Privacy
We collect only what is needed to run your campaigns and keep the system fair. We never sell personal data.
Last updated 2026-10-29
Who is responsible: induwara.lk. Operated by Induwara Ashinsana. Sri Lanka. Contact: contact page, [email protected].
If you advertise
- Account: your email, your name if Google gives it or you add it, and your business name. Used to sign you in, send receipts and notices, and tell the reviewer who is asking. Basis: to provide the service you asked for.
- Campaigns and ads: your images, landing page addresses, dates, budgets and results. Used to run, bill and report your campaigns.
- Payments: order and receipt numbers, amounts, dates, the PayHere payment reference and a masked card number. PayHere processes your card; we never see the full number. Kept as long as the law requires for accounts.
- Terms acceptance: which version of the terms you accepted and when.
- Security: sign-in records with a one-way hash of your network address, kept 90 days to detect abuse.
- Notifications: if you switch on app notifications, your browser gives us a push address for your device. Switch it off any time in Account.
If you visit induwara.lk
The ad system sets no cookies and reads none. When a page with an ad space loads, the ad server receives the request your browser sends anyway. It makes an anonymous visitor code from your network address and browser details mixed with a secret and the date, so it changes every day and cannot be traced back to you. We use it to count visitors, limit how often one person sees the same ad, and spot robots. We keep your country (from Cloudflare) and your device type (phone or desktop), not your network address. The request names the tool page you are on (its name only, never anything you typed or anything after a ? or #), and your browser is told to send no referring address with it. We use the page name to show an ad that fits the page and to count how busy each page is; it is not stored with your visitor code. Nothing you type on a page is sent. Clicking an ad takes you to the advertiser, who has their own privacy practices.
Cookies and storage on the Ad Console
| Name | Purpose | How long |
|---|---|---|
| __Host-ads_session | Keeps you signed in to the console | 30 days, only after you sign in |
| __Host-ads_g_nonce | Protects the Google sign-in from being hijacked | 10 minutes, only while you sign in with Google |
| __Host-ads_admin | Keeps our staff signed in to the admin site | 12 hours, staff only |
| __Host-ads_ref | Remembers which referral link you came from, so we can thank the person who invited you | 30 days, only if you opened a referral link |
These are strictly necessary, so there is no cookie banner: we use no advertising or tracking cookies. If you install the app, your browser also keeps a small offline page.
Who sees your data
- Cloudflare carries our traffic and sees requests.
- Resend sends our emails (your email address and the message).
- PayHere processes card payments.
- Google, if you sign in with Google.
- Our own staff, to review ads and help you.
Some of these providers are outside Sri Lanka, so data may be handled in other countries under their own safeguards. We do not sell your data, and we disclose it to authorities only where the law requires.
How long we keep it
Account, campaign and payment records are kept while your account is open and afterwards for as long as accounting law requires. Sign-in links are deleted after a day, sign-in records after 90 days, and anonymous audience counts after 120 days. Images of ads nobody uses any more are deleted after a week.
Your rights, and how to use them yourself
- See and download your data: Account, “Download my data”.
- Correct your details: Account.
- Delete your account: Account, “Close my account”, once no campaign is open and you have no credit. Payment records stay as the law requires; your name, business name and email are erased.
- Anything else (objecting, complaints): write to us. We answer within 30 days.
Security
Sign-in is by Google or a single-use email link, with no passwords to leak. Connections are encrypted. Access to staff tools is limited to named people. Payment details never touch our servers. We test our systems and fix what we find, and you can report a security problem through security.txt.
Children
The Ad Console is for businesses and adults. It is not directed at children.
Law
We handle personal data in line with Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, as it comes into force. We update this page when our practices change.