Privacy Policy

Openlet, the operator of openlet.lk, is the controller of the personal data described here. We handle it in line with Sri Lanka's Personal Data Protection Act No. 9 of 2022. For anything in this policy, or to exercise a right under it, write to [email protected].

• Account details — your name, email address, and optionally a phone number, WhatsApp number, profile photo and bio.
• Sign-in with Google — if you choose it, Google tells us your name, email address and profile picture. It does not tell us anything else about your Google account, and we never receive your Google password.
• Short-lived security tokens — the six-digit codes we email to confirm an address or a sign-in, and password-reset links. Only a one-way hash of each is stored, so a copy of our database does not yield a usable code, and each expires within 30 minutes.
• Listing content — everything you enter about a property, including its address, coordinates, price, photographs and floor plans.
• Marketplace activity — saved properties, saved searches, enquiries you send or receive, and notification preferences.
• Payment records — the amount, currency, purpose and status of any paid placement. Card and bank details are handled entirely by PayHere or Stripe and never reach our servers.
• Technical data — IP address, browser and device type, and timestamps of requests, recorded in server logs for security and abuse prevention.

We do not ask for, and ask that you do not upload, national identity card numbers, passport details, bank statements, or title deeds. If you send us one in an enquiry, we delete it.

• To run the marketplace — publishing your listings, delivering enquiries to the right lister, and showing you your saved items. This is necessary to perform our agreement with you.
• To send alerts you asked for, such as saved-search emails and price-drop notifications. You can turn each of these off in your settings at any time.
• To prevent fraud, abuse and spam, and to keep the site secure — including rate limiting, moderation, and investigating reported listings. This is our legitimate interest in a marketplace people can trust.
• To meet legal obligations, such as retaining payment records for tax purposes.

We do not use your data to make automated decisions with a legal effect on you.

• When you send an enquiry, the lister receives your name, your message, and the contact details you chose to include. This is the whole point of an enquiry, and it cannot be undone once sent.
• When you publish a listing, everything in it — including the contact details you attach and the map pin — is public and visible to anyone, including search engines.
• Service providers that operate parts of the site on our behalf: our hosting and database provider, object storage for images, Google Maps for maps and address lookup, Google Sign-In if you use it, Resend for sending the emails described above, and PayHere and Stripe for payments. Each receives only what it needs.
• Our analytics provider, Clicky, which records visits in aggregate — pages viewed, referrer, approximate country, browser. It is not linked to your account, is not used to build a profile of you, and is not shared with advertisers.
• Law enforcement or regulators, where we are legally required to disclose, or where it is necessary to investigate fraud or a threat to someone's safety.

We do not sell personal data, and we do not share it with advertising networks.

Our database and image storage are hosted with providers whose data centres may be outside Sri Lanka. Where data leaves the country we rely on the provider's contractual data-protection commitments to keep the standard of protection equivalent to that required under the PDPA.

• Account data — for as long as your account is open. Closing it starts a 30-day grace period, after which the account and its listings are permanently deleted.
• Listings — until you remove them, or 30 days after they expire.
• Enquiries — retained by the lister who received them; we hold our copy for 24 months.
• Payment records — 7 years, as required for tax and accounting.
• Server and security logs — 90 days.
• Photographs you uploaded but never attached to a listing — deleted automatically within 24 hours.
• Email confirmation codes and password-reset links — until used, or 30 minutes, whichever comes first.

Photographs upload straight from your browser to our image storage; the file never passes through our application servers. We re-encode every image on receipt, which discards the EXIF metadata cameras attach — including the GPS coordinates of where the photo was taken. The only location published with a listing is the map pin you set yourself.

Once a photograph is attached to a published listing it is public, and anyone may have copied or cached it. Removing the listing removes it from Openlet; it cannot remove copies already taken elsewhere.

Under the PDPA you may ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate — most of it you can edit yourself in your dashboard;
• delete your account and data, subject to records we must keep by law;
• stop sending you alerts and marketing, which you can also do yourself in settings;
• restrict or object to a particular use of your data.

Email [email protected] and we will respond within 21 days. If you are unhappy with our response you may complain to Sri Lanka's Data Protection Authority.

Passwords are stored hashed with bcrypt and are never recoverable in plain text. Traffic is encrypted in transit with TLS. Sign-in attempts, enquiries and uploads are rate limited, and sessions can be revoked across every device from your security settings. No system is perfect: if a breach affects you we will notify you and the Data Protection Authority as the PDPA requires.

Openlet is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has created an account, tell us and we will remove it.

Cookies and similar storage are covered separately in the Cookie Policy.

We will post any change here and update the date above. If a change materially affects how we use your data we will tell you before it takes effect.