Privacy policy
Last updated
This policy explains what personal data FinanceMe.lk collects, why, and what you can do about it. FinanceMe.lk is operated by FinanceMe.lk (“we”, “us”). Questions go to [email protected].
Two kinds of data
Your account data. When a lending company signs up, we collect the names, email addresses and phone numbers of its staff, the company’s details, and billing records. We are responsible for this data.
Your borrowers’ data. Lending companies use FinanceMe.lk to record their borrowers: names, NIC numbers, phone numbers, addresses, photos of documents, loans, payments and the location where payments are collected. The lending company decides what to record and why; it is responsible for that data, and we process it only on its instructions to provide the service.
We process personal data in line with Sri Lanka’s Personal Data Protection Act No. 9 of 2022.
What we use data for
- To run the service: sign-in, loan records, receipts, SMS and email the lending company asks us to send.
- To bill the lending company and keep accounting records.
- To keep the service secure: activity logs, detecting misuse and investigating problems.
- To tell account holders about important changes to the service.
We do not sell personal data, and we do not use borrowers’ data for advertising or to build profiles for anyone else.
Who we share it with
Only the providers we need to run the service, each bound to protect the data:
- our server hosting provider,
- our SMS gateway, to deliver messages to borrowers and staff,
- our email provider, to deliver account and invoice emails,
- PayHere, to process subscription payments (we never see or store full card numbers),
- Google, only if you choose to sign in with Google.
We disclose data to authorities only when the law requires it.
How long we keep it
Account and loan records are kept while the lending company’s account is open. If a company closes its account, we keep its data for 90 days so it can export it or return, then delete it, except where we must keep billing records for tax purposes. Activity logs are kept for at least one year.
Security
Connections use HTTPS. Passwords are stored as one-way hashes. Each company’s data is separated and every request is checked against the company of the signed-in person. Staff access is controlled by role. See the security page for more.
Your rights
Borrowers who want to see, correct or delete their data should contact the lending company they borrowed from; we will help that company respond. Staff and account holders can contact us directly at [email protected] to access, correct or delete their data, or to object to how it is used. If you are not satisfied with our answer, you may complain to the Data Protection Authority of Sri Lanka.
Cookies
The website and app use only the cookies needed to keep you signed in and to remember your language. We do not use advertising cookies.
Changes
If we change this policy in a way that matters, we will email account owners before the change takes effect.