Privacy Policy

This policy explains what personal information Asaliya Books collects when you use asaliyabooks.lk, why we collect it, who else sees it, and what you can ask us to do with it. It describes what this website actually does, not what a template says a website might do.

Who this policy covers

Asaliya Books runs the online bookshop at asaliyabooks.lk. When you browse the site, create an account or place an order, we decide what happens to the information you give us, and this policy is our account of that.

If anything here is unclear, or you want a copy of your information, a correction, or your account deleted, write to info@asaliyabooks.lk and a person will answer you.

What we collect

We collect what the shop needs in order to work, and stop there. All of it is information you give us yourself, except the security records at the end of this list.

Your account: Your first and last name, your email address, and a password. You may also add a username, a phone number, and whether you prefer English or Sinhala. Your password is stored only as a bcrypt hash, so we cannot read it — and neither could anyone who got hold of a copy of our database.
Signing in with Google: If you choose Continue with Google, Google tells us your name, your email address, and whether it has verified that address. We keep a Google account identifier so we recognise you next time. We never see your Google password, and we do not read your Gmail, contacts, calendar or files.
Delivery addresses: The name, phone number (a second one if you give it), street address, city, district and postal code for wherever you want books sent. You can save several, edit them, and delete them from your account whenever you like.
Your orders: What you bought and what it cost, how you chose to pay, the delivery address as it stood at the time of the order, any note you added, and the record of the order moving from placed to delivered — including the courier and tracking number once it ships.
Bank transfer receipts: If you pay by bank transfer, the deposit slip you upload: the image or PDF itself, its filename, and any reference number or note you send with it. A slip usually carries your own name and bank details, which is why we store these the way described further down.
Messages you send us: The name, email address, subject and message you type into the contact form. That message is emailed to the shop so we can reply to it; it is not saved in the website's database.
Your cart and wishlist: The books you have added. Your cart is kept in your own browser and is copied to our server only once you are signed in, so an unsigned-in cart never leaves your device. Your wishlist is saved to your account.
Buying in the shop: If you buy from us over the counter rather than online, we may record your name and phone number against the sale so the receipt can be found again later.
Records that protect accounts: When anyone tries to sign in, register, or send us a message, we record the email address used and the internet (IP) address it came from. These exist only to stop password guessing and spam, and they are deleted automatically after 24 hours.

What we do not collect

This list is short at most shops. Ours is short and true:

We run no analytics. There is no Google Analytics, no Meta pixel, and no other tracking script anywhere on this site.
We show no advertising, and we build no advertising profile of you.
We do not sell, rent or trade your information to anyone, at any price.
We never ask for or store card details. You pay cash on delivery, or by a bank transfer you make yourself.
The fonts on this site are served from our own servers rather than from a font network, so opening a page does not quietly announce your visit to anyone. Book cover images come from our own storage at Supabase, named below.

Cookies

We use only the cookies the site needs in order to work. There is no cookie banner because there is nothing here for you to refuse.

A sign-in cookie, set when you sign in, so you stay signed in as you move between pages. It goes when you sign out.
Security cookies used during sign-in, so we can tell that the form coming back to us is the one we sent you.
A language cookie, remembering whether you chose English or Sinhala.

Your shopping cart is not a cookie. It is held in your browser's own local storage under the name asaliya-cart, and clearing your browsing data clears it.

What we use it for

Every use below is one you would expect from a bookshop:

Taking, packing and delivering your order, and telling you where it has got to.
Checking a bank transfer against the order it belongs to before we dispatch it.
Answering you when you write to us.
Keeping your account yours — verifying sign-ins, and blocking repeated guessing at passwords.
Keeping the accounting and tax records a business is obliged to keep.

We do not use your information to make automated decisions about you, and we do not profile you.

How long we keep it

We keep your account for as long as you have one. Orders and the bank transfer receipts attached to them are kept for as long as we need them to run the shop, deal with returns and complaints, and meet the accounting and tax obligations a business in Sri Lanka has to meet.

Some things go sooner, automatically: a sign-in code emailed to you is destroyed the moment it is used, and the records that block password guessing and spam are deleted after 24 hours.

Ask us to delete your account and we will, keeping only what we are genuinely required to keep in the order records themselves.

What you can ask us to do

It is your information. You can ask us to:

Tell you what we hold about you, and give you a copy of it.
Correct anything that is wrong.
Delete your account and the data attached to it.
Stop sending you anything other than the messages an order actually requires.

Some of this you can do yourself, right now: your name, phone number and language are editable in your account, and you can add, change or delete delivery addresses there too. For the rest, write to info@asaliyabooks.lk and we will reply.

Sri Lanka's Personal Data Protection Act No. 9 of 2022 gives you rights over your personal data. This policy is how we intend to honour them. If you think we have got something wrong, tell us first — we would far rather fix it than have you take it further.

How we protect it

Passwords are stored as bcrypt hashes, never as text anyone here could read.
Bank transfer receipts are kept in private storage and never given a public link. Each time one is opened we check that the person asking either owns that order or works here, and only then issue a link that expires within minutes.
Repeated failed sign-ins are blocked — both for the account being targeted and for the connection doing the targeting.
The site is served over HTTPS, so what you send us is encrypted on the way.
Only staff accounts can reach the admin area, and only a senior administrator can create another staff account.

No website can honestly promise perfect security, and we will not pretend otherwise. If something ever went wrong with your data, we would tell you rather than hope you did not notice.

Children

This shop is meant for adults, and we do not knowingly collect information from children. If a child wants a book, a parent or guardian should place the order. If you believe a child has given us their details, write to us and we will remove them.

Changes to this policy

If we change how this site handles your information, we will change this page and update the date at the top. If a change is significant, we will say so plainly rather than leave you to spot it.

Contact us

Questions about this policy, or a request about your own data, go to the same place as everything else:

Email: info@asaliyabooks.lk
Phone: 077 177 5298
WhatsApp: 076 4606720
Address: Athurugiriya