How we look after your details
Last updated 10 October 2026
Business Plus Business (“B+B”, “we”) is a Sri Lankan company. This notice explains what personal details we collect when you use our website and app, why, who can see them, how long we keep them, and the choices you have. We follow Sri Lanka's Personal Data Protection Act, No. 9 of 2022.
In short: we only collect what we need to run B+B, we never sell your details, we never store card numbers, and you can ask us to see, correct or delete your details at any time by emailing [email protected].
What we collect, and why
| Who | What | Why |
|---|---|---|
| Everyone with an account | Name, email, phone number, country, profile photo (if you add one), password (stored scrambled; we can't read it) | To create your account, sign you in and contact you about your orders |
| Customers | Delivery addresses and their map location, orders, messages with businesses, ratings, bank transfer receipts you upload | To take, deliver and support your orders |
| Business owners | Business details, products, opening hours, bank account details for payouts, your team members | To run your store and pay you |
| Delivery partners | Vehicle, rates, service areas, and your location while you're on a delivery | To offer you jobs and let customers follow their delivery |
| Store Creator applicants | Name, email, mobile number, NIC number, district and city, age, gender, current status, CV | To check you meet the requirements and review your application |
| Card payments | Handled by PayHere. B+B never sees or stores your card number; we keep only a reference and the amount | To take payment safely |
| Optional | Phone notifications (if you turn them on); anonymous app usage (only if you say yes to “Help improve B+B”, with no name or account attached) | To tell you about orders, and to improve the app |
Who can see your details
- Only the people involved in an order see its details: the customer, the business and its team, and the delivery partner on that order.
- Store Creator NIC numbers and CVs are seen only by the applicant and the B+B hiring team. Lists show only the last 4 digits of the NIC, and every time a full NIC or CV is opened it's recorded.
- B+B staff see what they need to support you and keep B+B safe.
- We use trusted services to run B+B: Supabase (secure database and file storage), Cloudflare (website), PayHere (card payments), Google Maps (addresses and maps) and Resend (emails). They handle your details only to provide their service to us.
- We never sell your details or share them for advertising.
How we protect them
- Everything travels encrypted (https) and is stored on secure servers.
- Database rules let each person see only what they're allowed to see.
- Private files (bank receipts, delivery photos, CVs) are kept in private storage and are never public links.
- We don't put NIC numbers or CVs in emails.
How long we keep them
- Your account: while you use B+B. If you delete your account, it's switched off straight away and removed for good after 30 days (in case you change your mind).
- Store Creator applications: if an application isn't successful, the NIC, CV and other details are deleted 6 months after our decision. Unfinished CV uploads are deleted after 2 days. Everything is deleted when the account is removed.
- Help assistant questions: 90 days. Anonymous usage: up to 13 months.
- Records we must keep by law (for example payment records) are kept for as long as the law requires.
Your choices and rights
- See or correct your details: most are on your Account page; for anything else, email us.
- Delete your account: in the app, go to Account → Delete my account, or email us.
- Withdraw your consent (for example, to notifications or usage data) at any time in the app.
- Ask a question or make a complaint: email [email protected]. We reply within a few days. You can also contact Sri Lanka's Data Protection Authority.
Contact
Business Plus Business · [email protected] · +94 77 789 9999