Privacy

Who we are

aiyo is run by the aiyo team, an independent group in Sri Lanka. It isn’t a government service. For anything on this page, email buildsbyhameed+aiyo@gmail.com.

What we collect

• Your complaint. What happened, where, and any voice note, photos, videos or documents you add.
• A phone number or email, only if you give one. We don’t ask for your name. Please don’t put your NIC number or other people’s details in the complaint unless they’re needed.
• A quick bot check. Before you send, Cloudflare Turnstile looks at your browser to tell people from bots.
• Basic records. Our host, Cloudflare, keeps standard security records such as the time and your internet address.
• Cookies, only if you say yes. If you tap Accept on the cookie notice, we use Google Analytics and the Meta Pixel to count visits and see which pages help people. They set cookies, and Google and Meta receive details such as the pages you open, your device and your rough location. They never receive what you write or upload in a complaint. If you tap No thanks, they don’t load at all. You can change your choice any time with “Cookie settings” at the bottom of every page.

Phones often record the exact spot where a photo or video was taken. We remove that location data from photos and videos as soon as they arrive, before they’re stored.

What we use it for

• To check that the complaint is real before we post anything.
• To write a public post about the problem and keep it on the public map.
• To contact you, if you left a phone number or email: to ask a question, tell you when it’s posted, or ask whether it’s been fixed.
• To stop spam and misuse.

What becomes public

The problem, the place and the office responsible. We may also post photos or videos after checking them. Before posting, we cover faces, number plates and anything else that could identify you or other people. We don’t post voice notes; we write up what you said instead. Your name, phone number and email are never posted.

Who else handles it

Only the aiyo team can read complaints. We use two companies to run the site: Cloudflare (website, bot check and file storage) and Supabase (the database, on servers in India). They store the data for us and can’t use it for anything else. This means your data is kept outside Sri Lanka. If you accept cookies, Google and Meta also receive the visit details described above, under their own privacy policies.

Social media sites see only what we publish. We don’t sell or share your details with advertisers, and we never give them to the office you complained about. If Sri Lankan law requires us to hand over information, we’ll tell you first unless the law forbids it.

How long we keep it

• Phone number or email: deleted 12 months after your complaint is closed, either because it’s fixed or because we’ve stopped following it.
• Complaints we don’t post, and the files sent with them: deleted 12 months after we decide not to post.
• Posted complaints stay public as part of the record of what was reported and what was fixed. The private parts are deleted on the same schedule.

Your choices

You can ask us to show you what we hold about you, correct it, or delete it. You can withdraw a complaint before it’s posted, and ask us to take down anything in a post that identifies you. Email us with your reference number if you have it, and we’ll reply within a month.

Sri Lanka’s Personal Data Protection Act, No. 9 of 2022 protects these rights. If you’re unhappy with how we handle your data, you can also contact the Data Protection Authority of Sri Lanka.

Keeping it safe

Complaints and files are kept in private storage that the public website can’t read. Everything you send travels over an encrypted connection.

Changes

If we change this page, we’ll update the date at the top. If a change affects complaints you’ve already sent, we’ll tell you, as long as you left a way to reach you.