Legal
Privacy policy
Last updated September 2026
Who we are
Ceylona is operated by oneDesigns, a company based in California, USA, at www.ceylonaa.com. A Sri Lankan company is being registered; until it is, oneDesigns is the contracting party. The marketplace is not taking orders in the meantime.
What we collect
Your name, email, phone number and delivery address when you place an order. Your email, and a display name and profile photo if you sign up with Google or Facebook, when you create an account. The content of messages you send through the site, which we scan automatically for scams, off-platform payment requests and abusive language before delivery — no one reads a message unless it's flagged. If you apply to sell, the details you give us about your shop and yourself. Card numbers are entered directly on our payment gateway's page and never reach Ceylona's servers.
Why we hold it
To fulfil your order, let the maker prepare and post it, keep the marketplace free of scams and abuse, and contact you if something goes wrong. We do not sell personal data to anyone, ever.
Who we share it with
The artisan fulfilling your order (name, address and phone), the courier they choose to post it with, and PayHere, our payment gateway, for the order amount and reference. Resend, our email provider, sends the emails we trigger — order confirmations, receipts, alerts — on our behalf. If you sign in with Google or Facebook, they handle that sign-in directly; we only receive the email and name they choose to share with us. Each of these receives only what it needs to do its part, and none of them may use your data for their own purposes.
Cookies
We use two cookies: one remembers your language, the other your preferred display currency. Neither identifies you or is shared with anyone. No third-party advertising trackers, and nothing here follows you to other sites.
Site analytics
We keep an aggregate count of page visits — which pages, roughly what country and device type, and which site sent you here — to understand how the marketplace is used. These are running totals, not records tied to you: we don't store your IP address, and nothing here can be traced back to a specific visitor.
How long we keep it
Order records for seven years, as Sri Lankan tax law requires. Account, message and review data for as long as your account is active, or until you ask us to delete it — see Your rights, below.
Where it's processed
Ceylona runs on Google's Firebase platform, which may process and store data outside Sri Lanka as part of its normal operation. We choose providers that meet industry-standard security practices, wherever they're located.
Keeping it secure
Traffic to the site is encrypted. Payment details go straight to PayHere's own secure page and never touch our servers. Access to customer data inside Ceylona is limited to what each team member's role actually requires. If a data breach is ever likely to put you at risk, we'll tell you directly and without undue delay.
Children
Ceylona is not directed at children, and we don't knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we'll remove it.
Your rights
Email privacy@ceylona.lk to see, correct or delete what we hold about you. We respond within 30 days. If you're in Sri Lanka, these rights are also protected under the Personal Data Protection Act.
Changes to this policy
If we make a material change to how we use your data, we'll post the update here and change the date at the top. Using the site after a change means you accept the update.