Privacy Policy - heesara.lk

Who We Are - Data Controller

Heesara.lk, Galle, Sri Lanka. Community matrimony membership platform.
Contact: support@heesara.lk | contact@heesara.lk | privacy@heesara.lk (forwards to same)
Website: https://heesara.lk | OTP emails from noreply@heesara.lk via Resend

1. Data We Collect

Basic: Full name, gender, DOB (18+ validated, Minimum age check), age, district (birth & living), city, religion, caste, marital status, education, job, height, body type, skin color, bio, photos (max 3, WebP compressed), phone, email, expectations (age, height, district, job, caste, religion, horoscope preference), interests, consent flags.

Sensitive - Special Handling: Birth Time (Hr/Min/AM-PM) - PRIVATE & NEVER SHOWN TO OTHERS. Only profile owner can see own TOB in /account. We hide TOB from matches/search/profile view. Used internally only to calculate Porondam 20 matching score. Not displayed on public profile. If someone needs TOB to re-check outside, they must contact owner using contact details that appear only after mutual interest accepted.

We show: Date of birth, birth district/city, living district/city - but NOT birth time to others.

2. How We Use & Lawful Basis (PDPA Act No.9 of 2022)

• Consent: You check ✓ විවාහ අපේක්ෂිතයන් සඳහා (18+ වයස) බව තහවුරු කරමි before creating profile
• Contract: To show your profile only when your profile is in active state, to generate matches (score 100), Porondam 20 ✅❌ details, to allow contact only after mutual interest accept + both paid/active
• Legitimate Interest: Prevent scam (1 account = 2 profiles max, anti-scrape, to stop visibility deactivation), WebP photo compression, security logs
• TOB is processed only for internal porondam calculation, never for public display - legitimate cultural matching purpose

3. Sharing - We Never Sell Data

We never sell data. Sharing only:

• Contact details (phone/email) visible ONLY after accept interest and only for paid users, both accounts must in active state
• Supabase (database/storage), Resend (OTP email from noreply@heesara.lk) - data processors under contract
• Legal if required by Sri Lankan law / court order
• TOB never shared with other users, never in API response for other profiles

4. Security

HTTPS, Supabase Row Level Security, photo blur until accepted option, hide phone/hide email until match, private profile option, WebP compression, rate limiting. TOB encrypted in DB, access restricted to owner only. OTP via Resend with domain verification (SPF/DKIM for heesara.lk).

5. Retention

Profiles kept while account active + 6 months after free/paid expiry. Deleted profiles removed from storage (profile photo bucket) and contacts, interests. You can deactivate via button available or request deletion.

6. Your Rights (PDPA)

• Access: See your data in /account /my-profiles - including your own TOB
• Rectify: Edit via 'edit profile' button
• Deactivate: hidden from search
• Delete: Email support@heesara.lk with profile ID - we delete within 30 days
• Withdraw consent: Deactivate or delete; TOB can be deleted on request - porondam will then show N/A
• Complain: Data Protection Authority of Sri Lanka

7. Children's Privacy - 18+ Only

⚠ විවාහ අපේක්ෂිතයන් සඳහා (18+ වයස) පමණයි. We block DOB less than 18, search age dropdown 18-70 only, input min=18, server validation Age less than 18 rejects. If you are under 18, do not use. If we find under-18 profile, we delete immediately. This is not adult content site - it's family matrimonial.

8. Porondam & No Guarantee Disclaimer

🔮 පොරොන්දම් 20 is cultural belief for information only, not astrological guarantee. TOB is used only for internal cultural matching calculation. Heesara does NOT guarantee marriage. Profiles are posted by users, we only show matches. User must verify details before proceeding. Birth time is private, never shown to others to prevent misuse.

9. Cookies & Logs

We use localStorage for heesara ids, heesara profile id, heesara interests (client only), Supabase auth session. No third-party tracking cookies. No ads.

10. International Transfer

Data stored in Supabase (region) and Resend (US/EU for email delivery). By using heesara.lk you consent to this transfer for OTP delivery.

11. Contact & Updates

For privacy questions, deletion, TOB privacy: support@heesara.lk / contact@heesara.lk - Galle, Sri Lanka. We will update this policy when law changes. Check last updated date. OTP from noreply@heesara.lk - reply goes to support@heesara.lk.

Heesara.lk is a community membership platform for family-arranged marriage proposals. Not a dating site. No adult chat. Secure • Verified • විවාහ අපේක්ෂිතයන් සඳහා (18+ වයස) • No Guarantee of Marriage • PDPA Act No.9 of 2022 Compliant