RideMate Privacy Policy

1. Who we are

[COMPANY_LEGAL_NAME] ("we", "us"), [REGISTERED_ADDRESS], Sri Lanka, is the controller of personal data processed through the RideMate app and website. We handle personal data in line with the Personal Data Protection Act, No. 9 of 2022, as amended, and other applicable Sri Lankan law. Data protection contact: [DPO_NAME_OR_TEAM], [PRIVACY_EMAIL].

2. Data we collect

• Waitlist (website): email, optional mobile number, phone type, optional number of vehicles, your consent and the time you gave it.

• Account: mobile number (verified by one-time code), name, account and session identifiers.

• Family: family name, members, roles, invitations, the access each member has been given, and when access was granted, revoked or expires.

• Vehicles: type, registration number, display name, make, model, year, photo, odometer readings and who entered them, notes and responsible person.

• Vehicle documents: images and PDFs you upload (original and cropped versions), document category, document number, issue, start and expiry dates, upload history and version status.

• Driving licence: front and back images, licence number, holder name, expiry date and previous versions. A licence image may also show your photo, date of birth, address, blood group and vehicle classes. This data is stored separately from family data and is visible only to you.

• Service records: dates, descriptions, odometer, amounts in LKR, workshop names, notes, receipts and photos.

• Device and usage: push-notification token, device type, operating system and app version, notification delivery records, crash and diagnostic logs, and basic usage events. We do not include document content, licence numbers or private file links in analytics.

• Communications: messages you send to support.

• Permissions: we ask for camera, photo library and notification access only when you use the related feature. You can turn them off in your phone settings.

We do not collect your precise location or contacts.

3. How and why we use it

• To create and secure your account and verify your number — needed to provide the Service.

• To store your documents, records and family sharing settings, and to show them only to people you or your family owner have authorised — needed to provide the Service.

• To read uploaded documents automatically and suggest numbers and dates — needed to provide the Service. These are suggestions only; nothing affects your reminders until you confirm it. We make no decisions about you that have legal or similarly significant effects based solely on automated processing.

• To send expiry, maintenance and account notifications — needed to provide the Service.

• To send launch news and product updates — only with your consent, which you can withdraw at any time using the unsubscribe link or by contacting us.

• To keep the Service secure, prevent abuse, fix errors and improve features — our legitimate interests, balanced against your rights.

• To meet legal obligations and respond to lawful requests from authorities.

• If a paid plan is introduced: to process payments and keep billing records — needed for the contract and to meet tax and accounting law.

4. Who can see your data

• Your family: only the vehicles, document categories, history and costs the family owner chooses to share, and only while access is active. Your driving licence is never shared.

• Service providers that process data on our behalf under contract and our instructions, including: our software development and maintenance partner, Cogntix (cogntix.com), which builds and supports the Service and may access data only as needed to maintain, troubleshoot and secure it; cloud hosting and file storage ([HOSTING_PROVIDER, e.g. Amazon Web Services], Mumbai region), database hosting ([DATABASE_PROVIDER, e.g. MongoDB Atlas], Mumbai region), SMS one-time codes ([SMS_PROVIDER]), push notifications (Google Firebase Cloud Messaging and Apple Push Notification service), document text recognition ([OCR_AI_PROVIDER]), email ([EMAIL_PROVIDER]) and, in future, payments ([PAYMENT_PROVIDER]).

• Authorities when required by Sri Lankan law or a valid legal order.

• A buyer or successor if our business is reorganised or sold, under the same protections.

We do not sell your personal data and do not share it for third-party advertising.

5. Transfers outside Sri Lanka

Our servers, database and file storage are hosted in Mumbai, India. Some other providers (such as push-notification, SMS or text-recognition services) may also process data outside Sri Lanka. Where we transfer personal data abroad, we do so only as permitted by the Personal Data Protection Act and use safeguards such as contractual protections, encryption and access controls.

6. How we protect it

Encrypted connections, encrypted storage, short-lived private links to files, permission checks on every request, separation of driving-licence storage from family data, access logs and audit trails, and limited staff access. Notifications on your lock screen do not show document contents or numbers. No system is completely secure; if a personal data breach affects you, we will notify you and the Data Protection Authority as the law requires.

7. How long we keep it

• Account, vehicle, document and service data: while your account or the family is active.

• Replaced document versions: kept as history until you or the family owner delete them or the account/family is deleted.

• After account deletion: removed or anonymised within [30] days, except backups, which are overwritten within [90] days, and records we must keep by law (for example billing records).

• Waitlist data: until launch plus [12] months, or until you unsubscribe, whichever is sooner.

• Security and audit logs: up to [12] months.

8. Your rights

Subject to the Personal Data Protection Act, you can ask us to: give you access to your personal data; correct or complete it; erase it; withdraw consent you gave (without affecting earlier processing); and object to or restrict certain processing. You can also ask for a review of a decision made solely by automated processing. Send requests to [PRIVACY_EMAIL]; we may need to verify your identity and will respond within the time the law allows. If you are not satisfied, you may complain to the Data Protection Authority of Sri Lanka (www.dpa.gov.lk).

9. Children

The Service is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

10. Delete your account

• In the app: Profile → Account settings → Delete account. Confirm with a one-time code.

• If you own a family: first transfer ownership to an existing member who accepts, or delete the family. Deleting a family removes its vehicles, documents and history for all members.

• What is deleted: your account, your driving licence and its versions, and your personal settings.

• What may remain: vehicle records and documents you added to a family that someone else owns stay with that family, showing that they were added by a former member.

• Without the app: email [PRIVACY_EMAIL] from the address linked to you, or write to us with your registered mobile number. To leave the waitlist, use the unsubscribe link or email us.

11. Changes to this policy

We will post updates here and notify you in the app or by email/SMS before material changes take effect.

12. Contact

Cogntix (Pvt) Ltd,80 Nallur Cross, Jaffna 40000, Sri Lanka . Email: hai@getridemate.life.