Privacy Policy

Aura Private Suite, No. 168 ML 24, Realty Plaza, Ja-Ela, Sri Lanka. We decide how your information is used. Contact us about privacy at auraprivatesuite.info@gmail.com or on WhatsApp 077 301 1010.

• Your account: name, email address, WhatsApp number and a password (stored only as a secure hash). If you sign in with Google, we receive your name and email from Google.
• Your bookings: date, time, length, number of guests, what you plan to do, snacks ordered and the amounts paid.
• Your ID: a photo of the NIC, passport or driving licence of the person booking, and which type it is.
• Payments and refunds: your bank transfer receipt and its reference number, and, if you cancel in time, the bank account you want refunded.
• Security information: the IP address and time of sign-ins and other important account actions.

• To take and manage your booking, and to contact you about it by WhatsApp or email.
• To confirm that the person booking is 18 or older and is the person who arrives. This is why we ask for an ID photo and check the original at the door.
• To check your payment, pay refunds and keep the financial records we're required to keep.
• To keep accounts secure and prevent fraud, such as reused payment receipts.

We don't sell your information, and we don't use it for advertising.

• ID photos: deleted automatically 30 days after your visit. If a booking isn't completed, the photo is deleted within an hour.
• Refund bank details: deleted automatically 30 days after the refund is sent.
• Payment receipts and booking records: kept for as long as the law requires us to keep financial records.
• Your account: until you delete it.

Only Aura staff who need it. ID photos and refund bank details can be opened only by the owner (or staff the owner allows), and every time one is opened it is recorded. We use trusted providers to run the service: our hosting provider, Microsoft Azure (database), Google (if you choose Google sign-in), Cloudflare (to stop automated sign-ups) and our email provider. They process data only on our instructions. Some of these providers may store data outside Sri Lanka.

Connections are encrypted. ID photos, receipts, WhatsApp numbers, bank references and refund details are encrypted before they're stored, so they can't be read from a copy of the database or files. Staff accounts need two-step verification.

We use one essential cookie to keep you signed in. We don't use advertising or tracking cookies.

• See and correct your details in My account, or ask us for a copy of what we hold.
• Delete your account yourself from My account. Your name, contact details and ID photos are removed straight away. Booking and payment records stay without your details, because we need them for our accounts.
• Withdraw consent or object to how we use your information by contacting us.
• Complain to the Data Protection Authority of Sri Lanka if you're unhappy with how we handle your information.

If we change this policy, we'll update the date at the top. Significant changes will be shown on the website before they apply.