Privacy Policy

1. Who we are

Sarisara Lanka is a website where travellers plan trips in Sri Lanka with local guides, and book hotels, home stays, activities and Local Experts through those trips. "We" means Sarisara Lanka (Pvt) Ltd. We decide how your information is used and we are responsible for it.

2. What we collect

If you are a traveller

• Your name, email address, phone number and country, when you create an account or book.
• Your trip: dates, the number of adults and children, the services in your itinerary, and your messages with your guide and with us.
• Payments: what you paid, when, and how. Card and PayPal details are entered with PayPal or the card company, not with us; we only receive a payment reference.
• Bank details, only if you ask for a refund to your bank. They are stored encrypted.
• Proof of what you agreed to: the date, time and internet address when you accept a policy, ask to cancel, or answer a question about your trip.
• Reviews, trip stories and photos you choose to publish.
• When you are signed in: which tours and listings you look at, save or ask about, so we can suggest trips that match your interests.

If you are a partner (guide, driver, hotel, home stay, activity host, Local Expert)

• Your name, contact details, business details and the area you work in, including a map pin.
• Your identity card or passport, your licences and certificates (for example SLTDA), and photos of you and your place. These are kept in a private store that only Sarisara administrators can open.
• Your application conversation with our assistant, Sara, and the papers and photos you send in it.
• Your bank or PayPal details for payments. Bank details are stored encrypted.
• Your listings, prices, calendars, bookings, payments and messages.

If you are a Discoverer

• Your email, user name, identity card for checking who you are, the places and people you introduce, and your payment details.

If you only visit the website

• Nothing that names you. If you accept statistics in the cookie notice, Google Analytics and Microsoft Clarity record how the website is used (pages, clicks, country, device). We never send them your name, email or phone number.
• If you join the newsletter or write to us through a form, your name, email and message.

3. Why we use it

• To plan, book and run your trip, and to take and refund payments.
• To check every partner's identity and licences before travellers can book them, as Sri Lankan tourism rules require.
• To pay partners, and to keep the accounting and tax records the law requires.
• To keep the website safe: stopping fake sign-ups, fraud and misuse.
• To settle a disagreement fairly, using what was agreed and written at the time.
• To send you emails about your trip or your account. Newsletters and travel ideas are sent only if you agreed, and every one has an unsubscribe link.
• To improve the website, using statistics only if you accepted them.

4. Who else sees it

• The partners on your trip see your name, your dates, the number of travellers and what you booked from them. They do not see your phone number or email address.
• Travellers see a partner's public profile and listings. A partner's phone number and email address are never shown.
• Payment companies (PayPal, and a card company where card payment is offered) handle your payment. Banks carry refunds and partner payments.
• Document checking: to read partner documents and compare them with what the partner typed, the document image is sent to Google Cloud Vision and to an artificial-intelligence service (Anthropic's Claude). A Sarisara person always makes the final decision.
• The application assistant: a partner's application conversation is answered by an artificial-intelligence service chosen by Sarisara.
• Email and messages: our email sending company delivers our emails. When we message Local Experts on WhatsApp, Meta (WhatsApp) carries the message.
• Statistics (Google Analytics, Microsoft Clarity), only if you accepted them.
• Website services: our hosting company, Google Maps (for road distances, without your personal details), Google Fonts, and a social account (such as Facebook) if you choose to sign in with it.
• The law: a court, the police or a government body, only when the law requires it.

We do not sell your information, and we do not let any of these companies use it for their own advertising.

5. Information sent outside Sri Lanka

Some of the companies in section 4 work outside Sri Lanka, for example in the United States or Europe. We use them only for the purposes above, and we choose companies that protect information to a recognised standard.

6. Cookies

• Necessary cookies keep you signed in, remember your trip and currency, and protect the website. They are always on.
• Partner share links: when you open a partner's shared link, a cookie remembers which partner sent you, for 30 days.
• Review votes: a cookie stops the same visitor voting twice on a review, for 1 year.
• Statistics cookies from Google Analytics and Microsoft Clarity are set only if you press Accept in the cookie notice. "Only necessary" loads neither.

7. How long we keep it

• Your account: until you ask us to close it.
• Bookings, payments and what was agreed: for as long as tax and accounting law requires, and while a disagreement about a trip could still be raised.
• Partner identity documents and licences: while the partner works with us, and afterwards for as long as the law requires us to show we checked them.
• Statistics: kept by Google and Microsoft under their own settings, without your name.

8. How we protect it

Identity documents and licences are kept in a private store, not on the public website. Bank details are encrypted. Only Sarisara administrators can open them, and changes to payment details are recorded and confirmed by email.

9. Your rights

You can ask us to show you the information we hold about you, correct it, delete it, stop using it for newsletters, or send it to you. You can withdraw your agreement to statistics or newsletters at any time. Write to us at the address in section 12; a person answers within 30 days. We may need to keep some records the law requires, and we will tell you which ones.

If you think we have not handled your information properly, you can also complain to the Data Protection Authority of Sri Lanka, or to the data protection authority in your own country.

10. Children

Accounts are for adults. When a trip includes children, we record how many children travel; the adult who books gives any details we need.

11. Changes to this policy

If we change this policy in a way that matters, we will tell you by email or on the website before the change applies.

12. Contact

Sarisara Lanka (Pvt) Ltd
Address: Panadura, Sri Lanka
Privacy questions: privacy@sarisaralanka.com

Cancellations and refunds are explained in our Cancellation & Refund Policy.

Effective date: [effective date]