Privacy Policy

Last updated: 11 August 2026 · Applies to autohunt.lk and the Auto Hunt CRM service.

Who we are

Auto Hunt CRM ("we", "us") provides a customer-relationship-management service for businesses in Sri Lanka. Each business that registers ("workspace") controls the customer data inside its workspace; we process that data on the workspace's behalf.

What we collect

• Account data: your name, email address, and sign-in credentials (passwords are stored hashed).
• Workspace content: WhatsApp conversations, contacts, notes, deals, orders and files your team stores in the service.
• Billing data: your plan, invoices and payment references. Card details are handled by our payment provider (OnePay) and never stored on our servers.
• Technical data: IP address, browser type and usage logs kept for security and reliability.

How we use it

• To operate the service: delivering messages, storing conversations, running the features you switch on.
• AI features process conversation text to draft replies, score leads and summarise threads. AI processing happens only for workspaces that enable it, and is metered against your credit balance.
• To bill you, to answer support requests, and to keep the service secure.
• We do not sell personal data. Ever.

Sharing

• Meta Platforms (WhatsApp Business Platform) — to send and receive your WhatsApp messages.
• Anthropic — AI text processing, when AI features are enabled.
• OnePay (onepay.lk) — payment processing.
• Infrastructure providers hosting our servers and backups.

Retention and deletion

Workspace data is retained while the subscription is active and for 90 days after cancellation, then deleted. A workspace owner can export contact data at any time and can request hard deletion of individual contacts, which removes their messages and orders.

Your rights

Under Sri Lanka's Personal Data Protection Act (PDPA No. 9 of 2022) you may request access, correction or deletion of your personal data. If your data lives inside a business's workspace, we will route the request through that business as the data controller. Contact privacy@autohunt.lk.

Security

Data is isolated per workspace at the database layer, encrypted in transit, and access tokens are stored encrypted. Staff access is logged.

Changes

We will announce material changes to this policy by email and in the app.