Privacy Policy

Who we are

Hemli Tours is a Sri Lankan travel company and marketplace operating at hemlitours.com. We are the data controller for the information described here. Questions go to hemlitours@gmail.com.

What we collect

Account details — name, e-mail address, phone number, country and password (stored only as a one-way hash) when you create an account.
Sign-in with Google, Facebook, Apple or X — the provider shares your name, e-mail address and profile photo. We store those and the provider’s account identifier so you can sign in again. We never receive your password for those services and never post on your behalf.
Enquiries and bookings — the details you give us to plan or book a trip: dates, travellers, pick-up points, special requests, and the contact details we use to reach you.
Supplier applications — business name, registration and licence numbers, contact details and the listings you create.
Technical data — sign-in device and approximate location (from your IP address) so you can review and sign out your own sessions; the language and currency you choose.

How we use it

To run your account, keep it secure and send you confirmation links, password resets and security notices.
To plan, quote and fulfil trips, and to pass booking details to the operator or supplier providing the service.
To answer your questions on e-mail or WhatsApp.
To verify supplier businesses before their listings go public.
To keep the site working, prevent abuse and meet legal obligations.

We do not sell your personal information and we do not use it for third-party advertising.

Who we share it with

Only the people needed to deliver what you asked for: the supplier or driver-guide serving your booking, our e-mail delivery provider, our hosting and database providers, and authorities where the law requires it. Each receives only what their task needs.

How long we keep it

Account data is kept while your account exists. Booking and enquiry records are kept for as long as we need them for the trip, follow-up and our legal and tax obligations. You can ask us to delete your account at any time.

Your choices and rights

Update your name, phone, country and password, and sign out other devices, under My account.
Ask for a copy of your data, a correction, or deletion by writing to hemlitours@gmail.com.
Sign-in providers: you can revoke Hemli Tours’s access at any time in your Google, Facebook, Apple or X account settings.

Cookies

We use only the cookies needed to keep you signed in and remember your language, currency and location choices. We do not use advertising cookies.

Security

Passwords are hashed, sensitive integration credentials are encrypted at rest, connections are encrypted with TLS, and sign-in attempts are rate-limited. No system is perfectly secure; if you believe your account has been compromised, change your password and contact us.

Children

Our services are for adults making travel arrangements. We do not knowingly collect information from children under 16.

Changes

If this policy changes materially we will update the date above and, for significant changes, tell account holders by e-mail.