Privacy Policy

Wonder of Ceylon ("we", "us") runs wonderofceylon.com and its mobile app. This policy explains what personal information we collect, why, who we share it with, how long we keep it and the rights you have. We are responsible for your information as the data controller.

The short version

• You can use almost everything on the site without giving us any personal information.
• We only collect what you choose to send us, such as a contact form message.
• We use analytics cookies to improve the site, and you can switch them off at any time.
• We do not sell your personal information or use it for advertising.

What we collect and why

Contact and listing forms

When you contact us or ask us to add or correct a listing, we receive your name (if you give it), email address, your message and any business details you enter. We also store your browser type and a scrambled (hashed) version of your IP address rather than the address itself, which helps us block spam and abuse. We store the message in our database and forward it to our team by email so we can reply.

AI trip planner and AI travel translator

The trip details you enter in the planner, and the text you translate, are sent to Google's Gemini AI service to generate your itinerary or translation. We do not store your planner inputs or translations on our servers. If you use voice input in the translator, your speech is converted to text by your browser's own speech service (for example Google in Chrome or Apple in Safari) before it reaches us. Please do not enter sensitive personal information such as health details, passport numbers or payment details into these tools.

If you share a planner itinerary, the plan is packed into the link itself. We do not store it, but anyone you give the link to can read it.

WhatsApp and phone

If you tap a WhatsApp or call button, you leave our website and the conversation happens in WhatsApp or your phone app. WhatsApp is run by Meta, and its own privacy policy applies to that conversation. Messages you send us there are used only to answer your request.

Security and service logs

Like every website, our hosting provider processes your IP address and basic request details to deliver pages and protect the site. To stop abuse of our AI tools, we briefly count requests per IP address in memory; these counts are discarded within 24 hours. We also keep error logs that do not contain your form contents.

Maps, videos and business photos

Some pages show content loaded directly from other services: Google Maps and OpenStreetMap maps, YouTube videos (in YouTube's privacy-enhanced mode) and business photos hosted by Google. When that content loads, the service receives your IP address and basic browser details, and may set its own cookies, under its own privacy policy.

Cookies and analytics

We do not set advertising cookies. We use two analytics tools to understand how the site is used and improve it:

• Google Analytics 4 (Google): counts visits and shows which pages are useful. Ad features are switched off.
• Microsoft Clarity (Microsoft): records anonymised interactions such as clicks and scrolling, so we can spot pages that are confusing or broken.

These tools are on by default so we can see how the site is used and improve it. You can switch them off below at any time, and they will stay off in this browser.

We remember your choice in your browser.

Who we share information with

We use trusted service providers to run the site. They process data on our behalf:

• Vercel: website hosting and delivery.
• Supabase: our database, including stored contact messages.
• Google: the Gemini AI service (planner and translator), Google Maps, YouTube and business photos shown on our pages, and Google Analytics.
• OpenStreetMap: maps on some directory pages.
• Microsoft: Clarity analytics.
• Zoho Mail: delivers contact form messages to our inbox.

When you ask us to arrange a service such as a transfer or a tour, we share only the details needed to provide it with the transport or tour provider who will deliver it, and we tell you who that is. We do not sell personal information, and we never share it for advertising.

We may disclose information if the law requires it, or to protect the safety of our users, our providers or the public.

International transfers

Our service providers may process data in countries other than Sri Lanka or your own country. Where the law requires it, we rely on the safeguards those providers offer, such as standard contractual clauses for data from the European Economic Area, the UK and Switzerland.

Our legal reasons for using your information

• Taking steps at your request: answering your enquiry or arranging a service you asked for.
• Our legitimate interests: keeping the site secure, preventing spam and abuse, and running and improving our tools, including analytics, which you can switch off at any time.
• Legal obligations: where a law requires us to keep or disclose information.

How long we keep it

• Contact messages: for as long as we need them to deal with your enquiry and any follow-up. You can ask us to delete yours at any time.
• Planner and translator text: not stored by us.
• Request counts for abuse protection: discarded within 24 hours.
• Analytics data: kept within Google Analytics and Microsoft Clarity under their retention settings, unless you switched analytics off.

Your rights

Depending on where you live, including under the EU and UK GDPR and Sri Lanka's Personal Data Protection Act No. 9 of 2022, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is wrong or incomplete;
• delete your information;
• restrict or object to how we use it;
• withdraw consent you have given, without affecting earlier use.

Email us at contact@wonderofceylon.com and we will reply within one month. We may need to confirm your identity first. You also have the right to complain to a data protection authority, such as the Data Protection Authority of Sri Lanka or the supervisory authority in the country where you live, although we would appreciate the chance to resolve your concern first.

How we protect your information

Data travels over encrypted connections (HTTPS). Visitors cannot access our database directly; only our own servers can read or write it, access is limited to the systems and people who need it, and we review the security of the platform regularly. No system is perfectly secure, so if we ever become aware of a breach that affects you, we will tell you and the relevant authorities where the law requires it.

Children

Our services are meant for adults planning travel. We do not knowingly collect personal information from children under 16. If you think a child has sent us their information, please contact us and we will delete it.

Changes to this policy

We will update this page when we change how we handle personal information, for example when we add accounts, reviews or bookings, and change the date at the top. Important changes will also be shown on the site.

Contact us

Email contact@wonderofceylon.com, call or WhatsApp +94 74 322 4454, or use our contact page.