Legal

Privacy Policy

Last Updated: March 11, 2026

1. Information We Collect

We collect information you provide directly, data generated through your use of the Platform, and limited information from third-party services. This includes:

1.1 Information You Provide

  • Account Information: Name, email address, phone number, date of birth, and password.
  • Profile Information: Physical attributes (height, weight, measurements), photos, videos, bio/description, skills, portfolio links, social media handles, and model types.
  • Business Information: Company name, organization type, contact details, website, industry, logo, and business description.
  • Booking & Service Data: Service preferences, scheduling availability, package details, booking requests, and appointment records.
  • Health & Fitness Data: Body measurements, diet information, medical disclosures, fitness goals, and progress records (provided voluntarily for fitness programs).
  • Payment Information: Transaction records for marketplace purchases, booking payments, course subscriptions, and rental orders. Payment card details are processed by third-party payment providers and are not stored on our servers.
  • Communication Data: Messages sent through the Platform's chat system, notifications, and email correspondence.

1.2 Automatically Collected Data

  • Usage Data: Login activity, page views, feature usage, actions performed, and interaction patterns.
  • Device Information: Browser type, operating system, screen resolution, and device identifiers.
  • Location Data: Approximate location based on IP address (we do not collect precise GPS data).

1.3 Third-Party Data

  • Social Login: If you sign in with Google or Facebook, we receive your name, email, and profile picture from those services.
  • Referrals: If you join via a referral link, the referrer's user ID is recorded.

2. How We Use Your Information

We use your information for the following purposes:

  • Core Services: To create and manage your account, display your profile, facilitate connections between models/talents and businesses, process bookings, and enable marketplace transactions.
  • Personalization: To customize your experience, show relevant opportunities, and provide tailored recommendations.
  • Communication: To send notifications about bookings, project updates, messages, and important account information.
  • Safety & Moderation: To detect and prevent fraud, enforce our terms, run automated content moderation (including NSFW image detection), and maintain Platform security.
  • Verification: To review and verify profiles and organizations.
  • Improvement: To analyze usage patterns, improve features, fix bugs, and develop new services.
  • Legal Compliance: To comply with applicable laws, regulations, and legal processes.

We do not sell your personal data to third parties.

3. Information Sharing

We share your information in the following circumstances:

  • Public Profile: Information you choose to make public (profile details, portfolio photos, business listings) is visible to other Platform users and may appear in search results.
  • Booking Partners: When you make or receive a booking, relevant contact and service details are shared between the parties involved.
  • Service Providers: We use third-party services for essential Platform functions:
    • Google Firebase (authentication, database, file storage, hosting)
    • Cloud MySQL (data redundancy and analytics)
    • Email services (transactional emails and notifications)
    • Payment processors (for marketplace and booking transactions)
    These providers are contractually bound to protect your data and use it only for the services they provide to us.
  • Legal Requirements: We may disclose information if required by law, court order, government request, or to protect the rights, safety, or property of Catwa or its users.
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction.

4. Sensitive Data Protection

Certain categories of data receive additional protection:

  • Secure Data: Email addresses, phone numbers, and admin-level access are stored in a separate, restricted collection with enhanced access controls.
  • Health & Fitness Data: Medical information, body measurements, and dietary data provided for fitness programs are accessible only to you and your assigned fitness instructor. This data is never shared publicly or used for advertising.
  • Financial Data: Payment card numbers are processed by third-party payment providers and are never stored on our servers. Transaction records are kept for accounting and dispute resolution.
  • Casting Videos: Videos marked as "Private" are accessible only to you and approved viewers. Access requests follow a notification-based approval workflow.

5. Data Storage & Security

Your data is stored and protected as follows:

  • Data is stored on Google Firebase infrastructure with encryption in transit (TLS) and at rest.
  • Uploaded images and videos are stored in Firebase Storage with access-controlled paths.
  • A redundant copy of structured data is maintained in a MySQL database for analytics and backup purposes.
  • Deleted photos are soft-deleted (moved to a deleted_photos array) for an audit trail, but removed from public visibility immediately.
  • We retain your data for as long as your account is active. After account deletion, data is purged in accordance with our Data Deletion Policy.

6. Your Rights

You have the following rights regarding your personal data:

  • Access: View all personal data associated with your account through Account Settings.
  • Correction: Update or correct your information at any time through your profile or settings.
  • Deletion: Delete your account and associated data through Account Settings or by emailing us. See our Data Deletion Policy for details.
  • Portability: Request a copy of your data in a structured, machine-readable format by contacting support.
  • Restrict Processing: You may hide your profile from public view while retaining your account.
  • Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
  • Object: You may object to the use of your data for direct marketing or promotional purposes.

To exercise any of these rights, contact us at support@catwa.lk. We will respond to requests within 30 days.

7. Cookies & Local Storage

The Platform uses the following local storage mechanisms:

  • Authentication Tokens: Essential for maintaining your login session (Firebase Auth).
  • Theme Preference: Your light/dark mode preference is stored in localStorage.
  • Language Preference: Your chosen display language is stored locally.
  • Notification Preferences: Browser notification permission status.

We do not use third-party tracking cookies. We do not serve advertisements or share browsing data with ad networks. Anonymous usage analytics may be collected to improve the Platform.

8. Children's Privacy

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that a child under 18 has provided personal data without parental consent, we will take steps to delete that data promptly.

Where a minor's profile is managed by a parent or legal guardian (as permitted under our Terms), the guardian is responsible for the accuracy and appropriateness of all information provided.

9. International Data Transfers

Catwa is operated from Sri Lanka. If you access the Platform from outside Sri Lanka, your data may be transferred to and processed in Sri Lanka. By using the Platform, you consent to this transfer. We take appropriate measures to ensure your data is treated securely regardless of where it is processed.

10. Data Retention

We retain your data according to the following guidelines:

  • Active Accounts: Data is retained for as long as your account remains active.
  • Deleted Accounts: Profile data is deleted within 30 days. Some data may be retained longer for legal, accounting, or fraud prevention purposes.
  • Transaction Records: Purchase, booking, and payment records are retained for 7 years as required by tax and commercial law.
  • Activity Logs: Usage logs are retained for 12 months for security and analytics purposes, then anonymized.
  • Communication Records: Chat messages are retained for 90 days after account deletion.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

  • Update the "Last Updated" date at the top of this page.
  • Notify registered users via email or in-app notification.
  • Provide a summary of key changes.

Continued use of the Platform after changes take effect constitutes acceptance of the updated policy. We encourage you to review this policy periodically.

12. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us: