Privacy notice
Prelaunch policy: the operator must confirm the business details and review these arrangements before orders open. This notice does not grant a licence or remove legal responsibilities.
Who handles your information
Savoré is the trading name of the proposed meal service described on the Business details page. The current registration status is shown on the Business details page. The operator's full legal identity and genuine contact address must be added before ordering opens. For privacy questions, corrections, marketing preferences or deletion requests, use the published WhatsApp number. During prelaunch, no claim of full regulatory certification or registration is made.
Information used and why
When ordering is available, we use the name, mobile number, email and delivery address you submit, the selected meals and dates, quantities, delivery area, order reference, payment status, and necessary delivery instructions to process an order, arrange delivery, communicate about it, prevent fraud and deal with support or disputes. We record the terms version accepted and a server timestamp with the order. We retain operational customer history and aggregate purchase insights for the owner. Please provide only necessary delivery instructions in free-text fields, not medical histories, national identity numbers, card details or other sensitive documents. If you contact us about an allergy, we will limit use of that information to assessing and handling your request; it is not marketing permission.
Ordering, legal obligations and marketing are separate
Where applicable law permits, necessary order handling is connected with the requested transaction, legal record-keeping and proportionate security and service purposes. We do not treat a necessary order as permission for optional advertising. The marketing checkbox is optional and off by default; declining it does not prevent an eligible order. The owner can see the recorded marketing preference, but this site does not automatically send promotional messages. You can ask us through WhatsApp to stop optional marketing. Cookie preferences are separate from marketing contact permission and from acceptance of purchase terms.
Browser storage and your cookie choices
Essential storage supports a saved lunch bag, session order features, security, authentication where used, and your cookie choice. The Cookie and local-storage policy explains it. There are currently no optional analytics or advertising SDKs installed. Accepting optional categories records a preference; it does not currently activate a tracker. Any new tracking provider or materially different purpose requires an updated notice and a new choice. You can reopen Cookie settings in the footer at any time.
Service providers and disclosures
Authorised kitchen staff need order information for fulfilment and support. Delivery arrangements may require sharing relevant name, contact and address information with the person delivering the order; we do not sell customer lists. Cloudflare provides hosting/database/media infrastructure, and the private Sites preview uses OpenAI/ChatGPT authentication and hosting controls. These services can involve processing outside Sri Lanka; no Sri Lanka-only data-residency promise is made. We must review applicable provider arrangements and transfer requirements before a public launch. PayHere handles card entry on its own hosted page; Savoré receives the order/payment references and status rather than storing card numbers or CVVs. Providers apply their own privacy notices to their services. Information may also be disclosed where required by law or needed for legitimate disputes or security incidents, subject to applicable safeguards.
WhatsApp and external sites
WhatsApp, Facebook and TikTok links take you to services with their own privacy practices. Merely showing these links is not the same as installing their advertising SDKs. If you choose to contact us through WhatsApp, the message and account information you send are handled through that service and by the operator for the inquiry. Please do not send payment credentials, identity documents or unnecessary health information.
Retention and security
Order and customer records are kept only for as long as reasonably necessary for fulfilment, support, accounting/legal obligations and genuine disputes. Required financial records or legal holds can need longer retention. The owner must review retention periodically and handle appropriate correction/deletion requests; the application does not currently provide automatic record deletion or claim a universal statutory retention period. If you ask to stop marketing, the operator must record and honour that choice before sending any further offers. This is handled manually. Cookie preference records expire after the period described in the cookie notice. We use restricted admin access, server-side validation, protected tracking links and other reasonable safeguards, but cannot promise that every system is risk-free. Keep your private order link confidential.
Requests and the law as it applies
Contact us to ask what information is held about you, to correct it, to change marketing preferences or to request deletion. We may need proportionate verification, and records may need to be retained where law or a genuine dispute requires it. We will explain the response and any available complaint route. Statutory rights and duties apply only to the extent that the relevant provisions of Sri Lankan law are in force. This notice does not claim that all provisions of the Personal Data Protection Act are already operational, does not exclude a right when it applies, and does not promise an unimplemented automated request portal.
Updates
Material changes will be reflected in the dated policy version and, when necessary, a new consent request. Before accepting real orders the operator must confirm the final business identity, actual providers and delivery arrangements, retention process, and privacy obligations with appropriate professional advice.