Privacy Policy

Last updated: 19 September 2026

This policy explains what personal information Sweet Sip collects when you use this website and place an order, why we collect it, who we share it with, how long we keep it, and how you can see, correct or delete it.

1. Who we are

This store is run by Sweet Sip, Colombo 15, Sri Lanka. We are the “controller” of the personal data described here under Sri Lanka’s Personal Data Protection Act, No. 9 of 2022.

Questions or requests: email [BUSINESS EMAIL].

2. What we collect

When you place an order

• Your name, email address and phone number.
• Your delivery city and address.
• What you ordered, the shipping speed and payment method you chose, your order number and the time of the order.

When you write a review

• Your star rating, your comment (if you write one) and the name you choose to show. These are published on our website once we approve the review.
• Your order number and email, only to check that you bought the product and it was delivered. They are never shown. We keep the link between your review and your order as a record that the review is genuine.

Automatically

• Security check. Checkout and the review form use Cloudflare Turnstile to tell people from automated bots. It processes technical signals from your browser and device for that purpose only.
• Server logs. The companies that host and deliver this site record technical data such as your IP address, browser type and the pages requested, for security and to keep the site running. Fonts are loaded from Google Fonts and code libraries from jsDelivr, which also receive your IP address.

Stored only on your device

Your bag and saved items are kept in your browser’s local storage so they survive moving between pages. They stay on your device and are not linked to you. Clearing your browser’s site data removes them.

What we do not do

• We do not use advertising or analytics cookies, tracking pixels or cross-site tracking.
• We do not sell or rent your personal information.
• We do not send marketing messages. If we ever offer them, we will only send them to people who have opted in, and every message will have a one-click unsubscribe.
• We do not make automated decisions about you that have legal or similar effects.

3. Why we use it

• To take, prepare and deliver your order and collect payment. This is necessary to perform our contract with you.
• To contact you about your order by WhatsApp, phone or email.
• To publish your review and show that it comes from a real, delivered order. You choose to send it, and you can ask us to remove it at any time.
• To prevent fraud and spam orders, which is our legitimate interest in keeping the store safe.
• To keep sales and accounting records that the law requires.

4. Who we share it with

We share personal information only with the service providers we need to run the store, and only what each one needs:

• Supabase: stores our product and order database (servers in Australia).
• Vercel: hosts this website.
• Cloudflare: runs the security check on checkout and the review form.
• Telegram: sends each new order, including your name, contact and delivery details, to our staff so we can prepare it, and alerts us to new reviews (rating, comment, the name shown and the order number).
• WhatsApp (Meta): when you message us to confirm an order.
• Our delivery courier: your name, phone number and address, to deliver your parcel and collect Cash on Delivery payments.
• Our bank: when you pay or we refund by bank transfer.

We may also disclose information where the law requires it, for example to a court or regulator.

5. International transfers

Some of these providers store or process data outside Sri Lanka, including in Australia and the United States. We use established providers that encrypt data in transit and restrict access to it, and we limit what we send to what each service needs.

6. How long we keep it

• Order records: for as long as Sri Lankan tax and accounting law requires us to keep sales records. After that we delete them or strip out anything that identifies you.
• Reviews: shown for as long as the product is listed, or until you ask us to remove yours. The order link is kept with it.
• Order alerts in Telegram and WhatsApp chats: deleted once the order is complete and any refund or complaint is settled.
• Security-check and server-log data: kept by those providers for their own short security retention periods.

7. Children

Our store is not directed at children. You must be 16 or older to place an order. If you are 16 or 17, you may only order with the permission of a parent or guardian, who is responsible for the order. We do not knowingly collect personal information from anyone under 16. That includes children under 13, whose data is protected by laws such as the US Children’s Online Privacy Protection Act (COPPA).

If you believe a child under 16 has given us personal information, email [BUSINESS EMAIL]. We will delete it promptly and cancel any order it relates to.

8. Your rights

Under the Personal Data Protection Act you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is wrong or incomplete;
• delete your information (see the next section);
• stop or restrict using it, or withdraw consent you have given.

You can also complain to the Data Protection Authority of Sri Lanka. We would appreciate the chance to put things right first.

9. How to ask us to delete your data

1. Send the request. Email [BUSINESS EMAIL] with the subject “Data deletion request”. Include your order number(s) if you have them, and the email address or phone number you ordered with.
2. We confirm it’s you. To stop anyone deleting or reading someone else’s data, we will reply to the contact details on your order, or ask you to confirm a detail only the customer would know.
3. We acknowledge it within 7 days.
4. We complete it within 21 days of confirming who you are. We delete your details from our order database, order alerts and chats, and ask our service providers to do the same where they hold a copy.
5. We tell you what we did. If the law requires us to keep something, such as a sales record for tax purposes, we tell you what we kept and why. We keep it locked away and use it for nothing else, then delete it when the legal period ends.

An order that hasn’t been delivered or refunded yet can’t be deleted until it’s finished. We’ll tell you if that applies.

10. Security

The site is served over HTTPS. Order data is protected by database access rules, and our staff dashboard requires two-factor authentication. No system is perfectly secure. If a breach puts your information at risk, we will tell you and the authorities as the law requires.

11. Changes to this policy

If we change this policy, we will update the date at the top. For significant changes, we will also show a notice on the site.