Privacy Policy

1. Introduction

Let's Ride ("we," "our," or "us") operates the LetsRide platform (website and mobile application) — a transparent bidding marketplace connecting tourists visiting Sri Lanka with verified vehicle owners. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our services.

2. Information We Collect

2.1 Information You Provide

• Account Registration: Name, email address, phone number, password, profile photo, and user role (tourist, vehicle owner, hotel/travel agent).
• Vehicle Owner Verification: National Identity Card (NIC) number, vehicle registration details, vehicle photographs (2–5 images), and driver's license information for identity verification purposes.
• Trip Information: Pickup/drop-off locations, travel dates, passenger count, vehicle preferences, and special requirements you include in trip requests.
• Communications: Messages sent through our in-app chat system between tourists and vehicle owners, and any support correspondence.
• Feedback & Reviews: Ratings and comments you provide about services received.

2.2 Information Collected Automatically

• Device Information: Device type, operating system, browser type, device identifiers for push notification delivery.
• Usage Data: Pages visited, features used, timestamps, and interaction patterns to improve our platform.
• Location Data: Approximate location when you use location-based features (e.g., selecting pickup points on the map), only with your explicit permission.
• Cookies & Similar Technologies: As described in our Cookie Policy.

2.3 Information from Third Parties

• Google Maps/Places API: Location and routing data when you select trip destinations.
• Firebase Cloud Messaging: Push notification tokens for real-time alerts delivery.

3. How We Use Your Information

We use your information exclusively for the following purposes:

• Service Delivery: Facilitating the trip posting, bidding, acceptance, and communication workflow.
• Identity Verification: Verifying vehicle owner credentials to maintain marketplace trust and safety.
• Communication: Sending trip updates, bid notifications, booking confirmations via email, push notifications, and in-app alerts.
• Platform Improvement: Analyzing usage patterns to improve features, fix bugs, and enhance user experience.
• Safety & Security: Detecting fraud, preventing abuse, and protecting users from malicious activity.
• Legal Compliance: Fulfilling legal obligations under Sri Lankan law and responding to lawful requests.

4. Information Sharing & Disclosure

• Between Platform Users: When a tourist accepts a bid, limited contact information is shared between the tourist and vehicle owner to facilitate the trip (name, phone number, vehicle details).
• Hotels & Travel Agents: When a partner posts a trip on behalf of their guest, the vehicle owner sees the partner's business profile — not the guest's personal details.
• Service Providers: We use trusted third-party services (hosting, email delivery, push notifications) who process data on our behalf under strict contractual obligations.
• Legal Requirements: We may disclose information if required by law, court order, or to protect the safety of our users.

5. Data Retention

• Active Accounts: We retain your data for as long as your account is active and as needed to provide services.
• Account Deletion: Upon account deletion request, we initiate a 30-day grace period during which you can reactivate by logging in. After the grace period, all personal data is permanently anonymized (names replaced, emails hashed, photos removed).
• Transaction Records: Anonymized trip and bid records may be retained for business analytics and legal compliance.
• Legal Holds: Data may be retained longer if required by law or ongoing disputes.

6. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update or correct inaccurate information via your profile settings.
• Deletion: Request deletion of your account and associated data (subject to our 30-day grace period and anonymization process).
• Data Portability: Request your data in a structured, machine-readable format.
• Withdraw Consent: Opt out of non-essential communications at any time via notification settings.

7. Data Security

We implement industry-standard security measures to protect your information:

• HTTPS/TLS encryption for all data in transit
• Bcrypt password hashing — we never store plain-text passwords
• Token-based authentication (Laravel Sanctum) with automatic expiration
• Role-based access controls limiting data access to authorized personnel
• Regular security audits and vulnerability assessments

8. Children's Privacy

LetsRide is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we discover that a child's data has been collected, we will promptly delete it.

9. International Data Transfers

Our servers are located in regions optimized for Sri Lankan users. If your data is transferred outside Sri Lanka for processing (e.g., email delivery services), we ensure adequate data protection measures are in place through contractual safeguards.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. Your continued use of LetsRide after changes constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related questions, data access requests, or concerns, please contact us:

• Email:support@letsride.lk
• Platform: In-app support chat (available from your profile settings)

12. Governing Law

This Privacy Policy is governed by the laws of the Democratic Socialist Republic of Sri Lanka. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the courts of Sri Lanka.