Privacy notice

1. Who we are

SafeReach runs safereach.lk and is responsible for the personal data described here (the “controller” under the PDPA). For any privacy question or request, email info@safereach.lk. WhatsApp: 076 160 4666.

2. If you scan a SafeReach tag

You don’t need an account and we never ask for your name. When you send a report, we receive:

• the reason you chose and any message you type;
• a photo, only if you tick the box to include one;
• your approximate location, only if you allow it;
• an email address or phone number, only if you add one, so we can send you the vehicle owner’s replies by SMS or email. The chat on your private link closes 1 hour after your report.

The vehicle owner sees your report and messages, but never your email address, phone number or location history.

To stop abuse, we keep a one-way scrambled code made from your internet address and browser details. It can’t be turned back into your internet address. After several reports from the same phone in a short time, we may ask you to complete a quick Cloudflare Turnstile check.

Photos can contain details your camera saved in them, such as the time and, on some phones, the place they were taken. Turn off location for your camera if you don’t want to share it.

If you use “Scan a tag” on our website, the camera is used only on your phone to read the QR code. Nothing from the camera is recorded or sent to us.

If you ask to see a vehicle’s documents and the owner agrees, you can view them online for a short time only. We record when they were viewed.

If you press SOS on a tag and send an alert, we send the vehicle owner and their emergency contact the time and, if you allow it, your location. If the owner allowed it, we show you their emergency contact’s name and number. We keep a record of each SOS, with the location, for 90 days.

3. If you have a SafeReach account

When you sign up and use SafeReach, we keep:

• your sign-in email address and/or the mobile number you sign in with (we text it a one-time code each time), and your account details;
• the vehicle details you enter (registration number, make, model, year, colour, nickname, category). You choose which of these people who scan your tag can see;
• documents you upload, such as a revenue licence or insurance certificate;
• emergency contacts for a vehicle, if you add them: each person’s name, relationship and mobile number. Add someone only with their agreement. We text them once to ask them to confirm, and again only if someone presses SOS on your tag or you tell them you’re OK. We show their number only if you allow it;
• your vehicle’s insurer, its accident line and your policy number, if you add them. The SOS page shows the insurer and accident line; the policy number only after someone confirms an emergency;
• how you want to be alerted (email, SMS, WhatsApp or app notification) and the address or number to use;
• tag orders: the recipient’s name, phone number and delivery address, and payment records such as bank transfer references and voucher codes;
• your subscription, renewals and the messages in your cases.

4. Why we use your data

• To pass messages between the person who scans a tag and the vehicle’s owner — the service you asked for.
• To deliver tag orders and manage subscriptions and payments — our agreement with you.
• To keep SafeReach safe: limiting repeated reports, blocking abusive users, handling abuse reports and keeping security records — our legitimate interest in preventing misuse.
• To keep accounting and tax records — a legal obligation.
• Where we rely on your consent (a photo, your location, a recovery contact), you can withdraw it at any time.

We do not sell personal data, show advertising or use tracking cookies. We count visits with Cloudflare Web Analytics, which doesn’t use cookies. The only cookie we set keeps you signed in.

5. Who processes data for us

These companies process data only to provide their service to us, under contract:

• Fly.io — runs our servers (Singapore).
• Neon — hosts our database (Singapore, on Amazon Web Services).
• Cloudflare — serves the website, stores photos and documents, runs the Turnstile check and counts visits.
• WorkOS — handles sign-in for account holders.
• Text.lk — sends SMS alerts and sign-in codes (Sri Lanka).
• Meta (WhatsApp Business Platform) — sends WhatsApp alerts, if you choose WhatsApp.
• Our email delivery provider — sends email alerts and receipts.
• Google, Apple or Mozilla — deliver app notifications to your browser, if you turn them on.

Some of these providers store or process data outside Sri Lanka. We use only providers that are bound by contract to protect it, as the PDPA requires for transfers abroad.

6. How long we keep it

• Reports, messages, photos and locations: 1 year, then deleted.
• A scanner’s recovery email or phone number: 30 days.
• Records of alerts we sent: 90 days.
• Security records (such as the scrambled code above): 180 days.
• SOS records, with the location: 90 days.
• Vehicle documents: moved to your recycle bin 1 year after you upload them (or when you delete them), then permanently deleted 30 days later.
• Account and vehicle details: while you have an account. When you ask us to delete it, we remove your details or make them anonymous.
• Tag orders, payments and the audit log of staff actions: 7 years, for accounting and accountability, even if you ask us to delete your account.
• Anything linked to an open abuse investigation is kept until the investigation is closed.
• Database backups: up to 7 days, so anything we delete is gone from the backups within 7 days.

7. Your rights

Under the PDPA you can ask us to:

• give you a copy of your personal data;
• correct or complete it;
• delete it;
• stop using it, or withdraw your consent.

If you have an account, go to Settings › Privacy › Data requests. Otherwise, email info@safereach.lk. We may need to confirm it is you, and we reply within 21 working days.

If we must keep some data (for example order records), we tell you which and why.

If you are not satisfied with our answer, you can complain to the Data Protection Authority of Sri Lanka.

8. How we protect it

• All connections to SafeReach are encrypted.
• Only staff who need to can see personal data, and every staff action is logged.
• Shared documents are shown with a watermark, can’t be downloaded from SafeReach, and the link stops working after a short time.

9. Children

You must be 18 or over to create a SafeReach account.

10. Changes to this notice

When we change this notice, we update the date at the top. If a change affects account holders significantly, we tell them before it takes effect.