Privacy policy

What we collect

Your name, email, mobile number, delivery addresses, order history, payment references and basic technical data (IP address, browser) used for security and fraud prevention. We never store full card numbers or CVV codes.

Why we collect it

• To process, pack and deliver your orders
• To send order and delivery updates
• To verify payments and prevent fraud
• To answer support requests and handle returns
• To improve the store, only in aggregated form
• To send marketing emails — only if you opted in, and you can unsubscribe at any time

Who we share it with

Couriers (name, address, phone for delivery), payment providers (amount and reference for settlement), and our email/SMS delivery provider. We do not sell personal data.

Cookies

We use a session cookie to keep you signed in and remember your cart, plus a long-lived cookie when you tick "remember me". These are strictly necessary for the store to work; there is no third-party advertising tracker on this site.

How we protect it

• Passwords are hashed with bcrypt and never logged
• All database access uses prepared statements
• Sensitive forms are protected with CSRF tokens and rate limiting
• Uploaded files are stored outside the public web root and served through an access-checked endpoint
• Payment pages are served over HTTPS by the gateway itself

How long we keep it

Order records are kept for seven years to satisfy accounting requirements. Marketing preferences are kept until you unsubscribe. You can ask us to delete your account details that are not needed for tax or legal reasons.

Your rights

You can request a copy of your data, correct it, or ask us to delete it. Email hello@softmymarket.hstn.me and we will respond within 30 days.

Controller: SoftMyMarket, 128 Galle Road, Colombo 03, Sri Lanka.