Privacy Policy

ANYLK (PVT) LTD ("ANYLK", "we", "our", or "us") is a Sri Lanka-based travel and mobility platform connecting travellers with drivers, hotels and other accommodation providers, tour guides, photographers, and self-drive vehicle rental operators across Sri Lanka. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the ANYLK (traveller) and ANYLK Partner mobile applications and our website www.anylk.com (collectively, the "Services").

ANYLK is the data controller for the personal data described here. This policy is written to meet Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA), and it applies to everyone whose data we process — Sri Lankan residents and international travellers alike. It tells you what we collect, why, on what legal basis (Section 5), who receives it (Sections 8 and 9), how long we keep it (Section 11), and how to exercise your rights (Section 13). Where we rely on your consent, we ask for it separately, and you can withdraw it at any time.

• Tracking & Analytics: Learn how we use tracking technologies on our website in our Cookie Policy.
• Financial Data: Understand how payments, wallets, and payouts are handled under our Payment Policy.
• Right to Erasure: Find step-by-step instructions for removing your account and personal data on our Account & Data Deletion page.

1.1 Traveller Accounts

• Full name, email address, and phone number
• Password (stored in hashed form — never in plain text)
• If you sign in with Google or Apple, we receive your name, email address, and (Google only) profile photo from that provider
• Language preference and profile details you choose to add

1.2 Driver Accounts (ANYLK Partner)

• Full name, email address, phone number
• National Identity Card (NIC) — front & back photos, and NIC number
• Driver's licence photo, vehicle insurance certificate, and vehicle registration document
• Vehicle details and photos (type, model, number plate)
• Bank account details for payouts (account number, holder name, bank, branch)
• Real-time GPS location while online and during trips

1.3 Tour Guide Accounts

• Full name, phone number, profile photo
• NIC or passport number and document photos
• A selfie holding your ID, so our team can check the documents are yours (checked by a person — no face recognition)
• Guide licence / SLTDA registration documents where applicable
• Experience, areas covered, languages spoken, and pricing
• Bank account details for payouts

1.4 Photographer Accounts

• Full name, phone number, city, and optional Instagram handle
• Experience, camera and equipment details, and pricing
• NIC document photos, profile photo, and portfolio photos
• A selfie holding your NIC, so our team can check the documents are yours (checked by a person — no face recognition)
• Optional: a police clearance certificate — criminal-record information, kept only with your separate, explicit consent (see Section 12)
• Bank account details for payouts

1.5 Hotel & Accommodation Accounts

• Property name, type (hotel, villa, guest house, resort, bungalow, homestay, or hostel), contact number, city, and address
• Room / unit / bed types, prices (LKR & USD), and property photos
• Owner NIC document photos and business/SLTDA registration documents where applicable
• Bank account details for payouts

1.6 Self-Drive Rental Operator Accounts

• Business or owner name, contact number, city, and address
• Business registration number and NIC/passport document photos
• A selfie holding your ID, so our team can check the documents are yours (checked by a person — no face recognition)
• Vehicle details, condition, photos, and daily rental rates, and each vehicle's revenue licence and insurance documents
• Bank account details for payouts

All partner applications (1.2–1.6): if your application is rejected, your identity, licence, police-clearance and bank documents and details are deleted automatically 90 days after the rejection, unless you apply again before then.

1.7 Package Tour Bookings

A multi-day package tour is arranged by hand around your travel dates, so the booking form asks for more than a single ride does:

• Contact details (phone, WhatsApp, email) and the name and age of every traveller in the party
• Passport details of the lead traveller — name, number, date of birth, and validity date — and a copy of the passport
• Your ETA / tourist visa number and a copy of the visa document
• Arrival and departure flight numbers and times
• Travel insurance company, hotline, and a copy of the policy
• An emergency contact who is not travelling with you
• Optional: medical conditions or allergies the team should know about — only with your separate, explicit consent (see Section 12)
• Children's details: for children in the party, a passport copy for each child — only with the separate consent of their parent or guardian (see Section 12)

The scans and the date of birth, visa, insurance, emergency-contact and medical details are kept in access-restricted records that only you and the ANYLK team running your trip can open, and they are deleted automatically 90 days after your trip (Section 11).

1.8 Self-Drive Rental Bookings

Before a rental shop hands over a vehicle, ANYLK checks that the driver may legally drive it. When you book a self-drive rental we collect:

• Sri Lankan residents: copies of your NIC (both sides), your driving licence (both sides), and a proof of address
• International travellers: a copy of your passport photo page and your International Driving Permit or licence
• Your phone number, NIC / passport number, licence number and expiry, age, and an emergency contact

These are kept in access-restricted records: ANYLK's team checks them, and the rental shop can open them only around the pickup time. They are deleted automatically 90 days after the rental ends (or is cancelled); copies uploaded for a rental that is never booked are deleted after 7 days.

1.9 Automatically Collected Information

• Device type, operating system version, and app version
• IP address and device identifiers, including push-notification (FCM) tokens
• Crash reports and error logs (Firebase Crashlytics)
• App usage statistics (Firebase Analytics) — which screens are used, so we can improve the app; never sold or used for advertising
• Booking history, wallet transaction history, and in-app activity
• Ratings and reviews you submit

ANYLK includes an in-trip SOS emergency feature designed to protect travellers and drivers. When you (and only you) activate SOS during a trip, the following data is collected and processed:

• Live location: Your GPS position is streamed continuously to our safety team until the SOS is resolved.
• Voice recording: With your prior microphone permission, short audio clips are recorded — including while the app is in the background or the screen is off — and uploaded to secure storage. On Android a persistent notification is always visible while recording; recording stops automatically when the SOS ends, if the app is closed, or after a maximum session length.
• Emergency sharing: To get you help quickly, we may share a live-location link with police or emergency responders (for example via WhatsApp or Telegram). This public link shows only a map position — no name, phone number, or other personal details.
• Nearest police station lookup: Your location may be used to identify the closest police station.

Microphone access is optional for travellers — you can decline it and SOS will still work with location only. SOS voice clips are automatically deleted after 14 days, unless an incident is under active investigation and an administrator marks them for retention. SOS data is never used for advertising or any purpose other than safety.

3.1 Medical Assistance

If you use the in-app medical assistance feature, your GPS location is used once to find the nearest available doctor. Consultations (text, video, or in-person arrangement) take place over third-party messaging platforms such as WhatsApp or Telegram, which are governed by their own privacy policies. We store a record of the service request (doctor, service, fee, time) and the wallet payment; we do not store the content of your consultation or any medical records. If you write a short description of your problem when requesting a doctor, it is kept only if you tick the consent box under it; it is visible only to the ANYLK team that runs the doctor service, and it is deleted — together with the location of the request — after 90 days (Section 12).

3.2 AI Travel Assistant

The in-app AI travel assistant sends your chat messages (and recent conversation history) through our servers to Google's Gemini AI service to generate answers. Usage is subject to a daily message limit. Please do not include sensitive personal information in AI chats. AI conversations are used solely to answer your questions — not for advertising or profiling.

• To create and manage your account and verify your identity and email address
• To match travellers with drivers, hotels, guides, photographers, and rental operators
• To process wallet top-ups, booking payments, refunds, commissions, and partner payouts
• To display real-time maps, routes, and fare estimates
• To verify the authenticity of submitted documents (NIC, licences, insurance, business registrations)
• To send booking confirmations, trip updates, payment receipts, and service notifications (push and email)
• To respond to SOS emergencies and protect user safety
• To handle customer support queries and resolve disputes
• To prevent fraud and enforce our Terms & Conditions
• To improve app features based on aggregated usage data
• To comply with applicable laws, regulations, and court orders

We use your information only for the purposes listed in this policy. We do not sell it, and we do not use it for advertising profiles.

Under the PDPA, every use of personal data needs a lawful basis. These are ours:

• Performing our contract with you — creating your account; taking, delivering and tracking bookings; wallet top-ups, payments, refunds and partner payouts; booking confirmations, trip updates and receipts; customer support.
• Legal obligations — keeping financial, tax and accounting records, and responding to lawful requests from courts, police and regulators.
• Legitimate interests — verifying partners' identity and licence documents before they can serve travellers, preventing fraud and abuse, keeping the platform secure, resolving disputes, and improving the app from crash reports and aggregated usage statistics. We use these only where they do not override your rights and interests.
• Protecting life and safety — sharing your live location with responders during an SOS emergency (Section 2).
• Your consent — optional SOS voice recording (microphone permission), medical conditions you add to a package booking, the description of your problem when you request a doctor, the details and passport copies of children in a package booking (given by their parent or guardian), a photographer's optional police clearance certificate, and broadcast emails, which carry a one-click unsubscribe. You can withdraw consent at any time (Section 13); this does not affect what was done before, but we may then be unable to provide the part of the service that depended on it.

Location access is essential for core app functionality. We collect GPS location as follows:

• Travellers: Location is collected when you book a ride or service to determine pickup point, destination, and fare, and during active trips to show trip progress. It is also used once when you search for nearby services (e.g. medical assistance).
• Drivers: Real-time location is collected while you are online and available for bookings, and during active trips for navigation and passenger tracking. The Partner app may collect location in the background while you are marked "Online" — a visible notification is shown, and you can go offline or disable location in device settings at any time. While you are online, travellers looking for a ride see only an approximate, anonymous position of available vehicles (no name, phone number, or vehicle number); your precise live location is shared only with the passenger of your current trip.
• Hotels, guides, photographers, rental operators: Only city/area-level location is collected at registration for search and discovery — precise GPS is not tracked for these partners.
• SOS: Live location streaming as described in Section 2.

We do not sell location data or share it with third parties for advertising. Disabling location access will prevent ride booking and other location-based features from working.

• The ANYLK Wallet is an in-app balance maintained by ANYLK. Wallet transaction history is stored to provide statements, receipts, and dispute resolution.
• Bank transfer top-ups: If you top up by bank transfer (including via Wise for international travellers), the payment receipt you upload is stored securely and used only for verification by our administrators.
• Card payments are processed by our payment gateway (PAYable) and PayPal for international payments. We never see or store your full card number or card security codes — these are handled entirely by PCI-DSS compliant payment processors.
• Partner bank details are stored in access-restricted records visible only to the partner themselves and authorised ANYLK administrators, and are used solely for processing payouts.
• Payment receipts and invoices are emailed to you automatically after successful top-ups.

See our Payment Policy for full details of payment flows, commissions, and payouts.

We do not sell your personal information. We share data only in these circumstances:

• Between users: Travellers see a partner's name, photo, vehicle/property details, and live trip location. Partners see the traveller's name and pickup/booking details needed to deliver the service.
• Google Firebase / Google Cloud: Our backend (database, authentication, storage, cloud functions, push notifications, analytics) runs on Google Cloud infrastructure.
• Google Maps: Location data is sent to Google Maps APIs to render maps, routes, and fare estimates.
• Google Gemini: AI assistant messages are processed by Google's AI services (Section 3.2).
• Payment processors: Transaction data is shared with PAYable and PayPal to process payments and handle disputes/chargebacks, and with Wise when you top up from abroad through our Wise payment link.
• Email delivery: Emails (verification, receipts, booking confirmations, service notices) are delivered via Resend, our email delivery provider.
• Emergency services: During an SOS, your live location (and where necessary trip details) may be shared with police or emergency responders (Section 2).
• Legal requirements: We may disclose information if required by Sri Lankan law, a valid court order, or to prevent imminent harm.
• Incident investigations: Where an incident between users leads to a police complaint, criminal investigation, or court proceeding, we may preserve and provide the relevant platform records — booking details, GPS/trip logs, SOS recordings, in-app communications, and payment records — to law enforcement authorities, courts, and other lawfully entitled parties, in accordance with applicable law.
• Business transfers: In a merger, acquisition, or sale of assets, user data may be transferred to the successor entity subject to the same protections.

Our service providers process personal data only on our instructions and only for the service they provide to us.

ANYLK is based in Sri Lanka, but some of the providers that run our Services store or process data outside Sri Lanka:

• Google Cloud / Firebase — our database, file storage, authentication and server functions run in Google data centres outside Sri Lanka (our server functions run in Mumbai, India). Google Maps and Google Gemini run on Google's global infrastructure.
• Resend — email delivery, a provider based in the United States.
• PayPal and Wise — international payment providers, for the payments you choose to make through them.
• Google and Apple — sign-in, push notifications, and app distribution.

We send each provider only what it needs for its part of the Services, always over encrypted connections, and under that provider's data-processing terms. We transfer personal data outside Sri Lanka only with the safeguards the PDPA requires, and we review these arrangements as the Data Protection Authority of Sri Lanka issues its rules on cross-border transfers.

• All data in transit is encrypted using HTTPS/TLS
• Passwords are managed by Firebase Authentication and stored as secure one-way hashes
• Database security rules restrict every record to the users authorised to access it
• Sensitive partner data (NIC numbers, identity documents, bank details) is kept in separately restricted records accessible only to the owner and authorised administrators
• Identity document images are stored in access-controlled cloud storage — they are never publicly accessible
• All money movements (payments, refunds, payouts, commissions) are executed server-side with transactional safeguards
• Administrator actions on user data are access-controlled and logged
• Card data is handled exclusively by PCI-DSS compliant payment processors
• The database is protected against deletion and backed up — any point in the last 7 days can be recovered, and weekly backups are kept for 4 weeks — so records lost by mistake or through an attack can be restored

While we take strong precautions, no internet transmission is 100% secure. Please use a strong password and keep your credentials confidential.

If a breach happens: if personal data we hold is lost, disclosed or accessed without authorisation in a way that is likely to put your rights at risk, we will notify the Data Protection Authority of Sri Lanka and — where the risk to you is high — tell you directly, within the time limits set under the PDPA, together with what we are doing about it and what you can do to protect yourself.

We keep personal data only as long as the purpose it was collected for requires:

• Account and profile data is retained while your account is active
• Booking and trip history is retained for dispute resolution while your account is active
• Package tour bookings: passport, visa/ETA and insurance copies (including children's passport copies), date of birth, passport validity, visa number, insurance and emergency-contact details, and any medical conditions are deleted automatically 90 days after your trip ends, or 90 days after the booking is cancelled. The booking record itself — package, dates, payments, the names and ages of the travellers, and the lead traveller's passport name and number — is kept as a financial record, as described below.
• Document copies uploaded for a package booking that is never completed are deleted automatically after 7 days
• Self-drive rentals: the driver's NIC / passport / licence / IDP / proof-of-address copies and the ID and licence numbers, phone, e-mail and emergency contact kept with the rental are deleted automatically 90 days after the rental ends (or is cancelled); copies uploaded for a rental that is never booked, after 7 days
• Doctor requests: the description of your problem and the location of the request are deleted automatically after 90 days; the record of the request and its payment is kept as a financial record
• Rejected partner applications: identity, licence, police-clearance and bank documents and details are deleted automatically 90 days after the rejection, unless you apply again
• In-app chat messages (with drivers, guides, photographers and rental shops) are deleted automatically 12 months after they were sent
• In-app notifications are deleted automatically after 6 months
• Payment-dispute evidence we assemble for a card or PayPal dispute is deleted automatically after 2 years
• SOS voice clips are automatically deleted after 14 days unless retained for an active investigation; the SOS record itself (time, location, people involved) is deleted after 2 years, unless it is part of an investigation
• When you delete your account, it is deactivated immediately and your personal data — including profile, documents, photos, bank details, chats, and reviews — is permanently erased within 180 days (see our Account & Data Deletion page)
• Booking, payment, wallet and payout records required for legal, tax, or regulatory compliance may be retained for up to 6 years as required by Sri Lankan law, with your name, contact details, and bank details removed
• After a completed ride, the passenger and the driver can still see each other's phone number for 24 hours, so either can get in touch about something left in the vehicle; the numbers are then removed from the ride's record. If a ride is cancelled, or the passenger does not show up, they are removed straight away
• Anonymised, aggregated analytics data may be retained indefinitely
• Backups: data deleted under the periods above also leaves our database backups within at most 4 weeks (7-day recovery window, weekly backups kept 4 weeks); deleted files can be restored for 7 days

The PDPA treats some personal data as special categories that need extra protection — including health data, criminal-record information, and any personal data about a child (a person under 16). ANYLK handles only the three kinds below, and each only with its own separate, explicit consent that the app asks for at the moment it is collected:

12.1 Children in package bookings

An ANYLK account is only for people aged 18 or over — you confirm this when you sign up — and we do not knowingly let anyone under 18 create one. A parent or legal guardian may, however, include children in a package tour booking. For each child we collect their name, age and a passport copy, used only to arrange the trip and keep the party safe. The person making the booking must confirm that they are the child's parent or legal guardian (or have the guardian's permission) and consent to this — the booking cannot be made without it. Children's passport copies are deleted 90 days after the trip.

If you believe someone under 18 has registered an ANYLK account, please contact us at support@anylk.com and we will close the account and delete its data.

12.2 Health information

We collect health information in two optional places, and only with a separate tick each time:

• Package bookings — the "medical conditions / allergies" field. If you fill it in, the app asks for your consent before booking. It is visible only to you and the ANYLK team running your trip, used only to keep you safe during it, and deleted 90 days after the trip.
• Doctor requests — the short description of your problem. It is kept only if you tick the consent box under it (otherwise it is not stored and your request still goes ahead), is visible only to you and the ANYLK team that runs the doctor service, and is deleted after 90 days.

You can withdraw your consent at any time by contacting us (Section 17), and we will delete the information.

12.3 Criminal-record information

Photographers may choose to upload a police clearance certificate to show travellers they are safe to work with. It is optional; if you upload one, the app asks for your separate consent, and only the ANYLK team that approves photographers can see it. If your application is rejected it is deleted 90 days later; otherwise it is deleted with your account.

We do not ask for information about your racial or ethnic origin, religion, political opinions, or sex life, and we do not use biometric (face or fingerprint) recognition.

Under the PDPA and this policy, you have the following rights regarding your personal data:

• Access: Ask whether we process your personal data, and request a copy of it
• Correction: Update inaccurate or incomplete data via your profile settings or by contacting us
• Deletion: Delete your account and associated data directly in the app, or ask us to erase data we should no longer hold
• Portability: Request a machine-readable export of your data where technically feasible
• Withdrawal of consent: Withdraw any consent you have given (Section 5) at any time — for example, unsubscribe from broadcast emails with the link in every email
• Objection: Object to processing based on our legitimate interests
• Review of automated decisions: Some decisions are made automatically by fixed rules — for example, a partner account or vehicle listing is paused from new bookings when a required licence, registration or insurance document has expired, or when a driver's unpaid commission balance passes the settlement limit shown in the Partner app. You can ask for any such decision to be reviewed by a person.
• Complaint: If you are not satisfied with how we handle your data or your request, you can complain to the Data Protection Authority of Sri Lanka (www.dpa.gov.lk)

How to Delete Your Account

• Open the ANYLK or ANYLK Partner app → Profile → Delete Account, OR
• Email support@anylk.com with the subject "Account Deletion Request"

Full details — including what is deleted, what is retained, and timelines — are on our dedicated Account & Data Deletion page. To exercise any other right, email support@anylk.com with the subject "Data Protection Request" (see Section 17). We may need to confirm your identity first. We respond within one month; if a request is complex we may extend this by up to two further months, and we will tell you why within the first month.

Our Services integrate the following third-party services, each governed by its own privacy policy (where their data is processed: Section 9):

• Google Firebase / Google Cloud — database, authentication, storage, cloud functions, push notifications, analytics, crash reporting
• Google Maps — maps, navigation, routing, and fare estimation
• Google Sign-In & Apple Sign-In — optional authentication methods
• Google Gemini — AI travel assistant responses
• PAYable — card payment processing (Sri Lanka)
• PayPal — international payment processing
• Wise — international bank-transfer top-ups
• Resend — email delivery
• WhatsApp / Telegram — optional communication channels for support, medical assistance, and emergency coordination
• Google Play / Apple App Store — app distribution

If you access ANYLK from the European Economic Area, the following applies in addition to the rest of this policy:

• Legal basis: We process personal data based on contract performance (providing the Services), legitimate interests (fraud prevention, safety), legal obligations, or your explicit consent.
• Data transfers: Your data may be transferred to and processed in Sri Lanka and by the providers listed in Section 9. We apply appropriate safeguards consistent with GDPR requirements.
• Rights: You have the right to access, rectify, erase, restrict, and port your data, and to object to certain processing.
• Complaints: You may lodge a complaint with your local Data Protection Authority.

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect and the purposes for collection.
• Right to Delete: Request deletion of personal information (subject to legal exceptions).
• Right to Opt-Out: ANYLK does not sell personal information, so no sale opt-out is required.
• Non-Discrimination: We will not discriminate against you for exercising your rights.

To submit a request, contact us via the details in Section 17. We respond within 45 days.

We may update this Privacy Policy from time to time. For material changes we will notify you via in-app notification or email before the changes take effect, and post the updated policy here with a new date. Continued use after the effective date constitutes acceptance.

Questions, concerns, or requests regarding this policy or your personal data:

• Data Controller: ANYLK (PVT) LTD (Business Registration No. PV00365236)
• Address: No 96, Pahalagama, Mahabulankulama, Anuradhapura 50000, Sri Lanka
• Customer Support: support@anylk.com | +94 78 749 2227 (Call / WhatsApp / SMS)
• General Inquiries: info@anylk.com
• Data protection requests (access, correction, deletion, withdrawing consent, objections): support@anylk.com with the subject "Data Protection Request" — answered within one month (Section 13)
• Response time: We aim to respond to general questions within 5 business days
• Supervisory authority: Data Protection Authority of Sri Lanka — www.dpa.gov.lk

This Privacy Policy is governed by the laws of the Democratic Socialist Republic of Sri Lanka. Any dispute arising from this policy is subject to the exclusive jurisdiction of the courts of Sri Lanka.