1. Scope
OnTime provides a local ordering and delivery platform connecting customers, participating shops, and delivery partners. The information we handle depends on the app and features you use.
2. Information we collect
Account and profile information
We may collect your name, email address, phone number, password in hashed form, profile details, verification status, and account role.
Customer and order information
For customers, this may include saved delivery addresses, map coordinates, order contents, shop selections, delivery or takeaway preferences, prices, payment status, order history, notes, and support communications.
Shop information
For shop owners, this may include owner details, business name and contact information, shop location, opening hours, menus, product images, bank account information, and documents submitted for review such as business registration or public-health certificates.
Rider information
For delivery partners, this may include identity and contact details, NIC information or images, driving-licence and vehicle information, bank details, approval status, availability, delivery history, and location while using delivery features.
Device and technical information
We may collect device identifiers and push-notification tokens, app version, operating system, IP address, request logs, crash or diagnostic information, and security or audit records.
3. How we use information
- Provide accounts, ordering, delivery, shop management, and rider services.
- Calculate delivery distance and fees, route orders, and show order progress.
- Verify accounts and submitted shop or rider information.
- Send verification codes, password resets, order updates, and operational alerts.
- Process cash-on-delivery records, earnings, payouts, cancellations, and refunds where applicable.
- Prevent fraud, abuse, unauthorised access, and other security incidents.
- Provide support, investigate problems, improve reliability, and comply with legal obligations.
4. How we share information
We share only the information needed for an order or service to work. A shop receives relevant customer and order details. An assigned rider receives the pickup and delivery information needed to complete the delivery. Customers receive relevant shop and delivery-status information.
We may use service providers for cloud hosting, database services, file storage, email, maps, push notifications, analytics, and technical support. These providers process information on our behalf under their own security and privacy obligations. We may also disclose information when required by law, to protect people or the service, or as part of a business reorganisation.
We do not sell personal information.
5. Location information
Customers can select or confirm a delivery location. Riders may share location while using availability, pickup, navigation, and delivery features. Device settings control location permission. Disabling location may prevent location-dependent features from working correctly.
6. Retention and security
We retain information for as long as reasonably necessary to provide the service, maintain transaction and audit records, resolve disputes, prevent fraud, and meet legal or accounting obligations. Retention periods vary by record type.
We use reasonable administrative, technical, and organisational safeguards, including access controls, encrypted connections, password hashing, and restricted storage. No method of transmission or storage is completely secure.
7. International processing
Some technology providers may store or process information outside Sri Lanka. Where this occurs, we use the provider and contractual protections available to us and limit information to what is needed for the service.
8. Your choices and rights
You can update certain account information in the relevant app. You may ask us to access, correct, or delete personal information, subject to identity verification and any records we must retain by law or for legitimate business purposes. See Delete your account to submit a request.
You can manage notification and location permissions through your device settings. Essential account or order messages may still be sent when needed to provide the service.
9. Children
OnTime is not directed to children who cannot legally enter into these services or consent to the handling of their information. If you believe a child has provided personal information without appropriate permission, contact us.
10. Changes to this policy
We may update this policy as the service changes. We will publish the revised policy here and update the effective date. Material changes may also be communicated through the apps or other appropriate channels.
11. Contact us
For privacy questions or requests, email support@ontimelk.com or call +94 76 964 7931.