Legal
Privacy Policy
Last updated: March 13, 2026
CampusFlow ("we", "our", or "us") operates Sri Lanka's tuition marketplace at campusflow.lk. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our platform — whether you are a student, teacher, or visitor.
By registering for or using CampusFlow, you agree to the practices described in this policy. If you do not agree, please do not use our services.
1. Information We Collect
Account Information
When you register, we collect your full name, email address, password (stored as a hashed value), district, phone number (optional), and role (student or teacher).
Teacher Profile Data
Teachers additionally provide their subjects, years of experience, a short biography, and optionally a profile photo. This information is displayed publicly to help students find the right class.
Payment Records
We store records of class enrollment and payment transactions, including the amount paid, payment status, and any receipt images you upload. We do not store credit card numbers or bank account details — all sensitive financial data is processed outside our platform.
Usage Data
We may automatically collect technical information such as your IP address, browser type, device information, pages visited, and the time and date of your visits. This helps us improve platform performance and security.
Communications
If you contact our support team, we retain the content of those communications to assist with ongoing and future inquiries.
2. How We Use Your Information
- To create and manage your CampusFlow account.
- To display teacher profiles and class listings to prospective students.
- To process class enrollments and track payment statuses.
- To send transactional emails such as enrollment confirmations, payment approvals or rejections, and account notifications.
- To allow administrators to review and approve teacher accounts.
- To detect fraud, abuse, and security threats.
- To improve the platform through analysis of aggregated, anonymised usage patterns.
- To comply with applicable Sri Lankan laws and legal obligations.
3. How We Share Your Information
We do not sell your personal data. We share information only in these limited circumstances:
- Between students and teachers as necessary to facilitate a class enrollment (e.g., a teacher can see the name of an enrolled student).
- With our hosting and infrastructure providers (currently Neon Database and Cloudinary for image storage) who process data on our behalf under confidentiality obligations.
- With law enforcement or regulatory bodies when required by Sri Lankan law or a valid court order.
- In connection with a business transfer such as a merger or acquisition, where your data would remain subject to this policy.
4. Data Retention
We retain your account data for as long as your account remains active. If you request account deletion, we will remove your personal data within 30 days, except where retention is required by law or for legitimate business purposes such as fraud prevention. Payment records may be retained for up to 7 years to comply with financial record-keeping requirements.
5. Security
We implement industry-standard security measures including HTTPS encryption in transit, bcrypt password hashing, JWT-based authentication with expiry, and access controls that restrict data to authorised users. However, no system is completely secure. We encourage you to use a strong, unique password and to notify us immediately at security@campusflow.lk if you suspect any unauthorised access to your account.
6. Your Rights
You have the right to:
- Access the personal data we hold about you by logging into your dashboard or contacting us.
- Correct inaccurate information through your profile settings.
- Request deletion of your account and personal data.
- Object to or restrict certain processing of your data.
- Withdraw consent where processing is based on consent.
To exercise any of these rights, email us at privacy@campusflow.lk. We will respond within 14 business days.
7. Cookies
CampusFlow uses browser localStorage (not third-party cookies) to store your authentication token, language preference, and theme setting. We do not use advertising or cross-site tracking technologies. You can clear this data at any time through your browser settings, which will log you out of the platform.
8. Children's Privacy
CampusFlow is available to users of all ages, including school-age students. Where a user is under 18, we encourage a parent or guardian to review this policy and supervise account creation. We do not knowingly collect data from children under 13 without verifiable parental consent. If you believe we have inadvertently collected such data, please contact us immediately.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify registered users by email. Continued use of CampusFlow after changes take effect constitutes your acceptance of the updated policy.
10. Contact Us
If you have any questions or concerns about this Privacy Policy or how we handle your data, please contact us at:
CampusFlow (Pvt) Ltd
Sri Lanka's Tuition Marketplace
Email: privacy@campusflow.lk
Support: support@campusflow.lk