Privacy policy

Last updated: 24 September 2026

This privacy policy explains what personal information HUGS (“HUGS”, “we”, “us”) collects when you use hugs.lk, why we collect it, who we share it with, and the choices you have. HUGS is an online marketplace: independent shops sell through one storefront and one checkout. When this policy says “sellers” it means those independent shops.

1. Information we collect

Information you give us

Account details: your name, email address and password when you create an account. Passwords are stored only as a one-way hash; we cannot read them.
Sign in with Google: if you choose “Continue with Google”, Google shares your name and verified email address with us. We do not receive your Google password or access to your Google account.
Orders: the items you buy, your shipping and billing address, phone number, the delivery option you choose, your payment method (cash on delivery or bank transfer) and any note you add.
Saved items: wishlists, gift registries and addresses you choose to save.
Messages and reviews: anything you send to us or to a seller through the site, and reviews you post.
Seller applications: if you apply to open a shop, your shop name, category, description, website and the details you enter in your shop admin.

Information collected automatically

Cookies needed to run the site: to keep you signed in, remember your shopping bag and wishlist, and protect forms against misuse. These are required for the site to work.
Technical data: your IP address, browser type and the pages you request, which our hosting provider records for security and to keep the service running.

We do not sell your personal information, and we do not use it for third-party advertising.

2. How we use your information

To create and manage your account and let you sign in.
To take your order, pass it to the seller who fulfils it, and let you follow it.
To send service emails: order confirmations, shipping updates, password resets and sign-in codes.
To answer your questions and resolve problems with an order.
To review seller applications and keep the marketplace safe, including preventing fraud and abuse.
To send newsletters or offers, but only if you opt in. You can unsubscribe from any marketing email at any time.
To meet our legal obligations, such as keeping order records.

3. Who we share it with

Sellers: when you order from a shop on HUGS, that seller receives what it needs to fulfil the order: your name, shipping address, phone number, email, the items and the order note. Each seller receives only the part of your order that is theirs.
Service providers who process data on our behalf and only under our instructions:
- Cloudflare, for hosting, network security and storage of images and files;
- Mailjet, for sending transactional emails;
- Google, if you choose to sign in with Google;
- couriers and delivery partners chosen by the seller, who receive your delivery details.
Legal reasons: when required by law, a court order or a lawful request by a public authority, or to protect the rights and safety of our customers, sellers or HUGS.

Some of these providers may store data outside Sri Lanka. Where they do, we rely on their contractual commitments to protect it.

Google user data (Sign in with Google)

If you choose “Continue with Google”, HUGS asks Google only for the basic sign-in scopes: openid, email and profile. From these we receive your name, your email address and whether Google has verified it. We do not request, receive or store your Google password, contacts, Gmail, Drive, calendar or any other Google account data.

How we use it: only to create your HUGS account or sign you in to it, and to show your name on your account and orders.
Sharing: we do not sell Google user data, use it for advertising, or share it with anyone except as needed to run your account (our hosting provider stores it on our behalf) or when the law requires it.
Storage and deletion: your name and email are kept with your HUGS account for as long as the account exists. You can delete your account, or ask us to delete it, at any time (see “Your rights” and “Contact us”); you can also remove HUGS’s access at myaccount.google.com/permissions.

HUGS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How long we keep it

Account information for as long as your account is open.
Order records for as long as the law requires for tax and accounting purposes, even after an account is deleted.
Service logs for a short period, only as long as needed for security and troubleshooting.

5. Your rights

Subject to the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka and other laws that apply to you, you can ask us to:

give you a copy of the personal information we hold about you;
correct information that is wrong or incomplete;
delete your account and personal information (order records we are required to keep are retained);
stop sending you marketing email;
withdraw consent you gave, where our use of your information depends on consent.

You can update most details yourself in Your account, request deletion from your profile page, or contact us as described below. We may need to confirm your identity before acting on a request.

6. Security

We use encrypted connections (HTTPS) for the whole site, store passwords only as hashes, encrypt sensitive keys at rest, and limit who can access personal information. No system is perfectly secure, so please use a strong password that you do not use elsewhere.

7. Children

HUGS is not intended for children under 16, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.

8. Changes to this policy

We may update this policy as the marketplace changes. The date at the top shows when it last changed. If a change is significant, we will tell account holders by email or on the site before it takes effect.

9. Contact us

For questions about this policy or your personal information, write to us through our contact page. For questions about a specific order, you can also contact the seller from their shop page.