Privacy policy

Boleto ("we", "us") is an appointment booking platform for salons and beauty parlours, operated in Sri Lanka. This policy explains what personal data we collect through the Boleto mobile app and our websites (boleto-app.com and pay.boleto-app.com), why we collect it, and the choices you have.

1. Data we collect

Account information

• Customers: your name, email address, and profile photo, provided through Google or Apple sign-in.
• Business owners and staff: your name, email address (verified with a one-time code), phone number (verified by SMS), and profile photo.

Business verification (businesses only)

• Business registration details and documents, plus identity verification: a photo of your NIC or driving licence and a selfie. These are stored privately, used only to verify your business, and are never shown publicly.

Bookings and payments

• Booking details: the services, business, staff member, time, price, and booking status.
• Payments are processed by PayHere, our payment gateway. We never receive or store your card number. We keep the transaction reference, amount, and payment status.
• For businesses and staff who withdraw earnings: the bank account details you provide for payouts.

Content you share

• Reviews (rating, text, and optional photo) are public and shown on the business profile alongside your first name.
• Business photos, service catalogues, and staff profiles businesses publish.

Location

• With your permission, your device location is used to show salons near you and sort results by distance. Businesses provide their location to appear on the map. You can use the app without granting location access.

Device and usage data

• Push notification tokens, notification preferences, app version, and basic diagnostic data collected through Google Firebase.

2. How we use your data

• To create and secure your account (including one-time codes by email and SMS).
• To make and manage bookings, payments, refunds, and payouts.
• To send booking notifications and reminders - you control these in Settings › Notifications.
• To verify businesses and keep the marketplace trustworthy.
• To prevent fraud and abuse, and to comply with legal obligations.
• To improve the app and fix problems.

We do not sell your personal data, and we do not use it for third-party advertising.

3. Who we share data with

• Businesses you book with see your name and the details of your booking, so they can serve you.
• Service providers that run our infrastructure: Google Firebase (authentication, database, storage, notifications), PayHere (payment processing), an SMS gateway (one-time codes), an email delivery provider, and Google Maps (location and maps).
• Authorities, where we are legally required to do so.

4. Storage and security

Your data is stored on Google Cloud infrastructure. Access is restricted by security rules so that, for example, only you can read your own bookings and only a business owner can read their business records. Verification documents and payout details live in private storage that other users can never access. Data may be processed on servers outside Sri Lanka.

5. Retention and deletion

We keep your data for as long as your account exists. You can delete your account at any time in Account › Settings › Delete account - see the step-by-step guide. Deletion removes your login and personal details immediately; past bookings are kept as anonymized records, and invoices and payment records are retained where financial record-keeping requires it.

6. Your rights

Under the Sri Lanka Personal Data Protection Act (and similar laws where they apply), you may request access to, correction of, or deletion of your personal data, and object to certain processing. Most of this you can do directly in the app; for anything else, contact us and we will respond within a reasonable period.

7. Children

Boleto is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

8. Changes to this policy

We may update this policy as the product evolves. Material changes will be announced in the app or by notification, and the date at the top shows the latest revision.

9. Contact

Questions or requests: support@boleto-app.com