Privacy Policy

Platform: Vows.lk (“Vows.lk”, “we”, “us”, or “our”) — online wedding matchmaking platform available at https://vows.lk and related applications (the “Service”).

This Privacy Policy explains how we collect, use, store, disclose, and protect your personal data when you use Vows.lk. By creating an account or using the Service, you acknowledge that you have read this Policy.

1. Who we are (Data Controller)

Vows.lk is the data controller (under GDPR) / controller (under the Sri Lanka PDPA) for personal data processed in connection with the Service.

Privacy requests: privacy@vows.lk

If you are in the EEA/UK and we appoint a representative or Data Protection Officer, those details will be published here.

2. Scope

This Policy applies to:

• Account registration and authentication
• Profiles, photos, preferences, and matchmaking
• In-app messaging and related features
• Support communications

It does not govern websites, apps, or services of third parties that you may interact with after matching (e.g. WhatsApp, Instagram, or offline meetings). Those are governed by their own terms and policies.

3. Personal data we collect

We collect only what is reasonably necessary to provide matchmaking and related Service features.

3.1 Account and authentication data

• Mobile phone number
• Password (stored in hashed/encrypted form; we do not store plaintext passwords)
• One-time passcodes (OTPs) sent for verification, login, or password reset
• Authentication session metadata (e.g. login timestamps, device/session identifiers)

3.2 Profile and matchmaking data

• Display / full name and basic profile details you submit
• Age, gender, location (as provided), relationship/marriage intent, and similar onboarding answers
• Match preferences, lifestyle tags, and questionnaire responses
• Profile photographs and avatar images you upload
• Matching outcomes (likes, matches, compatibility signals generated by the Service)

3.3 Communications data

• Messages you send or receive through the Service
• Support tickets or emails you send to us

3.4 Technical and usage data

• IP address, browser/device type, approximate location derived from IP (where applicable)
• Log data, crash diagnostics, and interaction events needed to operate, secure, and improve the Service
• Cookies or similar technologies (see Section 10)

3.5 Data we do not intentionally collect

We do not require national identity card numbers, bank account details, or biometric templates for standard matchmaking use, unless a future feature expressly asks and obtains separate consent.

Please do not upload sensitive documents, financial credentials, or third-party personal data without a lawful basis and that person’s knowledge.

4. Purposes and legal bases

Under Sri Lanka PDPA, we process personal data for specified, explicit, and legitimate purposes and do not further process it in a manner incompatible with those purposes.

5. How we use your data

We use personal data to:

1. Verify your phone number and authenticate your account
2. Create and display your profile for matchmaking
3. Suggest potential matches based on preferences and onboarding answers
4. Enable communication between users who match
5. Protect the Service against abuse, spam, and unauthorised access
6. Comply with applicable law and enforce our Terms & Conditions
7. Improve reliability, safety, and user experience

We do not sell your personal data to third parties.

We do not rent or trade user profiles, phone numbers, or photos for advertising brokerages or unrelated commercial lists.

6. Sharing and disclosures

We may share personal data only in these limited cases:

6.1 With other users (as part of the Service)

Your profile information, photos, and selected preferences may be visible to other users according to product design (e.g. discovery and matched chats). Do not include information you are not comfortable sharing with potential matches.

6.2 Service providers (processors)

We use trusted processors to host and operate the Service (for example: cloud database/auth providers, SMS/OTP delivery providers, analytics/infrastructure vendors). They process data only on our instructions and under confidentiality and security obligations.

6.3 Legal and safety disclosures

We may disclose data if required by law, court order, or competent authority, or where necessary to protect the rights, safety, or property of Vows.lk, our users, or the public.

6.4 Business transfers

If we undergo a merger, acquisition, or asset transfer, personal data may be transferred as part of that transaction, subject to continued protection consistent with this Policy.

We do not sell personal data.

7. International transfers

Your data may be processed on servers located outside Sri Lanka (for example, where our cloud providers operate). Where GDPR applies, we use appropriate safeguards (such as Standard Contractual Clauses or equivalent lawful transfer mechanisms). Where PDPA applies, we take steps consistent with applicable cross-border transfer rules and guidance from the Data Protection Authority of Sri Lanka.

8. Retention

We retain personal data only as long as needed for the purposes above:

• Active accounts: retained while your account remains open
• Deleted accounts: personal profile data, match records, photos, and messages associated with your account are deleted or irreversibly anonymised within a reasonable period after account deletion, except where we must retain limited records for legal, security, dispute, or fraud-prevention reasons
• Logs/security records: retained for a limited period appropriate to security and operational needs
• OTPs: retained only for the short period needed to verify authenticity, then discarded

When retention ends, we delete or anonymise data so it can no longer identify you.

9. Your rights

9.1 Rights under Sri Lanka PDPA

Subject to legal exceptions, you may have the right to:

• Access your personal data
• Request correction of inaccurate or incomplete data
• Request erasure (“right to be forgotten”) where applicable
• Withdraw consent where processing is based on consent
• Object to certain processing
• Lodge a complaint with the Data Protection Authority of Sri Lanka

9.2 Rights under GDPR (if applicable)

If GDPR applies to you, you may also have rights to:

• Access, rectification, erasure, restriction, and portability
• Object to processing based on legitimate interests
• Withdraw consent at any time (without affecting prior lawful processing)
• Lodge a complaint with your local supervisory authority

9.3 In-app account deletion

You may completely delete your account and associated personal data at any time inside the app. Account deletion is designed to permanently remove your profile, matches, messages, and related personal data from active systems, subject only to limited legal retention described in Section 8.

You can also contact privacy@vows.lk to exercise rights if you cannot complete a request in-app.

We may need to verify your identity (e.g. via your registered phone number) before fulfilling requests.

10. Cookies and similar technologies

We may use essential cookies/local storage for authentication and security, and limited analytics cookies to understand Service performance. You can control non-essential cookies through your browser settings where available. Disabling essential storage may break login or core features.

11. Security

We implement technical and organisational measures appropriate to the risk, including:

• Encrypted transit (HTTPS/TLS)
• Hashed password storage
• OTP-based verification for sensitive auth flows
• Access controls and monitoring on production systems
• Least-privilege access for staff/processors

No method of transmission or storage is 100% secure. You are responsible for keeping your password confidential and for securing devices used to access Vows.lk.

12. Children’s privacy

Vows.lk is intended for adults seeking marriage/matchmaking. You must be at least 18 years old to create an account. We do not knowingly collect personal data from children under 18. If you believe a minor has registered, contact us and we will delete the account promptly.

13. Automated decision-making

Match suggestions may use rules-based or algorithmic ranking of compatibility signals. These features are intended to help discovery and do not, by themselves, produce legal or similarly significant effects about you without human involvement outside the matchmaking context. You may update preferences or delete your account at any time.

14. Third-party links and offline conduct

After matching, users may choose to communicate or meet outside Vows.lk. We are not responsible for third-party platforms or for how users behave offline. See our Terms & Conditions for liability limitations.

15. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the “Last updated” date and, where appropriate, providing additional notice in the app or by SMS/email. Continued use after the effective date constitutes acknowledgment of the updated Policy.

16. Contact

• Privacy requests / data rights: privacy@vows.lk
• General support: support@vows.lk

Related: Terms & Conditions