Privacy Policy

This policy explains what personal data Maluwa.lk collects, why, who processes it for us, and the choices you have. It's written to meet Sri Lanka's Personal Data Protection Act (No. 9 of 2022). Maluwa.lk is the data controller.

1. What we collect

• Account: your name and email address (and profile photo, if any) from your sign-in provider when you create an account.
• Profile: the role you choose (seeker or lister), and for listers an optional phone number, agency name and short bio.
• Listings: everything a lister enters about a property — description, price, size, features, photos and its map location.
• Enquiries: the message you send a lister, plus your name, account email and any phone number you include.
• Saved items: favourites and saved searches, so they follow you across devices. Before you sign in, favourites are stored only in your browser.
• Technical: standard server logs (IP address, browser, pages requested) and error reports, used to keep the site working and secure.

We don't collect payment details — Maluwa is currently free — and we don't run advertising trackers.

2. How we use it

• To run the service: show listings, deliver enquiries, keep your favourites and searches.
• To email you when someone enquires about your listing, and to confirm enquiries you send.
• To prevent abuse — for example, limiting how many enquiries an account can send.
• To fix problems and improve the site, using aggregated or technical data.

3. Who sees your data

• Other users: a lister's name and agency appear on their public listings. When you enquire, that lister receives your name, account email and any phone number you included. Your phone number is otherwise private.
• Service providers that process data on our behalf, under contract: Clerk (sign-in and account security), Supabase (database), Cloudflare (photo storage and delivery), Vercel (hosting and logs) and Resend (transactional email). Some of these providers store data outside Sri Lanka.
• Legal: if required by law or to protect users and the service.

We don't sell personal data.

4. Cookies

We use only the cookies needed to keep you signed in and secure (set by our sign-in provider, Clerk). There are no advertising or cross-site tracking cookies.

5. How long we keep it

Your account data and listings are kept while your account exists. Enquiries are kept so both you and the lister have a record of the conversation. Server logs are retained for a short period for security and debugging. When you delete your account, your profile, listings, photos, favourites, saved searches and enquiries are deleted.

6. Your rights

• Access and correction: listers can edit their profile in Settings; anyone can update their name, email and sign-in methods from the account menu.
• Deletion: delete your account from the account menu (Manage account → Security → Delete account). This removes your data as described above.
• Objection and complaints: you can contact us about any use of your data, and you have the right to complain to the Data Protection Authority of Sri Lanka.

7. Security

Data is encrypted in transit, database access is restricted by row-level security so users can only see what they're entitled to, and sign-in is handled by a dedicated identity provider. No system is perfectly secure — please use a strong, unique password.

8. Children

Maluwa is for adults. We don't knowingly collect data from anyone under 18.

9. Changes

If we change this policy materially we'll post the new version here with a new date.

10. Contact

For any privacy question or request, see the contact page.