Privacy Policy

Platform: Vows.lk (“Vows.lk”, “we”, “us”, or “our”) — a Sri Lankan matrimonial matchmaking platform available at https://vows.lk and related applications (the “Service”).

This Privacy Policy explains how we collect, use, store, disclose, and protect your personal data when you use Vows.lk. It is designed to align with the Sri Lanka Personal Data Protection Act, No. 9 of 2022 (PDPA) and, where applicable, international standards including the EU/UK GDPR. By creating an account or using the Service, you acknowledge that you have read this Policy.

1. Who we are (Data Controller)

Vows.lk / Nimera Solutions is the data controller (under GDPR) / controller (under the Sri Lanka PDPA) for personal data processed in connection with the Service.

Privacy and data-rights requests: info@vows.lk

If you are in the EEA/UK and we appoint a representative or Data Protection Officer, those details will be published here.

2. Scope

This Policy applies to:

• Account registration and authentication
• Profiles, photos, matrimonial preferences, and matchmaking
• In-app messaging and the mutual contact-reveal workflow
• Support communications

It does not govern websites, apps, or services of third parties that you may interact with after matching (e.g. WhatsApp, Instagram, or offline family meetings). Those are governed by their own terms and policies.

3. Personal data we collect

We collect only what is reasonably necessary to provide matrimonial matchmaking and related Service features, consistent with the PDPA principles of purpose limitation and data minimisation.

3.1 Account and authentication data

• Mobile phone number
• Password (stored in hashed/encrypted form; we do not store plaintext passwords)
• One-time passcodes (OTPs) sent for verification, login, or password reset
• Authentication session metadata (e.g. login timestamps, device/session identifiers)

3.2 Profile and matrimonial matchmaking data

• Display / full name and basic profile details you submit
• Age, gender, location (as provided), marriage intent / life-partner intent, and similar onboarding answers
• Matrimonial preferences, lifestyle tags, and questionnaire responses
• Profile photographs and avatar images you upload
• Matching outcomes (likes, matches, compatibility signals generated by the Service)

3.3 Communications data

• Messages you send or receive through the Service
• Contact-reveal requests and mutual consent records (so we can operate the privacy-first reveal workflow)
• Support tickets or emails you send to us

3.4 Technical and usage data

• IP address, browser/device type, approximate location derived from IP (where applicable)
• Log data, crash diagnostics, and interaction events needed to operate, secure, and improve the Service
• Cookies or similar technologies (see Section 10)

3.5 Data we do not intentionally collect

We do not require national identity card numbers, bank account details, or biometric templates for standard matrimonial matchmaking use, unless a future feature expressly asks and obtains separate consent.

Please do not upload sensitive documents, financial credentials, or third-party personal data without a lawful basis and that person’s knowledge.

4. Purposes and legal bases

Under the Sri Lanka PDPA, we process personal data for specified, explicit, and legitimate purposes (matrimonial matchmaking, account security, and Service operation) and do not further process it in a manner incompatible with those purposes.

5. How we use your data

We use personal data to:

1. Verify your phone number and authenticate your account
2. Create and display your profile for matrimonial matchmaking
3. Suggest potential life partners based on matrimonial preferences and onboarding answers
4. Enable communication between members who match
5. Operate the mutual contact-reveal workflow so private numbers are not shown publicly
6. Protect the Service against abuse, spam, and unauthorised access
7. Comply with applicable law (including the PDPA) and enforce our Terms & Conditions
8. Improve reliability, safety, and member experience

We do not sell your personal data to third parties.

We do not rent or trade member profiles, phone numbers, or photos for advertising brokerages or unrelated commercial lists.

6. Sharing and disclosures

We may share personal data only in these limited cases:

6.1 With other members (as part of the Service)

Your public profile information, photos, and selected matrimonial preferences may be visible to other members according to product design (e.g. discovery and matched chats). Your phone number and other private contact details are not shown on your public profile. They are revealed only if both members consent through the matrimonial connection / contact-reveal workflow.

Do not include information on your public profile that you are not comfortable sharing with potential life-partner matches.

6.2 Service providers (processors)

We use trusted processors to host and operate the Service (for example: cloud database/auth providers, SMS/OTP delivery providers, payment processors such as PayHere, and analytics/infrastructure vendors). They process data only on our instructions and under confidentiality and security obligations.

6.3 Legal and safety disclosures

We may disclose data if required by law, court order, or competent authority, or where necessary to protect the rights, safety, or property of Vows.lk, our members, or the public.

6.4 Business transfers

If we undergo a merger, acquisition, or asset transfer, personal data may be transferred as part of that transaction, subject to continued protection consistent with this Policy.

We do not sell personal data.

7. International transfers

Your data may be processed on servers located outside Sri Lanka (for example, where our cloud providers operate). Where GDPR applies, we use appropriate safeguards (such as Standard Contractual Clauses or equivalent lawful transfer mechanisms). Where the PDPA applies, we take steps consistent with applicable cross-border transfer rules and guidance from the Data Protection Authority of Sri Lanka.

8. Retention

We retain personal data only as long as needed for the purposes above:

• Active accounts: retained while your account remains open
• Deleted accounts: personal profile data, match records, photos, and messages associated with your account are deleted or irreversibly anonymised within a reasonable period after account deletion, except where we must retain limited records for legal, security, dispute, or fraud-prevention reasons
• Logs/security records: retained for a limited period appropriate to security and operational needs
• OTPs: retained only for the short period needed to verify authenticity, then discarded

When retention ends, we delete or anonymise data so it can no longer identify you.

9. Your rights

9.1 Rights under Sri Lanka PDPA

Subject to legal exceptions, you may have the right to:

• Access your personal data
• Request correction of inaccurate or incomplete data
• Request erasure (“right to be forgotten”) where applicable
• Withdraw consent where processing is based on consent
• Object to certain processing
• Lodge a complaint with the Data Protection Authority of Sri Lanka

9.2 Rights under GDPR (if applicable)

If GDPR applies to you, you may also have rights to:

• Access, rectification, erasure, restriction, and portability
• Object to processing based on legitimate interests
• Withdraw consent at any time (without affecting prior lawful processing)
• Lodge a complaint with your local supervisory authority

9.3 In-app account deletion

You may completely delete your account and associated personal data at any time inside the app. Account deletion is designed to permanently remove your profile, matches, messages, and related personal data from active systems, subject only to limited legal retention described in Section 8.

You can also contact info@vows.lk to exercise rights if you cannot complete a request in-app.

We may need to verify your identity (e.g. via your registered phone number) before fulfilling requests.

10. Cookies and similar technologies

We may use essential cookies/local storage for authentication and security, and limited analytics cookies to understand Service performance. You can control non-essential cookies through your browser settings where available. Disabling essential storage may break login or core features.

11. Security

We implement technical and organisational measures appropriate to the risk, including:

• Encrypted transit (HTTPS/TLS)
• Hashed password storage
• OTP-based verification for sensitive auth flows
• Access controls and monitoring on production systems
• Least-privilege access for staff/processors

No method of transmission or storage is 100% secure. You are responsible for keeping your password confidential and for securing devices used to access Vows.lk.

12. Children’s privacy

Vows.lk is intended for adults seeking a life partner through matrimonial matchmaking. You must be at least 18 years old to create an account. We do not knowingly collect personal data from children under 18. If you believe a minor has registered, contact us and we will delete the account promptly.

13. Automated decision-making

Life-partner suggestions may use rules-based or algorithmic ranking of compatibility signals. These features are intended to help matrimonial discovery and do not, by themselves, produce legal or similarly significant effects about you without human involvement outside the matchmaking context. You may update preferences or delete your account at any time.

14. Third-party links and offline conduct

After matching, members may choose to communicate or meet families outside Vows.lk. We are not responsible for third-party platforms or for how members behave offline. See our Terms & Conditions for liability limitations.

15. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the “Last updated” date and, where appropriate, providing additional notice in the app or by SMS/email. Continued use after the effective date constitutes acknowledgment of the updated Policy.

16. Contact

The primary official point of contact for privacy, data-rights, and general enquiries is:

• Email: info@vows.lk
• Operated by: Nimera Solutions

Related: Terms & Conditions