Privacy Policy
Sarasavi Piyasa is committed to protecting the confidentiality, personal dignity, and statutory privacy rights of every registered member in strict accordance with the Sri Lanka Personal Data Protection Act (PDPA No. 9 of 2022).
🛡️ The 4 Pillars of Sarasavi Piyasa Privacy Shield
AI Privacy Avatar
Smart AI generates an artistic cartoon avatar matching your style and features, masking your facial identity from public viewing while your real photo remains locked.
Real Names Never Public
Public profiles only display masked names (e.g. Kxxxx B.). Your full legal name is strictly disclosed only upon mutual interest acceptance.
No Name Search
Direct name queries are strictly disabled. Friends, colleagues, or relatives cannot look up your proposal by typing your name.
Private Contact Exchange
Phone numbers and WhatsApp links are strictly hidden from visitors and only exchanged when both sides explicitly accept an Interest Request.
1. Who We Are & Data Controller
This Privacy Policy governs the collection, processing, and protection of personal data by Sarasavi Piyasa across our web portal (https://sarasavipiyasa.lk) and mobile applications. The data controller responsible for your personal data under the Sri Lanka Personal Data Protection Act No. 9 of 2022 (PDPA) is:
NEXVERA CREATIONS (PVT) LTD, a private limited company duly incorporated in the Democratic Socialist Republic of Sri Lanka under Company Registration No. PV 00365696, with registered headquarters in Colombo, Sri Lanka.
We have appointed a designated Data Protection Officer (Data Protection Officer) responsible for overseeing compliance with the PDPA. You may contact our DPO at info@sarasavipiyasa.lk or by telephone at 076 314 8245.
2. Personal Data We Collect
To provide a genuine, trusted matrimonial platform tailored for university graduates and qualified professionals, we collect and process the following categories of personal data:
A. Account & Identification Data
- Account Credentials: Full legal name, verified mobile telephone number, verified email address, and cryptographically hashed password.
- Profile Demographics: Biological gender/profile type, date of birth, age, height (and height in cm), body weight, skin colour, current country of residence, district/region, city/location, and civil status.
- Academic & Professional Credentials: Educational category (Government University, Private Institution, Nursing Training School [NTS], National College of Education [Vidya Peeta]), institution name, faculty, degree program, enrollment and graduation year, profession, and monthly income bracket.
- Narratives & Preferences: Personal statement ('About Me'), partner expectations and structured partner preferences ('PartnerPreference' including preferred districts, religions, ethnicities, castes, civil statuses, education levels, professions, income bands, drinking, smoking, food preferences, age and height ranges), dietary preference, drinking habits, smoking habits, and account creator relationship ('accountCreatedBy' - Self, Parent, Sibling, Guardian).
- Family Background: Father's and mother's profession, country of residence, additional family notes, and sibling details.
B. Special Category (Sensitive) Personal Data
- Under Part II of the Sri Lanka PDPA, certain personal attributes are classified as special category data requiring explicit affirmative consent. Sarasavi Piyasa collects and processes:
- Ethnicity: Candidate's ethnicity ('ethnicity'), father's ethnicity ('fatherEthnicity'), and mother's ethnicity ('motherEthnicity').
- Caste: Voluntary cultural caste preference ('caste'), father's caste ('fatherCaste'), and mother's caste ('motherCaste').
- Religion: Religious affiliation ('religion'), father's religion ('fatherReligion'), and mother's religion ('motherReligion').
- Differently-Abled Status: Voluntary health and disability disclosures ('differentlyAbled').
- Astrological & Horoscope Information: Birth time, birth city, birth country, horoscope matching preference ('horoscopeMatching'), and calculated sidereal planetary positions, rashi, lagna, and porondam parameters ('horoscopeData').
Explicit Consent Requirement
Special category data is collected solely for the legitimate purpose of matrimonial compatibility matching. We process this data strictly based on your explicit affirmative consent granted at registration or profile update.
C. Verification Documents & Identity Proofs
- National Identity Card (NIC): Clear digital photographs of the Front and Back sides of your official National Identity Card, verified biological gender, and date of birth extracted from official registry algorithms.
- University Credentials: Degree certificates, academic transcripts, student ID cards, or institutional enrollment letters submitted for academic verification.
- Payment Proofs: Bank transfer deposit slips, CDM transaction confirmations, and transaction reference numbers uploaded for offline package activation.
D. Communications, Chatbot & Technical Logs
- In-App Interactions: Direct messages exchanged between mutually connected members ('Message'), connection requests ('Request'), feedback reviews ('Review'), and user safety reports/blocks ('Report', 'Block').
- WhatsApp & Chatbot Conversations: Member responses and registration inquiries submitted via WhatsApp or web chat ('WhatsAppConversation'), and message deduplication hashes ('WhatsAppProcessedMessage').
- Device & Diagnostic Data: Push notification tokens ('PushSubscription'), IP addresses, device user agents, and administrative security audit logs ('AdminAuditLog').
3. Purposes & Lawful Bases for Processing
We process your personal data in strict compliance with the lawful processing principles defined in the Sri Lanka PDPA:
| Processing Purpose | Data Categories Involved | Lawful Basis under PDPA |
|---|---|---|
| Account creation, profile hosting, and matrimonial discovery | Account data, profile demographics, academic qualifications | Contractual Necessity (Performance of user agreement) |
| Cultural and astrological compatibility matching | Special category data (religion, caste, ethnicity, horoscope, differently-abled) | Explicit Affirmative Consent |
| AI vector embeddings and personality summary generation | Biographical narrative text, partner preferences, personality questionnaire | Contractual Necessity (Core matchmaking service functionality) |
| Identity validation & academic badge verification | NIC images, degree certificates, institution records | Legitimate Interest & Fraud Prevention |
| Cross-border cloud hosting & infrastructure processing | Encrypted database records, photos, push tokens | Explicit Consent & Contractual Necessity |
| Financial accounting, transaction records & tax compliance | Payment records, deposit slips, package purchase history | Legal & Statutory Obligation (Sri Lankan Tax Laws) |
| Weekly match alerts & promotional communications | Mobile phone number, email address | Explicit Consent (Freely revocable opt-in) |
4. Artificial Intelligence, Automated Processing & Vector Matching
Sarasavi Piyasa utilizes advanced artificial intelligence algorithms to provide intelligent, dignified matrimonial recommendations:
1. 768-Dimensional Semantic Vector Embeddings: Your biographical narrative ('About Me') and partner preferences are processed using Google Gemini models to generate high-dimensional vector embeddings stored securely in our database ('Profile.embedding'). These mathematical vectors allow our search engine to identify meaningful conceptual compatibility without exposing your private raw text to third parties.
2. AI Personality Summaries: Voluntary personality questionnaires are analyzed using Google Gemini to construct holistic communication style archetypes ('PersonalityScore.aiSummary').
3. Matrimonial Match Suggestions & Ethnicity Filtering: Our recommendation algorithm calculates compatibility scores based on vector similarity and preferences. By default, suggestions prioritize candidates of your same ethnicity ('showOnlyMyEthnicity: true') to align with common cultural preferences. You have full freedom and control to disable this default at any time in Profile Settings ('Show only my ethnicity in suggestions') to discover matches across all cultural and ethnic communities.
4. Mandatory Core Feature: Semantic AI matching is an integral component of the Sarasavi Piyasa discovery platform to enable accurate matching for university graduates.
5. Right to Human Review: Under the PDPA, members have the right not to be subjected solely to automated decisions producing legal or significant effects. You may request a human review of any algorithmic profile decision or suitor recommendation by submitting a request through our Privacy Request Form at /privacy/request or contacting our DPO.
5. Third-Party Service Providers & Overseas Data Transfers
To operate a highly available, secure platform, we partner with reputable cloud infrastructure providers. Pursuant to Section 26 of the Sri Lanka PDPA (as amended by Act No. 22 of 2025), cross-border transfers of personal data are conducted under explicit data subject consent and standardized Data Processing Agreements (DPAs) / binding instruments. Unless explicitly verified as local Sri Lankan infrastructure, geographical cloud processing regions are designated as to be confirmed by the platform owner:
Authorized Third-Party Processors
- Supabase Inc. (Singapore / United States, to be confirmed by owner): Encrypted relational PostgreSQL database hosting, authentication engine, and private cloud storage for verification documents.
- Google LLC (Singapore / United States / Global, to be confirmed by owner): Google Firebase for real-time mobile push notifications (FCM) and off-site database backup snapshots; Google Gemini API for semantic vector embeddings, artistic avatar rendering, chatbot assistance, and automated content generation.
- Meta Platforms Ireland Ltd / Meta Platforms Inc. (European Union / United States, to be confirmed by owner): WhatsApp Business Cloud API for automated chatbot onboarding and customer communications; Meta Pixel tracking tag (deployed strictly on public pages, never on /master-control, and loaded ONLY after affirmative consent).
- Railway Corp. / Nexvera Gateway (United States, to be confirmed by owner): Cloud application deployment, backend service execution, and secure webhook routing.
- Functional Software Inc. / Sentry (United States / European Union, to be confirmed by owner): Application error diagnostics and real-time crash monitoring (strictly zero PII, tracing limited to <= 0.1, session replays disabled, beforeSend PII scrubbing).
- PayHere (Pvt) Ltd (Sri Lanka): Payment processing gateway for online credit and debit card transactions licensed by the Central Bank of Sri Lanka.
- SMSLenz / Notify.lk / Local Telecommunications Aggregators (Sri Lanka): Localized SMS delivery of One-Time Password (OTP) verification codes, match alerts, and transactional notifications.
- Brevo / Sendinblue SAS (France / European Union, to be confirmed by owner): Transactional email delivery for account verification codes, security alerts, and password reset links.
- Cloudflare Inc. (United States / Global, to be confirmed by owner): Global DNS, content delivery network (CDN) caching, DDoS mitigation, and web application firewall security.
- In-Memory Caching Host / Redis (Upstash / Railway / Self-hosted, to be confirmed by owner): Rate-limiting coordination, bot challenge token validation, and temporary session management.
- Core VPS / Container Host (Coolify / Hetzner / DigitalOcean, to be confirmed by owner): Web application container execution and platform infrastructure.
Cross-Border Transfer Safeguards & Binding Instruments
Personal data processed outside Sri Lanka is protected through TLS 1.3 transit encryption, access isolation, and zero third-party commercial data sales. Formal Data Processing Agreements (DPAs) conforming to the Data Protection Authority guidelines are maintained and reviewed annually.
6. Data Retention Schedules & Automated Purge Lifecycles
In compliance with the data storage limitation principle under the PDPA, Sarasavi Piyasa enforces strict, automated retention and deletion schedules:
| Data Category | Retention Period | Disposal & Retention Lifecycle |
|---|---|---|
| Verification Document Images (NIC Front/Back, University Proofs) | 90 Days post-review | Physical photos in cloud storage are permanently purged 90 days after administrative review (whether approved or rejected). Image URLs are set to null. An irreversible masked NIC hash ('maskedNic') is retained solely to prevent fraudulent re-registration. |
| Soft-Deleted Accounts | 30 Days after deletion | Upon account deletion, all personal fields on User and Profile are immediately anonymised. After 30 days, all linked records (reviews, consent logs, messages, requests) and Profile rows are permanently purged via automated purge routines. |
| Database Backup Archives (pg_dump snapshots) | 30 Versions (~30 Days) | Encrypted database snapshots (pg_dump) are encrypted with a secure public key prior to upload and stored in isolated backup storage. Older daily snapshots are purged automatically after 30 versions. |
| Payment Records & Financial Transactions | Permanent (Statutory Tax Period) | Payment transaction records and receipt metadata are retained to satisfy Sri Lankan corporate tax and statutory accounting obligations. Payment slip images are retained unless the owner configures a specific slip purge window via RETENTION_PAYMENT_SLIP_DAYS. |
| OTP & Verification Tokens | 24 Hours | Expired phone OTPs, email verification codes, and password reset tokens are automatically purged daily. |
| Chatbot Conversations | 180 Days | Unregistered chatbot conversations are permanently deleted after 180 days. For registered users, personal questionnaire answers are scrubbed after 180 days while retaining the phone verification link. |
| Chatbot Dedup Message Cache | 30 Days | Processed message deduplication records are purged after 30 days. |
| Active Chat Messages | Duration of Match | Messages remain accessible between mutually matched members until either party unmatches, blocks, or permanently deletes their account. |
7. Your Statutory Rights & How to Exercise Them
Under the Sri Lanka Personal Data Protection Act No. 9 of 2022 (as amended by Act No. 22 of 2025), you possess clear statutory rights regarding your personal data:
Exercising Your Rights in Sarasavi Piyasa
- Right of Access & Data Portability: You may view and download a digital copy of your complete profile data directly through your Account Settings page via /api/user/data-export.
- Right to Rectification: You may update and correct your profile information at any time in the Profile Editor. Corrections to official identity fields (Full Name, Date of Birth, NIC) can be submitted with supporting documents via Profile Update Verification.
- Right to Erasure ('Right to be Forgotten'): You may permanently delete your account by navigating to Account Settings ➔ Delete Account. Deletion requires password verification and triggers immediate anonymisation followed by permanent 30-day purge.
- Right to Withdraw Marketing & Tracking Consent: You can opt out of promotional SMS, marketing emails, and tracking cookies (Meta Pixel) at any time via the toggle in Account Settings, the 'Cookie settings' link in the footer, or by clicking the one-click unsubscribe link in promotional communications.
- Statutory Response Deadline (1 Calendar Month): In accordance with PDPA Amendment Act No. 22 of 2025, data subject requests must be fulfilled within one (1) calendar month of receipt. Where requests are complex or voluminous, this deadline may be extended by up to two (2) additional calendar months, provided written notice stating the reason for extension is served to you within the initial one month.
- Identity Verification Requirement: To prevent unauthorized data disclosure or malicious account sabotage, data access and erasure actions are gated on identity verification. Requests filed while logged in are verified automatically; requests filed by unauthenticated visitors require a 6-digit verification OTP sent to the registered email or phone.
- Simplified Privacy Requests: You can submit formal PDPA inquiries via our streamlined 3-type Privacy Request Form at /en/privacy/request ('Delete my data', 'Question about my data', 'Other inquiry') or by emailing our DPO at info@sarasavipiyasa.lk.
- Right to Lodge a Complaint: If you believe our data processing violates the Sri Lanka PDPA, you have the statutory right to lodge a complaint with the Data Protection Authority of Sri Lanka.
8. Age Eligibility (18+ Only) & Technical Security
1. Strict Adult-Only Eligibility (18+): Sarasavi Piyasa is exclusively open to individuals aged 18 years or older who are legally competent to enter into marriage. Our registration engine automatically extracts and validates applicant birth dates from official National Identity Card algorithms. Any applicant under 18 is immediately blocked from creating an account.
2. Technical & Organizational Safeguards: We implement industry-standard security measures, including bcrypt password hashing with salt, TLS/HTTPS encryption in transit, server-side access control checks on every API route, parameterized database queries with Prisma ORM, role-based access control for administrative staff, and automated rate-limiting on authentication and OTP endpoints.
9. Personal Data Breach Notification Commitment
NEXVERA CREATIONS (PVT) LTD maintains a comprehensive Incident Response Plan. In the unlikely event of a security incident resulting in the unauthorized access, disclosure, or destruction of personal data that is likely to pose a significant risk to your rights and freedoms, we will notify the Data Protection Authority of Sri Lanka and impacted members within the statutory timeframes mandated by the PDPA.
11. Policy Updates & Revision History
This Privacy Policy is versioned as 2026-10-v2 with an effective date of 2026-10-10. We may update this policy periodically to reflect evolving legal standards or platform features. If we introduce material changes to our data collection purposes or consent terms, we will present an active re-consent notification in the application requiring your review and affirmative confirmation.
Data Protection Inquiries & DPO Contact
If you have questions regarding this policy, data rights, or compliance, please reach out to our privacy office:
DPO Email:
info@sarasavipiyasa.lkDPO Telephone:
+94 76 314 8245Official WhatsApp:
+94 76 314 8245Corporate Headquarters:
Colombo, Sri Lanka