Privacy Policy

CeylonLot ("we", "us") is a parking management platform for municipal councils and private parking operators in Sri Lanka, built and operated from Colombo. It has two parts: a mobile app that parking officers use to check vehicles in and out and collect payments, and a dashboard that operators use to watch zones, slots, occupancy and earnings.

This policy covers the officer app, the operator dashboard and this website.

• Officer account data. The officer ID and name an operator registers with us, sign-in credentials, and the session information needed to keep accounts signed in securely. Passwords are handled by our authentication system (Better Auth) and stored only in hashed form - we never store or see them in plain text.
• Parking records. The vehicle plate number, vehicle type (car, three-wheeler, bike, van and so on), lot and zone, check-in and check-out timestamps, the computed fee and the payment method.
• Payment data. For card and digital payments: the amount, method, status and the transaction reference returned by PayHere, our payment gateway. Card numbers never touch our systems - they are entered with and processed by PayHere under its own privacy policy.
• Operator contact details.The name, email address and phone number we use to set up an operator's account, bill it and provide support.
• This website.The request-access form composes an email in your own mail app - the site itself stores nothing you type. We set no advertising or analytics cookies; if you sign in, a session token is kept in your browser's local storage so you stay signed in.

We use this data to run the service, and for nothing else:

• recording check-ins and check-outs, and computing fees from the operator's rate card;
• showing each operator its own dashboards - revenue, occupancy, activity and history;
• investigating disputed charges against the timestamped record, and providing support;
• keeping the platform secure and its accounts genuine;
• meeting tax, accounting and other legal obligations.

We do not sell personal data, we run no advertising, and we do no profiling.

Platform data is stored in Supabase, a managed database service, encrypted in transit (HTTPS/TLS) and at rest. Access is restricted by role: officers see the sessions for the lots they work, operators see only their own zones, and administrative access on our side is limited to what is needed to run and support the service. Sign-in is handled by Better Auth, with credentials stored only in hashed form.

Supabase's infrastructure may be hosted outside Sri Lanka; where it is, the same encryption and access controls apply.

No system is perfectly secure. If we become aware of a breach affecting personal data, we will notify the affected operators - and, where the law requires it, the authorities - without undue delay.

• Your operator.Each council or operator sees only the data from its own lots and zones - its officers, sessions and takings. No operator can see another's.
• Service providers. Supabase (hosting and database) and PayHere (payment processing), each only to the extent needed to do its job.
• Authorities. If the law requires it - a court order or a lawful request from a public authority - we may have to disclose records.

That is the whole list. We never share data for marketing, and we never sell it.

• Parking and transaction records are kept while the operator's account is active, and after closure only for as long as tax, accounting and audit obligations require - we treat that as up to seven years.
• Officer accounts are deactivated when the operator asks us to, and the officer's personal details are deleted or anonymised once they are no longer needed.
• Support and dispute correspondence is kept only as long as the matter it relates to.

Sri Lanka's Personal Data Protection Act, No. 9 of 2022 gives you rights over personal data we hold - including the right to see it, to have errors corrected and, in some cases, to have it erased or to object to how it is used.

• Officers - raise it with your operator, or email us directly.
• Motorists - the personal data we hold about you is normally limited to your plate number and the session record. Ask the operator of the lot, or email us.

Email hello@ceylonlot.com.lk and we aim to respond within 14 days. If you are not satisfied with our answer, you can complain to the Data Protection Authority of Sri Lanka.

When this policy changes, we update this page and the date at the top. If a change is material - new data collected, a new recipient - we tell operators by email before it takes effect.

Questions about privacy or this policy: hello@ceylonlot.com.lk.