Privacy Policy

This Privacy Policy explains what personal information Siyapath (the "Service"), operated by [Legal entity name] ("we", "us"), collects, why we collect it, and the choices you have. We handle personal data in line with the Personal Data Protection Act, No. 9 of 2022, of Sri Lanka.

1. Information we collect

Information you give us

• Name: your first name and surname.
• Mobile number: this is how you sign in, so it is required.
• Email address: optional, used for account recovery and updates.
• Password: stored only in a securely hashed form that we cannot read.
• Profile details: optionally, your school, date of birth and a profile photo.

Information collected automatically

• Security information: your IP address, browser type, sign-in times and failed sign-in attempts, used to protect your account.
• Cookies: a session cookie that keeps you signed in and a security (CSRF) cookie. We also remember your language and light or dark appearance choice. We do not use advertising cookies.

2. How we use your information

• to create and manage your account and let you sign in;
• to send SMS codes that verify your mobile number and reset your password, and emails that verify or change your email address;
• to show you lessons in your chosen language;
• to keep the Service and your account secure, for example by locking an account after repeated failed sign-ins;
• to answer your questions and improve the Service.

We do not sell your personal information, and we do not use it for advertising.

3. Who we share it with

We share personal information only with:

• Service providers who help us run the Service, such as our SMS provider [SMS provider name], email provider and hosting provider. They may use your information only to provide their service to us.
• Authorities, when the law requires us to.

4. Children

Many of our users are school students. If you are under 18, please use the Service with the permission of a parent or guardian. Parents or guardians can contact us at [contact email] to see, correct or delete their child's information.

5. How long we keep it

We keep your account information while your account is open. If you ask us to delete your account, we delete or anonymise your personal information within [number] days, except where the law requires us to keep it longer. SMS codes expire after a few minutes and are not kept.

6. How we protect it

We use encrypted connections (HTTPS), hash passwords, limit how many sign-in and code attempts can be made, and restrict staff access to personal data. No system is completely secure, but we work to protect your information.

7. Your rights

You can:

• see and update most of your details yourself in your profile settings;
• ask for a copy of the personal information we hold about you;
• ask us to correct or delete your information, or to close your account;
• withdraw your consent, although we may then be unable to provide the Service.

To make a request, contact us at [contact email].

8. Changes to this policy

We may update this Privacy Policy from time to time. We will show the date of the latest change at the top of this page and, for important changes, tell you when you next sign in.

9. Contact us

[Legal entity name]
[address]
[contact email]