Privacy Policy
Last updated: 2026-07-20
This policy explains what personal data CricBook collects, why, who we share it with, and what control you have over it.
Who is responsible for your data
CricBook (Pvt) Ltd (CricBook) is the controller of the personal data described here. Our registered office is TODO: street address, Colombo TODO, Sri Lanka. For anything in this policy, contact privacy@cricbook.lk.
What we collect
Information you give us
- Phone number — required, and verified by SMS one-time password. It is how we identify your account and reach you about a booking.
- Name and email address — for your account, booking confirmations and receipts.
- Sport preference — to tailor what we show you.
- Google account details — if you choose to sign in with Google, we receive your name, email and profile picture from Google. We do not receive your Google password.
Information we collect as you use CricBook
- Booking records — which venue, court, date, time and price, and whether the booking was completed, cancelled or missed.
- Approximate location — only if you allow it in your browser, and only to sort venues by distance. We do not track your location in the background or store a location history.
- Device and log data — IP address, browser type and pages requested, kept for security and to diagnose faults.
What we never hold
We do not store full card numbers, CVV codes or bank credentials. Card payments are handled entirely by PayHere on their own systems; we receive only a payment reference and the result.
Why we use it, and on what basis
- To provide the service — taking and confirming bookings, processing payments, and letting venues know who is coming. Necessary to perform our contract with you.
- To verify identity and prevent fraud — phone verification, and detecting misuse or repeated no-shows. Our legitimate interest in running the platform safely.
- To support you — answering queries and handling refunds and disputes.
- To meet legal and accounting obligations — keeping transaction records as required by Sri Lankan law.
- To send marketing — only with your consent, and you can withdraw it at any time without affecting your bookings.
Who we share it with
- The venue you book — receives your name, phone number and booking details, so they can expect you and contact you if something changes. They may not use it for their own marketing.
- PayHere — our payment processor, to take payment and issue refunds.
- Notify.lk — to deliver verification and booking SMS.
- Hosting and infrastructure providers — who process data on our instructions to run the service.
- Authorities — where we are legally required to disclose, or to establish or defend a legal claim.
We do not sell your personal data, and we do not share it with advertisers.
Where your data is held
Our infrastructure providers may process data on servers outside Sri Lanka. Where that happens we take reasonable steps to ensure a comparable standard of protection applies.
How long we keep it
- Account data — while your account is open, and for up to 12 months after you close it, in case of a dispute.
- Booking and payment records — retained as long as required for tax and accounting purposes.
- Log data — typically 90 days.
Your rights
Under Sri Lanka’s Personal Data Protection Act you may ask us to give you a copy of your data, correct it if it is wrong, delete it, restrict or object to how we use it, or withdraw consent you have given. Write to privacy@cricbook.lk and we will respond within 21 days. Some data must be kept where the law requires it — we will tell you if that applies.
Security
Access to accounts is protected by verified phone numbers and one-time passwords, sessions use secure httpOnly cookies, and traffic is encrypted in transit. No system is perfectly secure, but if a breach affects your data we will notify you and the relevant authority as required.
Children
CricBook is not intended for children under 16. If you believe a child has given us personal data, contact us and we will delete it.
Cookies
We use cookies that are strictly necessary to keep you signed in and to keep the service secure. If we add analytics or marketing cookies, we will ask for your consent first and update this policy.
Changes
We will post any changes here and update the date above. Where a change materially affects you, we will tell you directly.