Privacy policy

Two kinds of information

Your own account. If you run a business or are on its team, or you visit businesslk.com, we decide how your information is used, and this policy covers it.

What customers give a business. When you book, send a message or leave a review on a business's site, that business decides what to do with your details. We store and deliver them for the business, use them only to run the service, and never sell them. Ask the business first about how it uses your details: it can give you a copy or erase them from its dashboard. You can also contact us.

What we collect

Business owners and team members

• How you sign in: your mobile number, or your Google account's name, email address and photo.
• Your name as the team sees it, your language, and your role in each business.
• The business details you enter: name, category, address and map pin, opening hours, contact numbers, photos, pages, services, prices and staff profiles. Whatever you publish is public on the business's site and in the directory.
• For notifications you turn on: a push token for each device and a label such as “Chrome on Android”, your email address, and which alerts you want.
• An activity log of changes to the business (who did what, and when), which owners and admins can see.
• Invitations: the phone number or email address of the person invited. Invitations expire after 7 days.

Customers of a business

• Bookings: your name, mobile number, an optional note, the service, date, time and staff member, and your language.
• Contact form messages: your name, mobile number, optional email address and your message.
• Reviews: your rating and comment. They are public, shown with your first name and initial (for example “Nimali P.”), the service and the month.

The business's team can see your bookings and messages. People with a view-only role cannot.

Everyone who visits

• Visit counts. For each business we keep daily totals: page views, taps on Call, WhatsApp and Directions, and the kind of source (search, social, QR code, direct). We don't store your IP address, the page you came from, or any identifier for you.
• Abuse protection. Your IP address is held briefly in server memory to limit how often forms can be sent. It is not saved.
• Reports. If you report a business, we keep the reason, your details and, if you give it, your email address. Only BusinessLK staff see reports.

How we use it

• To run the service: publish sites, take bookings and messages, and show them to the right team.
• To send texts about a booking (when it is confirmed, moved or cancelled, and a reminder), each with a link to view or cancel it.
• To alert team members by push notification or email, if they turned that on.
• To prevent abuse: we check that requests come from our real apps, limit how often forms can be sent, cap texts to 6 per number per day, and review reported businesses.
• To answer your questions when you contact us.

We don't show ads, sell personal information, or track you across other websites.

Services we rely on

• Google Cloud and Firebase host our database, files and web servers, handle sign-in and push notifications, and run reCAPTCHA Enterprise to block automated abuse.
• Notify.lk delivers our text messages. It receives the mobile number and the text.
• Resend delivers email notifications to team members. It receives the email address and the notification.
• Google Maps. If a business adds a map to its site, the map loads from Google, and Google's privacy policy applies to it.
• OpenStreetMap. When you place your business on the map in the dashboard, your browser loads map images from openstreetmap.org.

Your information is stored outside Sri Lanka, with Google Cloud: our database is in Mumbai, India, and our web servers are in Singapore. We may also share information when the law requires it, or to protect people from fraud or harm.

Cookies and browser storage

• businesslk.com sets one cookie, NEXT_LOCALE, and only when you pick a language. It also notes in your browser, for the current tab session, which pages you've already viewed, so a refresh isn't counted twice.
• app.businesslk.com uses the same language cookie, keeps you signed in with Firebase's browser storage, and remembers a few settings on your device, such as your calendar view, tips you've closed and an unfinished new-business form.

There are no advertising or third-party analytics cookies.

How long we keep it

• Text messages we send: 30 days.
• Short links in texts: 30 days, or 90 days after the booking date if that is later.
• The count of texts sent to each number: 2 days.
• Invitations: 7 days.
• Business details, bookings, messages and reviews: while the business uses BusinessLK. When an owner closes a business, its site goes offline at once and everything it holds, including its photos, is deleted 30 days later. Reports made about a business are kept as moderation records.
• Your account: until you delete it. Deleting it removes your profile and sign-in at once.
• Visit counts: as daily totals, which say nothing about any one person.

Your choices and rights

You can ask us for a copy of your personal information, to correct it, to delete it, or to stop using it for a purpose you agreed to. Email support@businesslk.com from the number's owner or the account's email address, or tell us the booking or business involved, so we can check it's you. We'll reply as soon as we can and within the time the law allows.

Business owners can edit their details, remove photos and turn notifications off in the dashboard at any time. In the dashboard's Privacy tab, owners and admins can download all of their business's data and erase a customer's details when the customer asks. An owner can also close the business there; it can be reopened within 30 days. Anyone can delete their own account from the dashboard's Your account page.

If you think we have handled your information wrongly, you can also complain to Sri Lanka's Data Protection Authority.

Keeping it safe

Every business's data is kept separate, and our security rules are tested automatically on every change so that one business can never read another's. Connections are encrypted, team members only see what their role allows, and changes made by BusinessLK staff are logged.

Children

BusinessLK is for businesses and their customers, not for children. If a booking is for a child, such as a tuition class, a parent or guardian should make it.

Changes to this policy

When we change this policy we'll update the date at the top. If a change affects how we use information you've already given us, we'll tell business owners in the dashboard or by email first.