Privacy Policy

01Overview

This Privacy Policy explains what personal information Ekathana collects, why we collect it, who we share it with, and the choices you have. It applies to ekathana.lk and every feature offered through it.

Ekathana is a two-sided marketplace: much of what you provide is deliberately public, because the point of a profile is to be found. This policy is explicit about which information is public, which is visible only to signed-in members, and which is never shown to anyone but you and our team.

It should be read together with our Terms & Conditions.

02Account information

When you create an account we collect your name, email address and, if you register with a password, a securely hashed version of that password. We never store your password in a readable form and cannot recover it — a forgotten password is reset, not retrieved.

If you sign in with Google, we receive only your name, email address and profile picture. We request no other permission, and we cannot see your Google contacts, calendar, files or anything else in your Google account.

We record your account type (member, Provider or Creator), verification status, and the dates your account and profiles were created and updated.

03Public profile information

If you publish a Provider or Creator profile, the following is public to anyone on the internet, signed in or not:

• display or business name, description and short bio;
• category and, for Creators, your niches;
• location, service areas, country and languages;
• contact phone number and website, where you provide them;
• links to your Instagram, TikTok, YouTube, Facebook and LinkedIn accounts;
• brands you have worked with, and your FAQ entries;
• cover image and gallery photographs;
• your review rating and the reviews left for you.

Package and rate details are shown only to signed-in members — visitors who are not logged in can see that pricing exists, but not what it says.

Aggregate counts such as profile views are visible to you in your own analytics. They are not attributed to individual visitors on your dashboard.

Anything you place on a public profile should be treated as published. Do not put a home address, identity document number or anything else you would not want indexed by a search engine into a profile field.

04Uploaded media

Photographs you upload — profile pictures, cover images and gallery images — are stored with our cloud object-storage provider and served from it.

Images may carry embedded metadata such as camera model, capture time and, occasionally, GPS coordinates. Please strip location metadata from photographs before uploading if you do not want it included.

Removing an image from your profile removes it from the platform and schedules the underlying file for deletion from storage.

05Stories

A story consists of an image, an optional caption, and the record of who viewed, liked or shared it.

Stories are visible for 24 hours. After that they stop being shown and the media file is permanently deleted from our storage by an automated sweep. The record that a story existed may persist briefly in backups before ageing out.

The profile that posted a story can see its view, like and share counts. If you reply to a story, your reply is delivered as an ordinary private message and — like any message — remains in that conversation after the story has expired.

06Messages

Messages you send through Ekathana are stored so conversations persist across your devices, along with delivery and read status, reactions and timestamps.

Messages are private between the participants. They are not published on profiles, do not appear in search, and are not used to build advertising profiles.

Our team does not read private conversations as a matter of course. We may access specific messages where it is necessary to investigate a report, respond to a safety concern, prevent fraud, or comply with a legal obligation.

07Reviews

A review records your rating, your written comment, the profile reviewed, and your display name and profile picture, which are shown publicly beside it.

Reviews cannot be left anonymously. Your name and picture are attached so that ratings mean something to the people reading them.

You may edit or delete your own review at any time. The profile owner can hide a review from their public page or delete it; hiding or deleting removes it from the public rating.

08Digital Business Cards

A Digital Business Card contains the details you choose to put on it — typically your name, role, photograph, phone number, email address, website, social links and a QR code pointing at your profile.

A published card is a public page at its own link, and is designed to be shared and exported as an image or PDF. Anyone with the link can view it, and any file you export leaves our control entirely. Only include contact details you are willing to circulate publicly.

09Payment information

Subscriptions, boosts and business cards are paid for by direct bank transfer, with the payment slip sent to us over WhatsApp and confirmed manually by our team.

Ekathana never collects, processes or stores card numbers, CVVs or online banking credentials. There is no card form on the platform and no stored payment method.

What we do keep is a record of each purchase: the plan, amount, duration, the profile it applied to, a reference number, and its confirmation status. Any payment slip you send reaches us through WhatsApp and is governed by WhatsApp's own privacy policy in transit.

10Information collected automatically

When you use Ekathana our servers record standard technical information: IP address, browser and device type, operating system, the pages requested, and the time of the request. This is used to keep the service running, diagnose faults, apply rate limits and detect abuse.

We count profile views to give profile owners their analytics. Counts are aggregated per profile — a profile owner sees how many times their page was viewed, not who viewed it.

We do not use Google Analytics, advertising pixels, or any third-party tracking or analytics service. There is no cross-site tracking on Ekathana and no advertising network receives your data.

11Cookies

Ekathana uses a single, strictly necessary cookie: a session cookie that keeps you signed in. It is `httpOnly`, meaning scripts in the browser cannot read it, and it lasts up to 30 days or until you sign out.

We use no advertising cookies, no tracking cookies and no third-party analytics cookies, which is why you are not asked to accept a cookie banner.

Some of your preferences — such as which stories you have already seen — are stored locally in your own browser rather than sent to us. Clearing your browser storage clears them.

Blocking the session cookie will prevent you from signing in, since it is what keeps you logged in.

12Authentication and email verification

Passwords are hashed with bcrypt before storage. Password reset and email verification use single-use, time-limited tokens sent to your email address.

Signing in with Google is handled through Google's OAuth flow: you authenticate with Google, and Google returns your name, email address and profile picture to us. Your Google password is never seen by, or shared with, Ekathana.

We keep a record of active sessions so that signing out works and so unusual access can be investigated.

13Social media links

The Instagram, TikTok, YouTube, Facebook and LinkedIn links on a profile are plain links you type in yourself. Ekathana does not connect to those accounts, does not log in to them, does not read your posts or followers, and does not import any data from them.

When a visitor follows one of those links they leave Ekathana, and the destination platform's own privacy policy applies from that point. The same is true of the WhatsApp click-to-chat links used for enquiries and payment slips.

14Email communications

We send service emails you cannot opt out of while you hold an account, because they are part of the service: email verification, password resets, profile approval decisions, payment confirmations, subscription expiry reminders and important account notices.

Email is delivered through a third-party email provider, which processes your email address and the message content solely in order to deliver it on our behalf.

Any promotional email we send will offer a way to opt out. We do not sell or rent your email address.

15How we use your information

We use personal information only for the purposes below. We do not use it to build advertising profiles, and we do not sell it.

• Running your account — signing you in, verifying your email, resetting passwords and keeping sessions working.
• Publishing your profile — showing it in search, category listings, the featured section and link previews, and reviewing it before it goes live.
• Connecting members — delivering messages, story replies and enquiry notifications.
• Reviews and ratings — attributing reviews and calculating each profile's average.
• Paid features — recording subscriptions, boosts and business card purchases, confirming payment slips and reminding you before a subscription expires.
• Analytics for profile owners — counting views so you can see how a profile is performing.
• Safety and integrity — investigating reports, detecting fraud and abuse, enforcing our Terms & Conditions and applying rate limits.
• Service communication — sending the account emails described above.
• Legal compliance — meeting obligations under Sri Lankan law and responding to lawful requests.

16Who we share information with

We do not sell your personal information, and we do not share it with advertisers.

We share information only with service providers who help us run the platform, and only as far as they need it to do so:

• Cloud hosting and database — to run the application and store your account, profile and message data;
• Object storage — to hold and serve uploaded images and story media;
• Email delivery — to send verification, notification and account emails;
• Google — only when you choose to sign in with Google.

We may also disclose information where we are required to by law, a court order or a lawful request from an authority in Sri Lanka; where it is necessary to investigate fraud, abuse or a threat to someone's safety; or to establish or defend a legal claim.

If Ekathana is ever involved in a merger, acquisition or transfer of assets, we will give notice before your information becomes subject to a different privacy policy.

17Data retention

We keep information for as long as your account is open and for as long afterwards as we need it for the purpose it was collected, or as the law requires.

• Story media — deleted automatically 24 hours after posting.
• Deleted images — removed from the platform immediately and from storage shortly afterwards.
• Profiles you delete — removed from public view immediately; associated files are cleaned up with them.
• Paused profiles — retained, not deleted, so they can be restored when a subscription is renewed.
• Messages — kept for as long as the conversation exists for either participant.
• Payment records — kept for as long as needed for accounting and tax purposes.

Residual copies may persist briefly in encrypted backups after deletion, and age out on the ordinary backup cycle.

18Your rights

You can access and correct most of your information yourself: account details, profile fields, images, packages, FAQs and social links are all editable from your dashboard at any time.

You may also ask us to provide a copy of the personal information we hold about you, correct information you cannot edit yourself, delete your account and associated data, or restrict how we use your information — subject to any legal obligation we have to retain it.

To make a request, email hello@ekathana.lk from the address on your account. We may ask you to confirm your identity before acting, and we aim to respond within 30 days.

Some information cannot be removed on request where doing so would be misleading — a review you wrote, for example, may be anonymised rather than deleted, so the profile's rating history remains honest.

19Account deletion

You can delete individual profiles yourself from your dashboard. Deleting a profile removes it from public view and search, and its images are removed from storage.

To close your account entirely, email hello@ekathana.lk from your registered address. We will delete your account, profiles and uploaded media.

Some records survive account closure where we are required to keep them or where deletion would harm others: payment and tax records for the statutory period, records relating to a fraud or safety investigation, and messages that remain visible to the other participant in a conversation.

20Children's privacy

Ekathana is intended for adults. You must be at least 18 to hold an account, and the platform is not directed at children.

We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete the account and its data promptly.

If you believe a child has provided us with personal information, contact hello@ekathana.lk and we will act on it.

21Security

We protect your information with measures appropriate to a platform of this kind: encrypted connections (HTTPS) throughout, bcrypt password hashing, httpOnly session cookies, request rate limiting on sensitive endpoints, protection against database injection, restricted administrative access, and server-side checks so that a client cannot see data it is not entitled to.

No system is perfectly secure. You play a part too: use a strong, unique password, keep it to yourself, and sign out on shared devices.

If we become aware of a breach affecting your personal information, we will notify affected users and the relevant authorities as the law requires.

22Changes to this policy

We update this policy when the platform changes or the law requires it. The date at the top of this page always reflects the most recent revision.

Where a change materially affects how we handle your information we will give notice by email or through the platform before it takes effect.

23Contact us

Questions about this policy, requests about your information, and privacy concerns should go to hello@ekathana.lk.

You can also reach us through the contact page. We are based in Colombo, Sri Lanka.