Privacy Policy

This policy is issued by Crew Ceylon, which decides how and why your personal data is used on Crew Ceylon. It covers visitors, vendors, and people who leave reviews.

The short version

• You can browse and contact vendors without an account or giving us your name.
• We use no advertising trackers and no third-party analytics.
• We never see or store payment card numbers.
• We don’t sell your data.
• Vendors can delete their account and data themselves, any time.

What we collect

Vendors (people with an account)

• Account: email address and a sign-in method — a password or your Google account. Passwords and sign-in sessions are handled by Clerk; we never see or store your password.
• Profile: your name or business name, bio, service type, districts and event types, starting price, profile photo, cover image, photos and videos, packages and any phone, email, WhatsApp, website or social links you choose to add.
• Activity: your onboarding progress, whether your listing is published, and your boost balance and history.
• Payments: a record of each boost purchase — amount, package, date, status and transaction reference. See “Payments” below.

People who leave a review

You verify with Google each time you post. We receive and keep the name, email address and profile photo on that Google account, stored with your review. The email is used to enforce one review per person per vendor and to let you delete your own review; it isn’t shown publicly. We don’t create an account for you and can’t see anything else in your Google account.

Visitors

If you only browse, we collect nothing that identifies you by name. See the next section for the anonymous counting we do.

Visitors and analytics

When someone views a vendor’s profile or clicks a contact option, we log it so the vendor can see how their listing performs. To avoid counting one person many times:

• Your browser stores a random anonymous ID in local storage. It isn’t linked to your name, email or account, and you can clear it any time in your browser settings.
• As a backstop we compute a one-way hash of your IP address, browser details and the current date. We never store the raw IP address, and because the date is part of the hash it can’t be used to recognise you on a different day.

That’s all the analytics there is. We don’t use Google Analytics, advertising pixels or similar third-party trackers, and vendors only ever see totals — never who visited.

Cookies: signed-in vendors have session cookies set by our sign-in provider, which are needed for the account to work. We set no advertising or tracking cookies.

Payments

Boost purchases are processed by PayHere. You enter your card details on PayHere’s own checkout page, not ours, and PayHere — not Crew Ceylon — handles and stores them. We receive back only the result: whether the payment succeeded, the amount, and a reference.

• Each payment notification is cryptographically verified against our records before any credits are issued, and the price is always set by our server, never taken from your browser — so a tampered request can’t change what you’re charged.
• We keep payment records for accounting and dispute handling, even after an account is deleted (see “How long we keep it”).
• Payments between customers and vendors don’t pass through us, so we hold no data about them.

Who we share it with

We use a small number of service providers to run the site. Each only gets what it needs:

• Clerk — sign-in, accounts and sessions.
• Google — “Continue with Google” for vendors, and identity verification for reviews.
• PayHere — boost payments.
• Amazon Web Services and Railway — hosting, our database, and storage of the photos and videos vendors upload.

Some of these providers process data outside Sri Lanka. We only use providers that apply appropriate safeguards. We may also disclose data where the law requires it, or to protect against fraud or abuse. We don’t sell personal data or share it for advertising.

What’s public

Please keep in mind what anyone on the internet can see:

• A published vendor profile — everything on it, including the contact details you add. Don’t put anything on a profile you wouldn’t want a stranger to read.
• A review shows the reviewer’s Google name and profile photo, the rating, text and month. If the reviewer is also a registered vendor, it shows a “Vendor” tag and links to their profile.

How long we keep it

• Vendors: for as long as your account exists. When you delete it (Dashboard → Settings) we delete your profile, widgets, media (including the files in our storage), analytics, boost data, reviews about you, and your sign-in account.
• Payment and credit records are kept after deletion, disconnected from your account, because we need them for accounting and to resolve payment disputes. They contain no profile content.
• Reviews you wrote about other vendors stay with those vendors. To remove one, delete it yourself (re-verify with Google on the vendor’s page) or contact us.
• Anonymous analytics are deleted along with the profile they belong to.

Your rights

Under Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, you have rights over your personal data, including to:

• know what we hold about you and get a copy;
• correct data that’s wrong or incomplete;
• have it erased, and withdraw consent where we rely on it;
• object to or ask us to restrict certain uses; and
• complain to the Data Protection Authority if you’re unhappy with how we handle it.

Vendors can edit or delete most of this themselves in the dashboard. For anything else — including reviewers, who have no account — email hello@crewceylon.lk. We may need to confirm who you are first, and we’ll reply within a reasonable time.

Security

Connections to the site are encrypted. Passwords are held by our sign-in provider and aren’t readable by us. Access to our systems is restricted. No service is perfectly secure, so please use a strong, unique password. See Trust & safety for how to spot scams.

Children

Crew Ceylon is for adults. Vendor accounts require you to be 18 or older, and we don’t knowingly collect personal data from children.

Changes

If we change how we use personal data we’ll update this page and its date, and tell vendors in the dashboard when the change matters. See also our Terms of Service.

Contact

Privacy questions or requests: hello@crewceylon.lk.