Privacy Policy

Last Updated: September 22, 2026

At Dayoutbook.lk ("we," "our," or "us"), we are committed to protecting your privacy and ensuring that your personal data is handled securely and transparently in accordance with the General Data Protection Regulation (GDPR) and other applicable privacy laws.

This Privacy Policy outlines how we act as a Data Controller to collect, use, and safeguard your personal information when you use our Dayoutbook.lk website and related services, including our Sereny AI features. By accessing or using the Website, you agree to the terms of this Privacy Policy.

1. Information We Collect

We may collect the following types of information:

• a. User Identity & Contact Information: Name, email address, phone number, profile image, and other details you voluntarily provide when creating a traveler account or booking an experience.
• b. Payment & Financial Data: When you make a booking or receive a payout, we (or our secure third-party payment processors) collect billing details and transaction history. We do not store full credit card numbers on our servers.
• c. Vendor Business Information: If you register as a vendor or business owner, we collect business details, registration documents, payout/billing information, and public listing content.
• d. Service & Interaction Data: Information regarding your travel preferences, saved wishlists, search history, reviews, and interactions with Sereny AI (or for vendors, listing management and booking history).
• e. Technical & Usage Information: Browser type, device information, IP address, and browsing behavior gathered through cookies and similar tracking technologies.

2. Legal Basis & How We Use Your Information

Under the GDPR, we only process your personal data where we have a lawful basis to do so:

• Contractual Necessity: To manage your account, facilitate bookings between travelers and vendors, process payouts, and provide our core travel guide and AI services.
• Legitimate Interests: To improve the Website's functionality, verify vendor authenticity, analyze usage patterns, maintain security, and prevent fraud.
• Consent: To send newsletters, updates, or promotional materials. You may withdraw your consent at any time.
• Legal Obligation: To comply with applicable laws, tax regulations (specifically for vendor payouts), and regulatory requirements.

3. Sereny AI and Automated Processing

Our platform uses Sereny AI to provide personalized travel recommendations. The AI analyzes your search queries and stated preferences to suggest relevant destinations. Please note that Sereny AI is currently in testing mode. All chats and interactions are being monitored in the backend to enhance performance, ensure safety, and to guardrail users' privacy. We do not use your personal data for automated decision-making or profiling that produces legal or significant effects concerning you without human intervention.

4. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your browsing experience, remember your preferences, and track website traffic. You can control or disable cookies through your browser settings or our cookie consent banner. Disabling certain cookies may affect the Website's functionality.

5. Data Sharing and International Transfers

We do not sell your personal information. We may share your data only in the following cases:

• With Vendors: When a user makes a booking or inquiry, we share necessary contact and booking details with the respective vendor to fulfill the service.
• With Travelers: Vendor business profiles, public contact info, and listing details are shared publicly on the platform for travelers to view.
• With Service Providers: Trusted third-party providers (e.g., payment gateways, cloud hosting, AI infrastructure) under strict confidentiality agreements.
• For Legal Reasons: To comply with legal obligations or protect our rights and safety.

Some of our service providers may be located outside the European Economic Area (EEA). When transferring data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs).

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including providing your account services, maintaining records, and satisfying legal, accounting, or reporting requirements. When data is no longer needed, it is securely deleted or anonymized.

7. Your GDPR Rights

As a user, you have comprehensive rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure (Right to be Forgotten): Request deletion of your personal data.
• Right to Restrict Processing: Request the suspension of processing of your data.
• Right to Data Portability: Request the transfer of your data to you or a third party.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.

To exercise any of these rights, or if you have any complaints, please raise a support ticket on our website so we can consider your request and promptly address it to fulfill your requirements.

8. Data Security

We implement robust security measures to protect your information from unauthorized access, alteration, disclosure, or destruction. However, please note that no transmission over the internet is completely secure.

9. Contact Us

Dayoutbook.lk is the Data Controller responsible for your personal information. If you have any questions or wish to exercise your rights, please reach out to us:

Email: dayoutbook@gmail.com
Address: dayoutbook.lk , Ragama
Phone: +94 71 100 900 8