Privacy Policy

We collect only what we need to run the platform safely and well:

• Account data — your name, email address, and profile photo when you sign up.
• Google sign-in data — if you choose “Continue with Google” instead of an email magic link, Google tells us your name, email address, profile photo, and the ID Google uses for your account. That is all we ask Google for and all we receive: we get no access to your Gmail, contacts, calendar, or anything else in your Google account, and we cannot post or act on your behalf. If an account already exists with the same email address, signing in with Google signs you into that same account rather than creating a second one. Using Google is optional — the email magic link does the same job without involving Google.
• Contact details — your mobile number and location (province, district, street address), used to coordinate pickups and deliveries.
• Identity documents — if you list items as a supplier, we may request a government-issued ID or business registration document for verification. These are handled by Lately administrators only and are never shared publicly.
• Booking data — the items you rented, dates, payment references, and any notes exchanged during a booking.
• Lately People booking requests — when you request a Lately People package, we store your name, the date and start time you chose for each event, any note you add (for example the venue or what you need), and a snapshot of the package as you booked it: its name, price, what is included and its events. We keep the snapshot so later edits by the provider do not change your booking. Booking payments follow the same advance model as rentals, so we also store the payment slip image you upload (kept in private storage, never public) and the payment reference if you enter one.
• Messages — the text of messages you send to the other party in a booking, who sent each one and when, and when you last opened a conversation. Messaging is only available inside a booking; Lately has no general inbox or open messaging between users.
• Reviews — any review text and ratings you submit. These are displayed publicly on the platform. A review of a Lately People provider appears on that provider’s People page with your name and profile photo, as shop reviews do. You can leave one review per People booking (one for a whole bundle of events).
• Lately People early access — if you join the early-access list at lately.cc/people, your email address, your WhatsApp number (required if you offer a service, optional if you want to book one), whether you offer a service or want to book one, and optionally what you do, your district, and your Instagram or website link. If you joined before we asked for a number, we may use the mobile number already on your Lately account. If we met you in person or through someone you know, a member of the Lately team may add your email, WhatsApp number, what you do, your district and your Instagram or website link to this list on your behalf, so we can send you an invite. If you join through an invite link, we note which link you used. We use all of it for one thing: to invite you to Lately People, or to tell you when it opens — by email, WhatsApp message or call. It is not added to our newsletter, not shown to anyone else, and not shared outside Lately.
• Lately People pages — if you create a Lately People page (or our team sets one up with you, in which case we can also edit it alongside you), what you put on it is public by design: your name, photo, cover image, headline, bio, the districts you work in, years active, the languages you speak, your links (Instagram, Facebook, TikTok, website, WhatsApp) and your portfolio photos. A page is only public once you publish it; while it is a draft or paused, only you (and Lately administrators, when helping you or reviewing a report) can see it, and pausing hides the whole page. Removing a photo takes it off the site straight away, and we delete the file from our storage after a 14-day recovery window. You can delete your page from your dashboard at any time (or ask support@lately.cc); this removes the page, its photos and its view counts straight away, deletes the files from our storage after the same 14-day recovery window, and leaves your Lately account, shop and bookings in place. We count how many times each page is viewed, stored as daily totals only and shown to the page’s owner; we don’t record who visited. Videos on a People page are YouTube or Vimeo links: we store the link, its title (fetched from YouTube or Vimeo when the video is added, and editable) and, for Vimeo, its thumbnail address. Each video shows a thumbnail image from YouTube or Vimeo; the player itself loads only when you press play, and from then on that service receives your visit under its own privacy policy (we use YouTube’s privacy-enhanced mode and Vimeo’s do-not-track setting). Partner links are shown publicly: a People page shows the studios it’s linked to, and a studio’s shop page shows the People pages linked to it.
• Reporting a Lately People page — if you report a page, we store the reason you picked, any details you add, and either your Lately account (if you are signed in) or the email address you give us (optional). We use it only to review the report and, if you left an email, to follow up. We never tell the page owner who reported them. You can ask us to remove a report you made by emailing privacy@lately.cc.
• Device location — only if you tap “use my location” and your browser asks you to allow it. We store the coordinates your device reports in a cookie on your own browser for 30 days, and use them for one thing: sorting listings so the nearest appear first. We do not attach them to your account, keep them on our servers, or build any history of where you have been. Declining changes nothing except that sorting falls back to the district on your profile, and you can clear it by clearing your browser’s cookies for Lately. If the coordinates fall outside Sri Lanka we discard them rather than store them.
• Usage data — standard server logs including IP address, browser type, and pages visited. Used for security and performance monitoring only.
• Analytics — we use Google Analytics to understand how the site is used in aggregate: which pages are visited, roughly where visitors come from, and what device they use. It helps us see what’s working and fix what isn’t. We’ve turned off Google’s advertising features, so this data is not used to target ads, and we don’t use it to identify you personally.

Each piece of data serves a specific purpose:

• To run the platform — bookings, payments, and coordination between renters and suppliers require contact and identity information.
• To build trust — verifying supplier identities protects renters. Two-way reviews protect both sides.
• To prevent fraud — identity verification and booking records help us investigate disputes and protect the community.
• To communicate with you — we send transactional emails (booking confirmations, payment references, reviews, a notice when someone messages you about a booking, link requests and acceptances between People pages and studios, and the notices a partner gets when a booking that uses them is confirmed or cancelled) and occasionally platform updates. Message notification emails tell you a message arrived and link to the booking; they never contain the message itself. You can opt out of non-essential emails at any time.
• To protect your contact details — until a booking is confirmed, we automatically hide phone numbers and email addresses inside messages and booking notes, so neither party gets the other’s contact details before the booking is agreed. This is a pattern check on the text; it hides what it finds when displaying a message and never alters what you wrote.
• To pass a request to a Lately People provider — the provider needs your name, the dates and times you chose, and your note to decide whether they can take the booking. We use your booking snapshot to show both sides the same terms, and the date of the last event to complete the booking automatically after 7 days unless a dispute has been raised.
• To personalize what you see — your district and past bookings shape the rails on your home page. This never leaves Lately.
• To show you what is nearby — your district, or your device location if you have shared it, decides the order listings appear in. It only ever changes the order: nothing is hidden from you because of where you are, and no supplier is hidden from anyone because of where they are.

We do not sell your data. We do not use it for advertising. We do not profile you for third parties.

• All data is stored on secured cloud infrastructure with encryption at rest and in transit (HTTPS/TLS).
• Identity documents are stored in a private, access-controlled storage bucket. Only authorised Lately administrators can access them, and only for verification purposes.
• Passwords are never stored — authentication is handled via secure sign-in providers (Google OAuth) or email magic links.
• We conduct periodic security reviews and apply patches promptly.

Access to your personal data is strictly limited:

• Other users — only your name, profile photo, and public reviews are visible to other platform users. Your contact details are shared only with the other party in a confirmed booking (so a renter can arrange pickup, for example). Messages are visible only to the two people in that booking. For a Lately People booking, the provider sees your name, your note, and the dates and times you chose as soon as you send the request. Your phone number and other contact details are not shared with the provider (and theirs are not shared with you) until the provider has confirmed the booking; before that you talk only in Lately’s chat, which hides contact details written in messages. Your review of a People provider is public with your name and profile photo. If you book a Lately People page or a space with a partner add-on (for example, a photographer together with a studio), that partner sees the date, time and your first name, so they can keep the time free. They don’t see your contact details, notes or payment details.
• Lately administrators — can access all account and booking data, including the full text of messages, for the purposes of support, fraud prevention, and dispute resolution. Administrators see messages in full, including any contact details hidden from the other party, because messages are the record we rely on to settle a dispute fairly. An administrator who joins a conversation is always labelled “Lately Support” — we never post as you or as the other party. Some Lately team members have narrower access limited to the work they do (for example, helping shops with their listings or reviewing verification documents); they can see only the information that work needs.
• Google, if you sign in with it — choosing “Continue with Google” tells Google that you have an account with Lately and when you sign in, in the same way it knows about any other site you use it on. It does not tell Google what you do on Lately: not what you browse, book, list, or message. If you would rather Google not know you use Lately, sign in with the email magic link instead.
• Third-party processors — we use trusted services for email delivery, cloud infrastructure, and site analytics (Google Analytics). These processors act under data processing agreements and access only the minimum data necessary. Analytics data is processed by Google on servers outside Sri Lanka. Beyond Google Analytics we do not name specific vendors here as these may change — contact us if you need details.
• Legal authorities — we will disclose data if required by law, court order, or to protect the safety of our users.

• Your account data is retained for as long as your account is active.
• Booking records are retained for a minimum of 3 years for dispute resolution and legal compliance.
• The package snapshot and event dates of a Lately People booking are kept with the booking record, for the same minimum of 3 years.
• Messages are kept for as long as the booking they belong to is kept, and are deleted when that booking record is deleted. Messages are not deleted when you close your account. A conversation has two sides, and erasing one person’s messages would destroy the other person’s only record of what was agreed. When an account is closed we cut the link between the messages and that account, and the sender is shown to everyone thereafter as “Deleted user”.
• Identity documents are retained until your supplier account is closed, after which they are deleted within 90 days.
• A Lately People early-access entry is kept until we have invited or notified you. You can ask us to remove it at any time by emailing privacy@lately.cc.
• You may request deletion of your account and associated personal data at any time (see Section 6).

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correct — update incorrect information via your account settings, or contact us for records you can't edit yourself.
• Delete — request deletion of your account and personal data. Note that booking records required for legal or dispute purposes may be retained in anonymised form, and that messages you sent are retained as described in Section 5: they stay attached to the booking, but are no longer linked to you.
• Object — opt out of non-essential communications at any time using the unsubscribe link in any email we send.
• Portability — request your data in a machine-readable format.

To exercise any of these rights, email privacy@lately.cc. We will respond within 30 days.

We use minimal cookies:

• Session cookies — to keep you signed in. These are essential and cannot be disabled while using the platform.
• Preference cookies — to remember settings like your cart contents. These are cleared when you sign out.
• Location cookie — set only if you tap “use my location” and allow it. It holds the coordinates your device reported, expires after 30 days, and is read only to sort listings by distance. It is never sent to anyone else.
• Analytics cookies — Google Analytics sets a couple of cookies to tell repeat visits apart and measure how the site is used. They hold a random identifier, not your name, and expire within two years.

We do not use advertising cookies. Our analytics cookies measure site usage only and are not used to build advertising profiles.

Lately is not intended for users under 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, contact us and we will delete it promptly.

We may update this policy as the platform evolves. If we make material changes, we will notify you by email and display a notice on the platform. Continued use of Lately after the effective date constitutes acceptance of the updated policy.

Questions about this policy or your data? Reach us at: