Privacy notice

What we collect, and why

• Account data: your name, email address, and optionally your phone number and district, to run your account and let buyers contact you.
• Listing data: the vehicle details, photos, price and location you publish. Location data embedded in photos is removed when you upload them.
• Mobile number verification: when you verify a number, we send a one-time code by SMS through our SMS provider. We store only a scrambled (hashed) form of the code, which is deleted from use once it expires or is used, plus the number and when it was verified. We also keep a scrambled form of the network address a code was requested from, to stop abuse. Staff never see the codes.
• Contact choices: for each listing you choose which numbers to show (a verified primary number, optionally another number and a WhatsApp number), and whether only signed-in members can see them. Only the primary number can be marked “Verified by SMS”.
• Messages: conversations between buyers and sellers on Rathagaya, including any photos you attach (location data is removed from photos). Messages are checked automatically for common scam signs, such as short links or requests for advance payments or codes, so we can warn the other person.
• Reports: the reason and details you give when you report a listing.
• Photos: a public copy of each photo (which may carry a small watermark) and a clean private copy that only our systems use, so we can change how photos are shown. Both are deleted when you delete the photo, the listing or your account, or after the retention period for expired listings.
• View counts: to count views without counting the same person twice, we keep a scrambled code made from the network address and browser, which changes every day and can't be turned back into an address. These codes are deleted after about a week.
• Emails: service emails about your listings and promotions (for example “your ad is live” or an expiry reminder), with a record of whether our email provider accepted each one. We don't send marketing emails.
• Offers: the amount you offer, the advertised price at the time, and the offer's status. When you make an offer you agree that, if the seller accepts, they can see your name, phone number and email address so you can arrange a viewing. Before acceptance, sellers see only your display name. Each time a seller opens your details, we record it.
• Verified Seller requests: if you apply for the Verified Seller badge, you upload a photo or scan of an identity document (and, for dealers, business details). Documents are stored privately and seen only by authorised staff through short-lived links (every view is recorded). If you're approved, we normally keep them for 90 days after approval and then delete them. If you're not approved, or you withdraw, we delete them at the decision. We keep the decision, the date and the reviewer.
• Dealer applications: business details you give us (business name, type, registration number, contact details and showroom address) and the documents you upload, such as a business registration certificate and the applicant's ID. Documents are stored privately and opened only by authorised staff through short-lived links (every view is recorded). If the application is approved, we normally keep them for 90 days after approval and then delete them; otherwise we delete them at the decision. Registration numbers and documents are never shown publicly.
• Payments: for a paid promotion, the order, package, amount, any coupon used, the chosen start time, status and the payment reference from PayHere. Card details are entered on PayHere's page and never reach Rathagaya.
• Usage events: only if you allow analytics cookies, product events such as “search performed”, linked to a random anonymous identifier that is hashed before storage. These don't include names, emails, phone numbers or message text.

Cookies and similar storage

When you first visit, Rathagaya asks which optional cookies it may use. Optional categories stay off until you allow them, and you can change or withdraw your choice at any time with Cookie settings (also at the bottom of every page). Withdrawing deletes the related cookies and stored data from your browser.

• Necessary (always on): sign-in session cookies (Supabase, names starting sb-), security checks (including __cf_bm, set by our network provider Cloudflare for 30 minutes to tell people from bots), your compare list (stored in your browser when you press Compare) and rathagaya_consent, which remembers your cookie choice for six months. Ad and dealer page view counts are also necessary: they use no cookie or device identifier (see “View counts” above). On the sign-in and sign-up pages, the “Sign in with Google” button is loaded from Google, which may use its own cookies under Google's privacy policy; it isn't loaded anywhere else.
• Analytics: rodha_sid, a random anonymous identifier (180 days, hashed before storage), and the usage events described above.
• Functional: rodha_lang, which remembers the language you chose (one year), and “Recently viewed” vehicles, stored only in your browser.
• Marketing: none. Rathagaya doesn't use advertising or social media trackers. If that changes, they will only run after you allow this category.

What we don't collect

Apart from voluntary Verified Seller requests and dealer applications (above), Rathagaya doesn't ask for or keep identity documents (such as your NIC), vehicle registration certificates or registration numbers. Please don't include them in listing photos, descriptions or messages.

What we don't do

• We don't sell personal data.
• We don't show your phone number unless you choose to. You control who can see it on each listing.
• “Recently viewed” vehicles are stored only in your browser (if you allow functional cookies), not on our servers.
• We don't read your conversations as a routine. Trained staff can open a conversation only when someone reports it, to investigate suspected fraud, or when the law requires it (for example a court order). Every such access is recorded with its reason, and those records are reviewed.

WhatsApp and other services

If a seller adds a WhatsApp number, the WhatsApp button opens WhatsApp, a separate service run by Meta under its own terms and privacy policy. Rathagaya can't see or moderate WhatsApp chats and doesn't verify WhatsApp accounts. For your safety, keep conversations on Rathagaya where possible.

Service providers

We use Supabase (database, authentication and file storage), a hosting provider, PayHere for payments, an email provider for service emails and an SMS provider for verification codes. If you sign in with Google, Google tells us your name, email address and profile picture link; Google handles your password, and we never see it. If AI writing assistance is enabled, the vehicle details you entered (not your contact details) are sent to Anthropic to draft a description. Final provider list and data transfer details: to be completed before launch.

Retention and deletion

• சரிபார்ப்பு ஆவணங்கள்: உங்கள் Verified Seller அல்லது டீலர் விண்ணப்பம் அங்கீகரிக்கப்பட்டால், வழக்கமாக அங்கீகரித்த நாளிலிருந்து 90 நாட்கள் ஆவணங்களைத் தனிப்பட்ட முறையில் வைத்திருந்து பின்னர் நீக்குவோம். அங்கீகரிக்கப்படாவிட்டால் அல்லது நீங்கள் திரும்பப் பெற்றால், முடிவு எடுத்ததும் நீக்குவோம். ஆவணப்படுத்தப்பட்ட சட்டப்பூர்வத் தடுப்பு இருக்கும்போது அல்லது சட்டம் கோரும்போது மட்டுமே அதிக காலம் வைத்திருப்போம். முடிவு, அதன் தேதி, மதிப்பாய்வாளர் மற்றும் கட்டணப் பதிவுகள் தனியாக வைக்கப்படும்.
• Deleting a document removes it from our private storage. Our database provider's backups can still contain the database record that pointed to the document (not the file itself) until those backups expire under the provider's schedule.
• You can delete your account in Settings. This removes your profile, listings, photos and messages.
• If you delete a message, the other person no longer sees it, but a staff-only copy is kept for a limited period (currently 30 days) in case it is needed to investigate fraud or abuse, and then erased.
• Messages that have been reported are kept until the investigation ends and then for a limited period (currently one year) in case of appeals or legal claims, and then erased.
• If the law requires us to preserve a conversation (for example during a police investigation), it is kept until that requirement ends, and the accounts involved can't be deleted until then.
• Moderation and audit records may be kept without your personal details, for safety and legal reasons.
• Payment records (order, amount, status and the PayHere reference) are kept separately from verification documents, for as long as accounting and tax rules require.

Your rights

Subject to applicable law, you may ask to access, correct or delete your personal data, and to object to some processing. Contact details for privacy requests will be published here before launch.