Legal

Privacy Policy

Last updated: June 29, 2026

1. Introduction

Lankan Ads ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform. By using the Platform you consent to the practices described in this Policy.

2. Information We Collect

We collect the following categories of information:

2.1 Information You Provide

Mobile phone number — used for account registration and OTP verification
Password — stored as a salted PBKDF2-SHA512 hash; never stored in plain text
Advertisement content — title, description, images, price, location, and contact number you submit
Payment information — transaction details processed by PayHere (we do not store card numbers)

2.2 Information Collected Automatically

IP address — collected for security, rate limiting, and fraud prevention
Browser and device information — user agent, viewport size
Usage data — pages visited, advertisements viewed, interactions with the Platform
Cookies — session cookie for authentication and age verification cookie

3. How We Use Your Information

To create and manage your account
To publish and display your advertisements
To process payments via PayHere
To send OTP verification codes via SMS
To prevent fraud, abuse, and unauthorised access
To comply with legal obligations
To improve the Platform's functionality and user experience
To send service-related communications (account activity, ad expiry)

4. Sharing Your Information

We do not sell your personal data. We may share your information with:

Payment processors — PayHere, to process advertisement fees
SMS providers — to deliver OTP verification codes to your phone
Cloud infrastructure — Supabase (database hosting) and Cloudinary (image storage)
Law enforcement — when required by applicable law or to protect the safety of users

Your contact number on advertisements is visible to the public as part of your listing. Do not include sensitive personal information you do not wish to be publicly visible.

5. Cookies

We use the following cookies:

admin_session — HttpOnly, Secure session token for admin panel access
age_verified — stores your 18+ age confirmation for 24 hours

Authentication tokens for regular users are stored in localStorage. You can clear these at any time through your browser settings.

6. Data Retention

Account information is retained for as long as your account is active
Advertisement data is retained for 90 days after expiry before deletion
OTP codes expire automatically after 5 minutes
Payment records are retained for 7 years for financial compliance

7. Security

We implement industry-standard security measures including:

Passwords hashed with PBKDF2-SHA512 and a unique random salt per user
HTTPS encryption for all data in transit
HttpOnly, Secure cookies for admin sessions
Rate limiting on authentication endpoints
Input sanitisation to prevent XSS and injection attacks
Content Security Policy (CSP) headers

Despite these measures, no system is 100% secure. We cannot guarantee the absolute security of your data.

8. Your Rights

You have the right to:

Access the personal data we hold about you
Request correction of inaccurate personal data
Request deletion of your account and associated data
Withdraw consent for data processing where consent is the legal basis

To exercise these rights, contact us at info@lankanads.lk.

9. Children's Privacy

The Platform is strictly for individuals aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes by updating the "Last updated" date. Continued use of the Platform after changes are posted constitutes acceptance of the updated Policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy, please contact: info@lankanads.lk