eSewa

Legal

Privacy Policy

Last updated: 24 June 2026

1. Who we are

eSewa ("we", "us", "our") is an independent online platform that provides digital services to Sri Lanka's government servants across multiple professions. We are not affiliated with, endorsed by, or acting on behalf of any government ministry, department, or statutory body.

For privacy enquiries, contact us at privacy@esewa.lk.

2. Information we collect

Account information

When you register, we collect your email address, password (stored as a salted hash — never in plaintext), and the profession category you select.

Profile information

To use platform services, you provide your full name, current posting and district, profession details, service grade, and mobile phone number. Additional fields may apply depending on your profession and the services you use.

Verification documents

If you apply for Verified status, you upload images of your National Identity Card (front and back), a selfie holding your NIC, and an appointment or service letter. These images are stored encrypted and are used solely for identity verification by our reviewers.

Service request details

Information you enter when using platform services — for example, your current posting, desired destination, and any notes submitted as part of a service request.

Messages

The content of conversations you have with other government servants through the in-app messaging system.

Payment information

If you purchase credits, your payment is processed by PayHere. We do not receive or store your card details. We retain a record of the transaction amount, date, and outcome.

Usage data

Timestamps of logins, pages visited, and actions taken (e.g., expressing interest, dismissing a match). IP address and user agent are logged for security purposes.

3. How we use your information

  • —To create and maintain your account.
  • —To run matching algorithms and surface compatible partners where applicable.
  • —To verify your identity and award the Verified badge.
  • —To facilitate in-app messaging between government servants using the platform.
  • —To process credit purchases and maintain transaction records.
  • —To send you in-app and email notifications about matches, messages, and account events.
  • —To enforce our Terms of Service and investigate reported accounts.
  • —To improve the platform and diagnose technical issues.

We do not sell your personal data. We do not use your data for advertising.

4. What other users can see

Where matching is available, other users may see your current district, service details relevant to the request, service grade band, and Verified status.

Your name, NIC number, phone number, and email address are never shown to other users. They may be shared inside a conversation only if you choose to share them yourself.

5. Data storage and security

Your data is stored on Supabase infrastructure hosted within the European Union (Frankfurt region). Data in transit is encrypted with TLS 1.2+. Verification document images are stored with server-side encryption. Database backups are retained for 30 days.

Passwords are never stored in plaintext. We use bcrypt hashing via Supabase Auth. Session tokens are HTTP-only cookies and are not accessible to JavaScript.

6. Third-party services

We use carefully selected third-party providers for infrastructure, payments, and communications. These providers process your data only to the extent necessary to deliver their specific function:

  • —Cloud infrastructure — for hosting, database, authentication, and secure file storage.
  • —Payment processing — for handling credit purchases. We do not receive or store your card details; the payment provider's own privacy policy governs data submitted during checkout.
  • —SMS delivery — for sending phone verification one-time passwords. Your phone number is transmitted solely to deliver the OTP.

All third-party providers are bound by data processing agreements and are prohibited from using your data for their own purposes.

7. Data retention

We retain your account data for as long as your account is active. If you delete your account, your profile, service requests, and matches are deleted within 30 days. Message history is retained for 90 days after account deletion to allow the other party to retrieve any shared contact details they may need. Verification documents are deleted within 14 days of account deletion. Transaction records are retained for 7 years to comply with financial record-keeping obligations.

8. Your rights

You may at any time:

  • —Access a copy of the personal data we hold about you.
  • —Request correction of inaccurate data.
  • —Request deletion of your account and associated data.
  • —Withdraw consent for processing that relies on consent (e.g., marketing emails).
  • —Object to processing we carry out for legitimate interests.

To exercise any of these rights, email privacy@esewa.lk. We will respond within 30 days.

9. Cookies

eSewa uses strictly necessary cookies only: a session cookie to keep you logged in, and a CSRF token cookie for security. We do not use advertising or analytics cookies.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified via an in-app notification and, where appropriate, by email. Continued use of the platform after the effective date constitutes acceptance of the updated policy.