Privacy Policy

1. Who we are

MotoBi is a motorbike marketplace app for Sri Lanka. It is operated by ThuliNexis Digital (Pvt) Ltd, 57 Upcot Road, Maskeliya, Sri Lanka.

In the language of the Personal Data Protection Act, No. 9 of 2022 (“the Act”), we are the controller of the personal data described in this policy.

Contact for privacy matters: info@thulinexis.com / thulinexis@gmail.com

2. What MotoBi is, and what it is not

MotoBi is a platform that lists motorbikes and shops so buyers and sellers can find each other. We are not a party to any sale, repair, or transaction. We do not sell bikes or parts, we do not carry out repairs, and we do not hold money for either side.

This matters for privacy because the details you publish in a listing — including your contact number — are shown to other users so they can contact you directly.

3. What we collect

3.1 Information you give us

When you create an account

• Your name
• Your mobile number
• Your email address
• Your district and city
• If you sign in with Google, we receive your name, email address and Google account identifier from Google. We do not receive your Google password. We still ask you for your mobile number separately, because buyers need to be able to contact you.

When you post a listing

• Bike details: brand, model, year, condition, mileage, price, description
• Photographs of the bike
• The district and city where the bike is
• Whether you are willing to be contacted on WhatsApp

When you register a shop

• Shop name, owner name, contact numbers, email
• Address, district, city, and where given, map location
• Opening hours, services offered, description
• Photographs of the shop

Verification documents (shops only)

To confirm a shop is a real, legally operating business before we list it, we ask the owner to upload:

• A business registration certificate or trade licence
• The front and back of the shop owner’s National Identity Card (NIC)
• A photograph of the shop premises

These documents are treated as our most sensitive data. Section 6 explains exactly how they are handled.

When you contact us or report a problem

• What you report, and about which listing, shop or advertisement
• Your contact number, if you ask us to call you back

3.2 Information we generate

• Image fingerprints. When a photograph is uploaded we calculate a mathematical fingerprint of it. This lets us detect the same photograph being re-used across listings, which is how stolen-photo and duplicate-listing fraud usually shows up. The fingerprint is not a face scan and cannot be turned back into a picture.
• Moderation records. If staff remove a listing or shop, we record who did it, when, and the reason given.
• Document access records. Every time a staff member opens a verification document, we record who opened it, which document, and when.
• Basic technical information needed to operate the service, such as your device’s network address and app version.

3.3 What we do not collect

• We do not track your location in the background. Any location we hold is a district, city or address that you typed in yourself.
• We do not collect your racial or ethnic origin, political opinions, religious beliefs, or health information.
• We do not read your contacts, messages, or other apps.

4. Why we use your data, and on what legal basis

Where we rely on your consent — most importantly for verification documents — you may withdraw that consent at any time. See section 9.

5. What other people can see

This is the part most people care about, so it is set out plainly.

Publicly visible to anyone using the app:

• Your listings: bike details, photographs, price, district and city
• The contact number you chose to publish on your listing
• Approved shop details: shop name, photographs, address, opening hours, contact numbers

Never publicly visible:

• Your NIC images, NIC number, business registration or trade licence
• Your email address
• Reports you submit about other users
• Any internal note staff record about your account

Visible to MotoBi staff only:

• Verification documents, and only to staff whose role permits it
• Reports, moderation history, and account records

If your listing or shop is removed, we tell you the reason. We do not tell the person you were dealing with who reported it.

6. How we handle NIC and verification documents

We ask for these documents only to confirm a shop owner is who they say they are, and that the business is real. We know these are sensitive, so:

• They are stored in private storage that is not reachable from the public internet. There is no public link to your NIC image. Guessing a web address will not reach it.
• They can only be opened through a route that first checks the person asking is either you or an authorised staff member. Anyone else gets nothing.
• Every staff view is logged — who, which document, when.
• They are never shown in the app, never included in any public response, and never sent to advertisers or any other user.
• They are never published, sold, or shared for marketing.

We may disclose them if we are legally required to — for example under a court order, or a lawful request from the Police or a regulator investigating fraud. If that happens and we are permitted to tell you, we will.

Retention: see section 8.

7. Who we share data with

We do not sell your personal data. We share it only with service providers who help us run MotoBi, and only as much as they need:

We do not give any of these providers permission to use your data for their own purposes.

8. How long we keep things

When you close your account, we delete or anonymise your personal data, except where we must keep something to meet a legal obligation, or to defend against a claim, or where it forms part of a fraud record.

9. Your rights

Under the Personal Data Protection Act, No. 9 of 2022, you have the right to:

• Be told what personal data we hold about you and how we use it
• Access a copy of your personal data
• Correct data that is wrong or incomplete
• Ask us to delete your personal data
• Withdraw consent where we relied on your consent
• Object to certain uses of your data
• Ask for a human review of a decision made purely by automated means

Some of these rights have limits set out in the Act. For example, we may need to keep certain records to meet a legal obligation, or to investigate fraud.

How to exercise them: email info@thulinexis.com / thulinexis@gmail.com from the email address on your account, or write to us at the address in section 1. We will respond within 24 hours.

If you are not satisfied, you may complain to the Data Protection Authority of Sri Lanka. Its contact details are published at dpa.gov.lk.

10. Data stored outside Sri Lanka

Some of the providers listed in section 7 store data outside Sri Lanka. The Act places conditions on sending personal data abroad, and we take steps to make sure your data is protected to the standard the Act requires wherever it is held.

11. Security

• Verification documents are held in private storage, reachable only through an authenticated route, with every staff access logged.
• Staff accounts are separate from user accounts, and each staff member only has the permissions their role requires.
• Access to sensitive documents is limited to staff who need it.

No system is perfectly secure. If a breach happens that is likely to affect you, we will notify you and the Data Protection Authority as the Act requires.

12. Children

MotoBi is not intended for children. You must be at least 18 years old to register an account, post a listing, or register a shop. If we learn that we hold personal data of a child, we will delete it.

13. Advertisements

MotoBi shows advertisements from third-party businesses. These are supplied by the advertiser, who is responsible for their content. We do not build an advertising profile of you, and we do not share your personal data with advertisers.

14. Changes to this policy

If we change this policy we will publish the new version here and update the date at the top. If a change is significant, we will tell you in the app.

15. Contact

ThuliNexis Digital (Pvt) Ltd
57 Upcot Road, Maskeliya
Email: info@thulinexis.com / thulinexis@gmail.com