Mahajana Super ("we", "us", "our") operates the Mahajana Super mobile application (the "App") and the website at mahajanasuper.lk (together, the "Services"). This policy explains what personal data we collect, why we collect it, and what we do with it.
The short version: We collect the minimum data needed to run your loyalty account, process your orders, and send you order updates. We don't sell your data, we don't share it with advertisers, and you can delete your account any time by emailing us.
01What we collect
When you use our App or Services we collect the following personal data:
Identity and contact data
- Full name
- Mobile number — used for OTP authentication and order notifications
- Email address (optional) — used for receipts and support
- Delivery addresses you enter
Transaction data
- Your Mahajana Club Card membership number
- Points balance and points history
- Voucher and coupon history
- Order history: items, quantities, prices, delivery address, payment status
Device and app data
- Device model and OS version
- App version
- Push notification token — used to send you order and reward notifications
- Crash reports and error logs — to fix bugs
Location data
- Your approximate or precise location, only when you open the app and only to (a) show you the nearest branch and (b) calculate delivery fees
- We do not track your location in the background
- You can deny location permission — the app still works, you'll just need to pick your branch manually
Camera and photos
- When you use the QR scanner, your camera is active only during that screen
- When you attach a photo to the AI chat, only that photo is uploaded
- We do not access your camera or photos at any other time
02How we use it
We use your data to:
- Authenticate you when you log in (phone OTP)
- Show you your Mahajana Club Card, points balance, and vouchers
- Process your orders and deliver them to you
- Send you order updates and, if you opt in, promotional offers
- Improve the App and fix bugs
- Meet our legal and bookkeeping obligations in Sri Lanka
03Who we share it with
We do not sell your data. We do not share it with advertisers.
We share limited data only with these service providers, and only for the purpose listed:
- SMS provider (Dialog SMS API, Text.lk): only your mobile number and the OTP / order message content
- Push notification service (Google Firebase Cloud Messaging): only your push token and the notification payload
- Payment gateway (when digital payment is used): only your order amount and reference — we never see your card details
We may disclose your data where legally required by a court or regulator in Sri Lanka.
04How long we keep it
- Account data: while your account is active, plus 90 days after you request deletion
- Transaction history: retained for 7 years for tax and bookkeeping, as required by Sri Lankan law
- Location data: not stored — only used at the moment of the request
- Crash logs: 30 days, then discarded
05Security
We protect your data with:
- HTTPS encryption for all communication between the App and our servers
- Hashed OTPs — we never store your OTP in plain text
- Restricted access to our production database
- Regular security reviews
06Your rights
You can:
- Access the data we hold about you — email us
- Correct any data that's wrong — edit it in the app or email us
- Delete your account — email support@mahajanasuper.lk with "Delete account" in the subject
- Object to marketing messages — turn off notifications in the app or email us
07Children
The App is not directed to children under 13, and we do not knowingly collect data from anyone under that age.
08Changes
If we update this policy we'll tell you in the App and post the new version at this URL. Continued use of the App after an update means you accept the new policy.
09Contact
Questions or complaints about this policy?