This policy covers the Gamana rider app (lk.gamana.rider), the Gamana driver app (lk.gamana.driver) and this website. It is published by STEER (PRIVATE) LIMITED, registered in Sri Lanka under number PV 00234358, at Colombo, Sri Lanka.
Gamana connects passengers with drivers. Doing that means knowing who you are, where you are, and where you want to go. This page says exactly how far that goes and where it stops.
What we collect
Everyone
- Your mobile number. This is your account. We send a one-time code to it to prove the number is yours. The codes themselves are stored only as a hash and expire after five minutes.
- Your name, so the person meeting you knows who to look for.
- Your language preference and whether your account is active.
- A notification token for your device, so we can tell you a driver has accepted. It identifies the installation, not you.
Passengers
- Your location while the app is open, to show nearby vehicles and set your pickup point. The rider app does not collect location in the background.
- Pickup and drop-off points, and the route taken, recorded as a series of coordinates for each trip.
- Places you save — home, work, anywhere you name.
- Fares, payments and receipts, including the method used.
- Messages you send your driver through the app, and ratings you leave.
Drivers
Everything above, and because driving people for money is a regulated activity:
- Your NIC number, and images of your NIC, driving licence, insurance certificate, police report and revenue licence. These are checked before you are approved and are visible only to staff reviewing applications.
- Your vehicle — plate, make, model, colour, year.
- Your location while you are online, including in the background, so that trips can be offered to the driver nearest the passenger and so a passenger can watch you approach. This continues while the app is minimised and stops when you go offline. Android shows a permanent notification the entire time it is happening.
- Your earnings, seat fees and payment records.
If you asked for early access
Separately from the apps, this website has a form for requesting an invitation to the closed test. If you used it we hold the email address you gave, whether you said you wanted to ride or to drive, the area you named if you gave one, and which page sent you to us.
It is used to send you an invitation and for nothing else — no newsletter, no advertising, and it is never passed to anyone. We delete it once the app is publicly available, or sooner if you ask: privacy@gamana.online.
This website, and analytics
This website uses Google Analytics to count visits and see which pages people read. It tells us how many people came, roughly where from, and what they looked at. It does not tell us who you are, and we do not connect it to your Gamana account or to anything in the apps — the apps themselves carry no analytics at all.
Google sets a cookie in your browser to recognise a return visit, and receives your IP address, which it shortens before storing. You can refuse it: browser settings, an ad blocker or Google’s own opt-out extension all stop it, and nothing on this site breaks if you do. Blocking it has no effect on booking a ride or driving.
Things we do not collect
- Your contacts, photos, call log or messages. The camera permission is used only when you choose to photograph a document.
- Recordings of in-app calls. Audio travels directly between the two phones and is never stored by us. The microphone permission exists for that call and nothing else.
- Card numbers. We do not currently take card payments.
- Advertising identifiers. We do not run ads and do not track you across other apps.
Why we are allowed to hold it
| What | Why | Basis |
|---|---|---|
| Number, name, location, trip history | To provide the ride you asked for | Performance of our contract with you |
| Driver documents and NIC | To verify who is carrying passengers | Legal obligation and public safety |
| Payments and ledger records | Tax, accounting and dispute resolution | Legal obligation |
| Emergency alerts and trip routes | Investigating incidents and safety reports | Protecting vital interests |
| Early-access email address | Sending you an invitation to the closed test | Consent, which you may withdraw at any time |
| Notification tokens | Telling you your driver is here | Performance of our contract with you |
Who else sees it
We do not sell your data. Nobody buys access to it. It reaches these parties only:
The other person on the trip
Your driver sees your first name, your pickup point and your destination. You see your driver’s name, photo, rating, vehicle and plate. Neither of you sees the other’s phone number — in-app calling connects you without revealing it.
Companies that run parts of the service
| Who | What they receive | Where |
|---|---|---|
| Amazon Web Services | Everything — they host the service | Mumbai, India |
| Supabase | Accounts and the database | Mumbai, India |
| Map display, place search, push notifications, and website analytics | Global | |
| SMSlenz | Your mobile number, to send the sign-in code | Sri Lanka |
| OSRM (OpenStreetMap) | Start and end coordinates, to draw the route | Europe |
| Nominatim (OpenStreetMap) | Place searches and coordinates, to turn them into addresses | Europe |
The two OpenStreetMap services receive coordinates without your name or number attached. They cannot tell who a journey belongs to.
Authorities
We hand over data when the law requires it — a court order, or a police investigation into an incident on a trip. We tell you when that happens unless we are legally barred from doing so.
Where it lives, and for how long
Your data is stored in Mumbai, India, on servers in the AWS ap-south-1 region. It is encrypted in transit and at rest.
- Trip routes: 12 months, then deleted.
- Messages between rider and driver: 6 months.
- Driver documents: while you drive with us, and 6 years after you stop, as proof we checked.
- Payment and ledger records: 6 years, which Sri Lankan tax law requires.
- Everything else: deleted within 30 days of you closing your account.
What you can ask us to do
Under Sri Lanka’s Personal Data Protection Act No. 9 of 2022 you may ask us to show you what we hold, correct it, delete it, or stop using it in a particular way. You can also ask for a copy in a portable format.
Write to privacy@gamana.online. We answer within 30 days. There is no charge.
To close your account and have your data deleted, see deleting your account — it explains exactly what goes and what we are obliged to keep.
Children
Gamana is not for under-18s. We do not knowingly hold data about children. If you believe a child has an account, write to privacy@gamana.online and we will remove it.
Changes
When this policy changes in a way that affects you, we will tell you in the app before the change takes effect — not by quietly editing this page. The date at the top always reflects the current version.
Complaints
If we have handled your data badly, tell us first at privacy@gamana.online. If we do not put it right, you can complain to the Data Protection Authority of Sri Lanka.