Your data, handled with care.

VESTARA is an online fashion marketplace operated by VESTARA Atelier (Pvt) Ltd, 85/1, Courts Road, Mawanella, Sri Lanka ("VESTARA", "we", "us"). Independent sellers ("Stores") list products on VESTARA and we provide the platform, checkout, delivery coordination and customer support.

The VESTARA iOS and Android apps are published on the App Store and Google Play under the developer account of CodeworkLab (info@codeworklab.com), on behalf of VESTARA. CodeworkLab acts only as the store publisher: it has no access to your VESTARA account, orders or payment details, and sees only the aggregated download, crash and usage statistics that Apple and Google provide to app publishers. VESTARA operates the Services, decides how your personal data is used, and remains responsible for it under this policy.

We are the data controller for personal data processed through the VESTARA website (synapstore.shop) and the VESTARA iOS and Android apps (together, the "Services"). We process personal data in line with the Sri Lanka Personal Data Protection Act No. 9 of 2022 and, where they apply to you, other data protection laws such as the GDPR.

We only collect what we need to run the Services. Depending on how you use VESTARA, this includes:

• Provide the Services. Create and secure your account, process orders and payments, arrange delivery, handle returns and refunds, and provide customer support. (Legal basis: performance of a contract.)
• Personalise your experience. Show recommendations, recently viewed items, size suggestions and search results that match your interests. You can turn off personalisation in Settings → Privacy. (Legitimate interests / consent.)
• AI-powered features. Visual search, smart search, product tagging and style suggestions use machine-learning models to analyse product images, search text and photos you choose to upload. We do not use your photos to train third-party models.
• Keep VESTARA safe. Detect and prevent fraud, abuse, fake reviews and security incidents, and enforce our Terms. (Legitimate interests / legal obligation.)
• Communicate with you. Send order updates, delivery notifications and important account messages. Marketing messages and promotional push notifications are only sent if you opt in, and you can opt out at any time. (Contract / consent.)
• Meet legal obligations. Keep tax and accounting records, respond to lawful requests from authorities, and resolve disputes. (Legal obligation.)

We never sell or rent your personal data. We share it only as needed to run the Services:

• Stores you order from. Your name, delivery address, phone number and order details so they can prepare and fulfil your order. Stores may not use this data for any other purpose.
• Delivery partners. Courier companies (such as Domex) and VESTARA delivery partners receive the recipient name, address, phone number and cash-on-delivery amount needed to deliver your parcel.
• Payment processor. Stripe, Inc. processes card payments and fraud screening under PCI-DSS Level 1.
• Infrastructure providers. Supabase (database, authentication and file storage), Cloudflare (hosting, content delivery, security and AI inference), Sentry (crash and error reporting), Expo / Apple / Google (push notification delivery), and our email and SMS providers. Each is bound by a data processing agreement.
• Legal & safety. Authorities or other parties when required by law, or when necessary to protect the rights, property or safety of VESTARA, our users or the public.
• Business transfers. A buyer or successor if VESTARA is involved in a merger, acquisition or sale of assets, subject to this policy.

Some providers store data outside Sri Lanka (for example in Singapore, the EU or the United States). Where data leaves Sri Lanka we rely on contractual safeguards required by applicable law.

The VESTARA mobile app may ask for the following device permissions. You can change them at any time in your device settings; the rest of the app keeps working.

On the website we use essential cookies and local storage to keep you signed in, remember your bag and preferences, and protect against fraud. Optional analytics cookies help us understand which pages work well. You can manage these choices in our Cookie Policy at any time. The mobile app uses equivalent on-device storage for the same purposes.

• Account data. Kept while your account is active. Deleted within 30 days after you delete your account.
• Orders & invoices. Kept for up to 7 years to meet Sri Lankan tax and accounting requirements, then deleted or anonymised.
• Support messages. Kept for up to 2 years after the ticket is closed.
• Crash logs & technical data. Kept for up to 90 days.
• Backups. Encrypted backups roll off automatically within 35 days.

All traffic between your device and VESTARA is encrypted with TLS. Data is encrypted at rest by our infrastructure providers, and database access is restricted with row-level security so each account can only reach its own records. Staff access is limited to people who need it and protected by multi-factor authentication. No system is perfectly secure; if a breach affects your data we will notify you and the relevant authority as the law requires.

• Access & portability. Request a copy of the personal data we hold about you, in a portable format.
• Correction. Update your name, contact details and addresses directly in your account at any time.
• Deletion. Delete your account in-app, or ask us to erase specific data.
• Objection & restriction. Object to personalisation or marketing, or ask us to restrict processing.
• Withdraw consent. Turn off marketing emails, push notifications and optional cookies at any time.
• Complain. If you are unhappy with how we handle your data, contact us first. You may also complain to the Data Protection Authority of Sri Lanka or your local regulator.

We respond to verified requests within 30 days and never charge for reasonable requests.

• In the app. Open Account → Settings, scroll to Danger zone, tap Delete account and confirm.
• On the web. Sign in at synapstore.shop, go to Account → Settings and choose Delete account at the bottom of the page.
• By email. Email munxhd@gmail.com from the address on your account with the subject "Delete my account". We will confirm within 48 hours.

The Services are not directed to children. You must be at least 18 to create an account or place an order. We do not knowingly collect personal data from anyone under 18; if we learn we have, we will delete it. Parents or guardians who believe a child has given us data can contact munxhd@gmail.com.

We may update this policy from time to time. The "Last updated" date shows the latest version. If we make significant changes we will notify you in the app or by email before they take effect.

Privacy questions or requests: munxhd@gmail.com · VESTARA Atelier (Pvt) Ltd, 85/1, Courts Road, Mawanella, Sri Lanka. App Store / Google Play publisher: CodeworkLab (info@codeworklab.com).