Privacy Policy

Who we are

Vemlet provides software that vehicle rental operators use to run their businesses in Sri Lanka ("Vemlet", "we", "us", "our"). This Privacy Policy explains how we handle personal data when you use our website and application.

Vemlet is operated by AHAMED ASARD ALTHAF AHAMED, of B 39/2, Maththamagoda, Kotiyakumbura.

We handle personal data in two different roles. For the account details of the operator who creates a Vemlet account, we act as a data controller. An operator also enters personal data about their own customers and drivers. Examples are names, National Identity Card details and driving licence details. For that data, we act as a data processor for the operator. The operator stays the data controller of that data. Section "Data that operators enter about others" below explains this further.

This policy refers to the Personal Data Protection Act, No. 9 of 2022, as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025 (the "PDPA").

The personal data we collect

Operator account data. When you create and use a Vemlet account, we collect your name, business name and mobile number. We also collect related account and settings information. We use your mobile number and SMS codes to sign you in. Vemlet records when you sign in, when you last opened the app and on how many days you used it. We use this information to help you and to find accounts that are no longer used.

Data that operators enter about others. Operators use Vemlet to record information about their customers and drivers. This may include names, phone numbers, National Identity Card numbers and images, driving licence numbers and images, vehicle condition photos, selfies and signatures. It may also include the location and time recorded at vehicle handovers and returns. Operators enter this data. We store and process it on the operator's instructions. The app removes the location and other hidden details stored inside each photo before uploading it.

Rental and usage records. We store bookings, agreed charges, rental payments, deposits and the use of deposits for charges. We also store refunds, expense bills, workshop bills and payment corrections. These records include amounts, dates, payment methods, references and details of who was paid. They can also include photos of bills or proof of payment, if the operator adds them. We also record technical information from the use of the app, such as device and log information.

Subscription and billing records. We record the plan and vehicle limit you choose and the billing name and address you give us. We also record the confirmations that set your subscription terms, your service periods, invoices and credit notes. When you pay by bank transfer, we record the amount, the date, the bank transaction reference and the transfer details we need to match it. We also record which invoices each payment paid, refunds, corrections, evidence references and the audit records that explain each change. We do not collect card details or make automatic charges.

Founder support and payment messages. You can use WhatsApp to ask for a plan change, a cancellation, a renewal or help to match a transfer. The founder records the bank facts after checking them. The founder also records a short reference to your message. A screenshot or a message alone does not confirm a bank payment. Do not send sign-in codes or customer identity documents in sales or support chats. Do not send financial screenshots there unless you hide the private details first.

Location data. When an operator's work process needs it, the app records the place where a vehicle handover or return happens. This is for the operator's own records.

Why we process personal data and our legal reasons

We process personal data to provide and run the service and to check who is signing in. We process it to make the documents and records that operators rely on. We process it to give support and to take payment for the service. We also process it to keep the service secure and to meet our legal duties. Our legal reason depends on the data. It may be that we need the data for our contract with the operator. It may be the consent of the operator or of the person the data is about. It may be our legitimate interests in running the service and keeping it secure. Or it may be to meet a legal duty.

Data that operators enter about others

When an operator enters personal data about their customers or drivers, that operator is the data controller for that data. The operator is responsible for having a legal reason to collect and use it. The operator is also responsible for informing those people, as the PDPA requires. Vemlet acts as a processor. We process that data only to provide the service to the operator and only on the operator's instructions. If you are a customer or driver of a rental operator and want to use your rights over your data, please contact that operator. That operator controls your data. We will help the operator to answer these requests.

If a customer or driver asks Vemlet to delete their details, we send the request to the operator. The operator decides what to do and replies to the customer or driver. When an operator removes a customer in the app, Vemlet keeps the customer's history for the operator's records. When an operator's account is deleted, we also delete the records about their customers and drivers.

How we store and protect personal data

We store personal data on systems run by Cloudflare, Inc. The service uses HTTPS. It checks who is signed in before it shows private account records. It records supported rental changes, billing actions and technical errors; this is not a complete log of every access to personal data. No way of storing or sending data is completely secure. But we take reasonable steps that suit the kind of data we hold.

The app keeps your sign-in session and some records it loaded earlier on your device. These saved records can include names and phone numbers. The app keeps them for no more than 24 hours. The app deletes them when you sign out. It also deletes them when Vemlet no longer accepts your sign-in. Protect access to your device, especially if you share it with another person.

International transfer of personal data

Our hosting provider, Cloudflare, runs a global network. Personal data may be stored or processed on servers outside Sri Lanka. A Vemlet address does not mean data is stored only in Sri Lanka.

How long we keep personal data

We keep an account's records while the account is open. When a trial or paid service ends, that alone does not delete any records. Section "Your rights" below explains how an owner can ask us to delete an account.

While your service is not active, standard Vemlet document links stop working 60 days after the time service ends. Document links on your domain stop when Pro access ends. These limits do not delete private documents or financial records. They are not a general plan for how long we keep rental data.

Unused accounts. We may delete a trial account at least 30 days after its trial ends. We do this only if nobody has used the account in the last 30 days. We may also delete an account at least 6 months after its paid service ends. We do this only if nobody has used the account in the last 6 months. Before we delete an unused account, we send the owner a message and wait 14 days. If the owner replies that they want to keep the account, we keep it. If the owner opens the app before we delete it, we also keep it. If the owner replies that we may delete it, we delete it without waiting 14 days.

When an account is deleted, we delete its records, photos, documents and website. We keep only two things from the account:

Vemlet's billing records. These are the invoices, credit notes, payments and refunds for the Vemlet subscription, with their history. We keep each record for 10 years after the end of its tax year. A tax year starts on 1 April and ends on 31 March. Then we delete the record. If a later record refers to it, for example a payment made against an invoice, we keep it until we delete that later record.

A short deletion note. The note holds the business name, the owner's name and the registered mobile number. It also holds the date, the reason and a reference to the request or notice. We keep the note for 5 years to show that we deleted the account. It helps us recognise the mobile number if it is used for a new account.

Our hosting provider keeps backup copies for up to 30 days. Deleted data leaves these backups within 30 days. We do not restore a deleted account.

Copies of website images can stay stored on the internet for a limited time after we delete the website. Vemlet does not link to these copies.

Sharing personal data

We do not sell personal data. We share personal data only in these cases. We share it with service providers who help us run the service. These include our hosting provider (Cloudflare) and our SMS provider (Text.lk), which sends our messages. We share it with WhatsApp (Meta) when you choose to contact us through WhatsApp. We share it when the law requires us to. You pay for your subscription by manual bank transfer. We do not collect card details. We do not take money automatically, put a hold on a card or use a payment gateway.

Operators decide which business details, vehicle information, rates and contact details to publish on their website. They also choose whether to share rental documents. Agreements may contain identity details and signatures. Anyone with a working public document link can read the document until the link expires or is stopped. This includes someone who gets the link from another person. If a link is stopped, copies that people already downloaded stay with them. A document shared as a PDF file stays with the person who received it, whatever happens to the link. Before you share through WhatsApp or another service, check the document and the person you send it to.

If Vemlet changes owner

Vemlet may move to a registered business or to a company that its founder forms. If that happens, your account and your records move with Vemlet. This policy continues to apply. We will tell you before it happens.

Your rights

Subject to the PDPA, you have the following rights. You have the right to be told how your personal data is processed and to access your personal data. You have the right to have wrong data corrected and to ask for your data to be deleted. Where processing is based on your consent, you have the right to withdraw that consent. You have the right to object to some processing or to ask for it to be limited. You have the right to ask for a copy of your data in a form that you can move. To use any of these rights, contact us using the details below. You also have the right to make a complaint to the Data Protection Authority of Sri Lanka.

We handle a data request through the contact details below. In the app, you can download private documents. You can also download a CSV file of up to 5,000 money transactions at a time. These downloads are not a full export of your rental data. They do not export the performance reports either.

Deleting your account. To delete your account, send us a WhatsApp message from your registered mobile number. We check that the request comes from that number. Any paid service must end first. You must still pay any unpaid Vemlet invoices.

Before we delete your account, download the documents and money records you want to keep. We delete the account within 7 days and send you a message when it is done. Section "How long we keep personal data" above explains what we keep. Deleting an account cannot retrieve copies that other people already downloaded or saved.

Children

Vemlet is a business tool. It is not made for children. We do not knowingly collect personal data from children.

Changes to this policy

We may update this Privacy Policy. When we do, we will change the effective date at the top of this page. Where appropriate, we will also tell operators.

Contact us

For any question about this policy or to use your rights, contact us at hello@vemlet.lk or on WhatsApp at +94 71 367 3679.