Manuscripts while the book is listed, plus 90 days.

Your rights

You may ask to see, correct or delete your personal data, or withdraw consent, by emailing [support email]. Deletion requests are completed within 30 days, except records the law requires us to keep.

Cookies

Essential cookies keep you signed in and remember your language. We also use Google Analytics cookies to count visits and see which pages help readers, so we can improve the site. Google's advertising features are switched off, and no advertising trackers are used. You can block these cookies in your browser and the site still works.

Contact

Data protection contact: [name, email]. (Legal review: whether a Data Protection Officer must be designated.)