Privacy Policy

Publication draft. The legal issuer name, address, and effective date must be confirmed before this policy is published or subscription money is accepted. Data handling, retention and applicable legal safeguards also need review before real customer data is entered.

Who we are

Vemlet provides software that vehicle rental operators use to run their businesses in Sri Lanka ("Vemlet", "we", "us", "our"). This Privacy Policy explains how we handle personal data when you use our website and application.

We handle personal data in two different roles. For the account details of the operator who signs up for Vemlet, we act as a data controller. For the personal data that an operator enters about their own customers and drivers (for example, names, National Identity Card details, and driving licence details), we act as a data processor on that operator's behalf; the operator remains the data controller of that data. Section "Data that operators enter about others" below explains this further.

This draft refers to the Personal Data Protection Act, No. 9 of 2022, as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025 (the "PDPA"). Publication of this draft does not confirm that the required legal and data handling review is complete.

The personal data we collect

Operator account data. When you create and use a Vemlet account, we collect your name, business name, mobile telephone number, and related account and settings information. We use your telephone number and SMS codes to sign you in.

Data that operators enter about others. Operators use Vemlet to record information about their customers and drivers. This may include names, telephone numbers, National Identity Card numbers and images, driving licence numbers and images, condition photographs, selfies, signatures, and the recorded location and time of vehicle handovers and returns. Operators enter this data; we store and process it on the operator's instructions.

Rental and usage records. We record bookings, deposit collection and outcomes, return charges, collected return balances, expenses and other supported entries, together with technical information generated when the application is used, such as device and log information.

Subscription and billing records. We record your selected plan and limit, the billing name and address you provide, the confirmations that establish subscription terms, service periods, invoices and credit notes. When you pay by bank transfer, we record the amount, date, bank transaction reference and display details needed to match it, together with receipt allocations, refunds, reversals, evidence references, and the audit operations that explain each change. We do not collect card details or make automatic charges.

Founder support and payment messages. You may use WhatsApp to request a plan change, cancellation, renewal or help matching a transfer. The founder records verified bank facts and a short reference to the supporting message. A screenshot or message does not itself verify a bank payment. Do not send login codes, renter identity documents or unredacted financial screenshots in sales or support chats.

Location data. Where an operator's workflow requires it, the application records the location at which a vehicle handover or return takes place, for the operator's own record.

Why we process personal data and our lawful basis

We process personal data to provide and operate the service, to authenticate users, to generate the documents and records operators rely on, to provide support, to take payment for the service, to keep the service secure, and to comply with our legal obligations. Depending on the data, our lawful basis is the performance of our contract with the operator, the operator's or the data subject's consent, our legitimate interests in operating and securing the service, or compliance with a legal obligation.

Data that operators enter about others

Where an operator enters personal data about their customers or drivers, that operator is the data controller for that data and is responsible for having a lawful basis to collect and use it, and for informing those individuals as required by the PDPA. Vemlet acts as a processor and processes that data only to provide the service to the operator and on the operator's instructions. If you are a customer or driver of a rental operator and wish to exercise your rights over your data, please contact that operator, who controls it. We will assist the operator in responding to such requests.

How we store and protect personal data

Personal data is stored using the infrastructure of Cloudflare, Inc. The service uses HTTPS and authenticated access controls for private account records. It records supported rental changes, billing actions and technical errors; this is not a complete log of every access to personal data. No method of storage or transmission is completely secure, but we take reasonable measures appropriate to the nature of the data we hold.

The app stores the sign-in session and some previously loaded records on your device. The offline record cache can include names and phone numbers and has a maximum age of 24 hours. It is cleared on sign-out or when the app receives an unauthorised response. Protect access to your device, especially when it is shared with another person.

International transfer of personal data

Our infrastructure provider, Cloudflare, operates a global network, and personal data may be stored or processed on servers located outside Sri Lanka. A Vemlet address does not mean data is stored only in Sri Lanka. The applicable transfer arrangements and safeguards require review before this draft is finalised and real customer information is entered.

How long we keep personal data

We keep personal data for as long as an operator's account is active and as long as needed to provide the service, and thereafter for any period required to comply with our legal obligations, resolve disputes, and enforce our agreements. Operators may request deletion of data as described below, subject to records we are required to retain.

Subscription invoices, credit notes, confirmed payment and allocation history, refunds, reversals, and their audit records are retained for at least five years unless professional advice or law requires a longer period. Ending a trial or paid service does not automatically delete these records. While service remains inactive, public access through standard Vemlet document links stops 60 elapsed days after service ends. Document links on your domain stop when Pro access ends. These limits do not delete private documents or financial records and are not a general rental data retention schedule.

Sharing personal data

We do not sell personal data. We share personal data only with service providers who help us operate the service, including our infrastructure provider (Cloudflare) and our SMS provider (Text.lk) for sending messages, and WhatsApp (Meta) when you choose to contact us through WhatsApp, and where we are required to do so by law. Subscription payment is made by manual bank transfer. We do not collect card details, make automatic charges, place payment holds, or use a payment gateway.

Operators decide which business details, vehicle information, rates and contact details to publish on their website. They also choose whether to share rental documents. Agreements may contain identity details and signatures. Anyone with a valid public document link can read the document until access expires or is revoked, including someone to whom the link is forwarded. Revocation cannot retrieve copies already downloaded. A document shared as a PDF file remains with the recipient independently of the link. Review its contents and the intended recipient before sharing through WhatsApp or another service.

Your rights

Subject to the PDPA, you have the right to be informed about how your personal data is processed, to access your personal data, to have inaccurate data corrected, to request erasure of your data, to withdraw consent where processing is based on consent, to object to or request restriction of certain processing, and to request a copy of your data in a portable form. To exercise any of these rights, contact us using the details below. You also have the right to lodge a complaint with the Data Protection Authority of Sri Lanka.

A data request is handled through the contact route below. The app provides private document downloads; it does not currently provide a complete rental data export or report export.

Children

Vemlet is a business tool and is not directed at children. We do not knowingly collect personal data from children.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the effective date at the top of this page and, where appropriate, notify operators.

Contact us

For any question about this policy or to exercise your rights, contact us at hello@vemlet.lk or on WhatsApp at +94 71 367 3679.