Privacy Policy

1. Who is responsible for your data

The controller of your personal data is [Company legal name, registration no., address] (“LokuPodi”, “we”). This policy explains how we process personal data under the Personal Data Protection Act No. 9 of 2022 (“PDPA”).

Data protection contact: [Data Protection Officer name], [privacy@ contact email], [address].

2. What we collect

• Account data: your email address (to sign you in with a one-time link), your display name and your language choice. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Phone number: the mobile number you verify by SMS code, and the contact number on each ad. Both are stored encrypted.
• Listing content: the text, photos, price, category, condition and town of your ads, and messages you send to moderators. We remove hidden data such as GPS location from photos before saving them.
• LokuPodi Store details: for drop-off requests and buy requests, your name, phone number, delivery area or address, item details, inspection records and order history.
• Consent records: which version of our terms you accepted, when, and in what context (for example account creation or posting an ad).
• Usage and security data: anonymous counts such as ad views and “Show phone number” taps, measured with a hashed visitor ID that rotates daily — we do not store raw IP addresses for analytics. We use short-lived, hashed network identifiers for rate limits and abuse prevention.
• Cookies: a cookie to keep you signed in and one to remember your language. We do not use advertising cookies.

3. Why we use it and our lawful basis

• To provide the Service — create your account, publish your ads, show your number to interested buyers, and process LokuPodi Store requests (performance of our contract with you).
• To keep LokuPodi safe — moderate ads, prevent fraud, spam and scraping, and enforce our Terms and Posting rules (our legitimate interests, and legal obligations).
• To record your acceptance of our terms, and to keep records required by law (legal obligations and legitimate interests).
• To improve the Service using anonymous, aggregated statistics (legitimate interests).
• To send you service messages such as sign-in links, verification codes and updates about your ads or Store requests. We will only send marketing messages with your consent, and you can withdraw consent at any time.

4. How your phone number is protected

• Phone numbers are encrypted in our database and are never placed in the page itself.
• The number on an ad is revealed only when a visitor taps “Show phone number”, and reveals are rate-limited to stop scraping.
• Sellers can see how many times their number was revealed, but not who revealed it.
• LokuPodi Store ads show the LokuPodi Store business line, not the seller's number, and never show the seller's identity.

4A. Jobs: employers and applicants

• Employer profiles: the company details you enter are public on the company page and job pages, except the contact email and phone for LokuPodi, which only our staff see. We also keep which LokuPodi accounts are members of each employer. We keep this data while the employer profile exists, and moderation and consent records afterwards as described below.
• Apply contacts: the email, phone, WhatsApp number or link an employer chooses for applications is a business contact. It is not printed in job pages; it is released only to a visitor who taps Apply, with rate limits against scraping.
• Job statistics: we count job views and apply clicks using the same daily-rotating, hashed visitor identifier as the rest of LokuPodi (no IP address is stored), and show employers only totals.
• Applicants: LokuPodi does not collect or store job applications or CVs. When you apply, you contact the employer directly, and the employer is responsible for the personal data you send them.

5. Who we share it with

• Other users: your ads, your display name and (only when a visitor asks) your ad's contact number are shown publicly.
• LokuPodi staff and LokuPodi Store staff, who need the data to moderate ads, handle Store drop-offs, orders, delivery and payouts.
• Service providers who process data for us under contract: hosting and database, file storage, email delivery, SMS delivery, and AI text assistance for optional ad drafting.
• Authorities, when the law requires it or to protect the rights and safety of users and the public.
• We do not sell personal data.

6. Processing outside Sri Lanka

Some of our service providers (such as cloud hosting and email) store or process data on servers outside Sri Lanka. Where we transfer personal data outside Sri Lanka, we do so as permitted by the PDPA and use providers that apply appropriate safeguards to protect it.

7. How long we keep it

• Account data: while your account is open, and deleted or anonymised after you ask us to close it, except where we must keep it longer.
• Ads: while they are live and for a limited time after they expire or are removed, so that you can renew them and so that we can handle reports.
• LokuPodi Store records, moderation records, consent records and audit logs: as long as needed to handle disputes and meet legal, tax and accounting obligations.
• Daily-rotating analytics identifiers cannot be linked back to you after they rotate.

8. Security

We protect personal data with measures such as encryption of phone numbers, encrypted connections (HTTPS), access controls for staff, two-factor authentication for administrators, and rate limits. No system is perfectly secure; if a breach affects your data, we will act as required by the PDPA.

9. Your rights

• Under the PDPA you may ask us for access to your personal data, to correct or complete it, to erase it, or to withdraw consent where we rely on consent. You may also object to certain processing and ask for a review of decisions made solely by automated means.
• You can edit or remove your ads at any time from My listings, and change your name and language in your profile.
• When we erase an account, we may keep limited records that the law requires or that are needed to handle disputes, such as consent records and audit logs; these are unlinked from your account where possible.
• To exercise your rights, contact our data protection contact above. If you are not satisfied with our response, you may complain to the Data Protection Authority of Sri Lanka.

10. Children

LokuPodi accounts are for people aged 18 or over, or used with the consent of a parent or guardian. We do not knowingly collect personal data from children without that consent. If you believe a child has given us personal data, please contact us so we can delete it.

11. Changes to this policy

We may update this policy. The date of the latest version is shown at the top of this page, and we will give notice on the Service of material changes. If there is any conflict between the English, Sinhala and Tamil versions, the English version prevails.