Privacy Policy

What we collect

To log you in and process a booking, we collect your mobile number or email address (whichever you sign in with), the name(s) you enter for each ticket, and your booking and payment history. If you register as a bus operator, we also collect your business name and the NTC permit number you provide.

How we use it

• To verify your phone number or email when you log in (a one-time code, not a password).
• To create and manage your bookings, and calculate the correct NTC-based fare.
• To send your ticket and booking updates by SMS or email, whichever you signed in with.
• To let the bus operator you booked with see who is on their trip — name and seat only, for that trip.
• To keep a record of admin actions (like approving an operator) for accountability.

Who we share it with

We don't sell your data. It's shared only where a booking actually requires it:

• The bus operator you book with — your name, seat, and phone number (if you signed in with one), only for their passenger list and to contact you about that trip.
• Our SMS provider (SMSlenz.lk) or email provider (Resend), to deliver your OTP code and ticket — whichever you signed in with.
• Our payment gateway, to process payment — we never see or store your full card or bank details ourselves.

How we protect it

Login codes and session tokens are never stored as plain text — only a cryptographic hash. A payment is only ever confirmed by a verified message from the payment gateway itself, never by what your browser reports, which protects against a booking being marked paid when it wasn't.

Your choices

You can see your own booking history once logged in. To ask a question about your data, or request it be deleted, contact us — see the Contact Us page.