Sri Lanka’s Safari Jeep Marketplace1. Scope and contact
JeepBooking handles information for tourist/provider accounts, safari requests, provider verification and its related partner/admin apps. Contact helpjeepbooking@gmail.com for privacy requests. Other Shehan Tour Solutions services do not automatically receive your account or booking records.
2. Tourist and booking information
We process authentication/account identifiers, name, country, email and telephone/WhatsApp details; park, package, date/time, traveller counts, hotel/pickup information, notes, quotes and acceptance records; assigned jeep/driver, booking and safari status, cancellation/replacement records, messages, completion reports and reviews.
3. Provider, driver and verification information
Provider onboarding includes service identity, contacts, profile images, operating parks, pickup coverage, descriptions, packages/prices, bank details, licence/verification documents and service gallery images. Fleet/driver records include vehicle registration/capacity/status and authorised driver information.
Approved listing details and validated gallery images may be public. Bank details and verification documents are private operational records for authorised review; they are not intended for public profile display. Provider contacts shown to tourists may be used to arrange the service, not for unrelated marketing.
4. Purposes and processing reasons
We use information to authenticate accounts, evaluate provider applications, display approved listings, manage requests and revisions, assign jeeps/drivers, communicate updates, record completion and commissions, handle disputes/reviews and secure the service. Depending on the activity, this supports the requested/agreed service, proportionate security/operational needs, legal duties or optional consent.
5. Sharing and public content
Supabase supports authentication, database and image storage; Vercel supports hosting. The selected provider and authorised driver receive necessary tourist/contact and trip details. Admin staff have role-based operational access. Communication and app-notification providers receive delivery data required for their roles.
Profile/listing details, photos and approved review content may be visible publicly. Do not put another person’s private contact or identity information in public fields. We do not sell personal data or grant one provider access to unrelated providers’ bookings. Lawful disclosures may be made when required.
6. Payments and financial records
Current tourist checkout is cash directly to the driver, without an online card-payment form. The platform may record agreed fares, cash-collection status, provider commission statements, bank details and any recorded refund/dispute history. Do not submit full card details in chat or notes. A provider’s bank information may be retained for operational/accounting purposes even while online checkout is unavailable.
7. Cookies, session storage and booking source
Authentication and essential account functions may use cookies or local device storage. Production pages classify a broad source such as direct, organic, paid, campaign or referral and store that category with a timestamp in this tab’s session storage for up to 30 minutes. The capture does not persist the complete referring URL or advertising click ID as its source value.
A source category may be associated with a saved booking to understand booking sources. Source capture honours Do Not Track and Global Privacy Control. This is separate from hosting security logs and does not claim that the website is free of all technical logging.
8. Partner and Admin app notifications
When an authorised app user enables notifications, the system processes an installation identifier, push token, account association and notification settings to deliver relevant operational updates. Expo push services and underlying device notification services may process delivery information. Permission can be changed in the app or phone settings; disabling notifications can affect timely updates.
Device permissions and features must be explained in the app where used. This notice does not claim that continuous location tracking is active; notification permission is not consent to unrelated tracking.
9. Email, WhatsApp and booking messages
Authentication and service messages may be sent through configured email or WhatsApp services. Booking-related communication is distinct from marketing consent. Messages or booking chat sent through the platform are operational records visible to authorised participants and support; do not send passwords, unnecessary health details or payment secrets.
10. Retention
We retain account, booking, communication and operational records for as long as needed to provide services, handle complaints and disputes, prevent misuse and meet applicable accounting or legal requirements. We delete or minimise information when no longer needed. Deleting an account may not delete a record that must lawfully be retained; backup and provider records may take longer to expire.
11. Security and international processing
We use access controls and other practical safeguards appropriate to the service. No website, app or messaging platform can guarantee absolute security. Keep passwords, sign-in codes and private links confidential, and report suspected misuse promptly.
Hosting, database, authentication and communication providers may process information outside Sri Lanka. We use these services for the purposes described here and seek appropriate safeguards where required. We do not promise that all information is stored only in Sri Lanka.
12. Your choices and privacy requests
Contact the business using the details below to request access, correction or deletion, ask about use of your information, withdraw optional consent, or raise a concern. We may ask for proportionate identity verification and explain any lawful reason a record must be retained. Do not send passwords or sign-in codes. Rights available under applicable law remain unaffected.
Where applicable, you may raise a privacy concern with Sri Lanka’s Data Protection Authority at www.dpa.gov.lk. A request concerning another service must be directed to that service; the shared Shehan Tour Solutions branding does not merge their accounts or booking records.
13. Children and updates
A responsible adult arranges travel and supplies necessary information for children. We do not intend children to independently operate provider accounts or submit verification documents. Last updated: 6 October 2026. New features that materially change information handling require an updated notice and appropriate choices.