Privacy Policy

Effective / last updated: 14 October 2026

This Privacy Policy explains how Curry King (Private) Limited ("Curry King", "we", "our", "us") collects, uses, shares and protects your personal information when you order from us. It applies to:

  • our website at curryking.lk and m.curryking.lk;
  • the Curry King app for Android (Google Play) and the Curry King app for iOS (App Store);
  • Keeri, our ordering assistant, and the order messages we send you.

The website and the apps share one Curry King account, so this one policy covers all of them. Differences between them are listed under "Platform notes". The Curry King Rider app has its own policy.

1. Information we collect

Information you give us

  • Account details — your name, email address and password when you create an account, or your name, email and account ID from Google or Apple if you sign in with them.
  • Phone number — which we verify with a one-time code sent by SMS. A verified number is needed to place some orders and to join a canteen.
  • Delivery addresses — the addresses you type or save, with the map position we look up for them, and any directions you add.
  • Orders — what you order, when, where it is delivered or collected, the amount, discounts, vouchers, tips, and ratings or comments you leave on an order.
  • Payments — card payments are entered on the secure payment page of our bank (HNB, provided by Cybersource), not on our site or app. We receive the result of the payment, never your full card number or security code. If you choose "Save this card", we keep a payment token from the bank, encrypted, together with the card brand, last four digits and expiry date so we can show you the saved card.
  • Wallet and loyalty — your wallet top-ups and balance, loyalty points and vouchers.
  • Canteen membership — the canteens or workplaces you join, and the organisation an order is billed to.
  • Preferences — food preferences you set, such as spice level or vegetarian first.
  • Messages — what you write to Keeri, to our support team, or in a contact or sign-up form.
  • Guest orders — if you order without an account, the name, phone number, email and address you give for that order.

Information collected automatically

  • Device and connection — your IP address, the type of device, operating system and browser (or app version), and an approximate area derived from the IP address, recorded with your cart and your orders to prevent fraud and to help with delivery questions.
  • How you use our services — pages and dishes you view, items added to or removed from your cart, checkout and sign-in steps. We do this to run and improve the service and to understand where ordering goes wrong. These records start without your name; once you sign in they are linked to your account.
  • Your cart — the contents of your cart are saved on our servers while you shop, including the contact details you have entered, so it is not lost and so we can help you finish an order you did not complete.
  • Error reports — when something fails, a technical report with the error, the page, your device type and a session identifier.
  • Cookies and similar storage — see section 6.

Location

If you allow it, the website or app reads your device location on the map screens (pickup points, our food carts and order tracking) to show where you are and which pickup points are nearest. This location is used on your device only and is not sent to or stored by Curry King. The map is provided by Google Maps. The position of a delivery address comes from the address you type, not from your device. You can refuse or withdraw location access at any time in your browser or device settings; you can still order by typing an address.

Camera

If you allow it, the camera is used only to scan a canteen QR code. The image is read on your device to decode the code; no photo or video is uploaded or stored.

Information from others

  • Google or Apple, when you sign in with them (name, email, account ID).
  • Our bank, the outcome of your card payment.
  • Our riders, the delivery status of your order.
  • If you message us on WhatsApp, your WhatsApp number, which we use to link the conversation to your account.

We do not collect your date of birth or gender, and we do not knowingly collect information from children.

2. How we use your information

  • To create and manage your account and keep it secure, including checking your phone number.
  • To take, prepare, deliver and collect your orders, take payment, and issue receipts and tax invoices.
  • To send you messages about your orders and account by SMS, email or, where enabled, WhatsApp — confirmations, status updates, verification and password reset codes.
  • To run Keeri, our ordering assistant (see section 4).
  • To run wallets, loyalty points, vouchers and canteen accounts.
  • To give support and answer questions and complaints.
  • To follow up when you start signing up or ordering but do not finish — for example, to help you complete sign-up or recover an unfinished cart.
  • To send you offers and vouchers (see section 5).
  • To understand how our services are used, fix faults, plan production and improve the menu and the service.
  • To detect and prevent fraud and misuse.
  • To meet our legal, tax and accounting obligations.

We use your information because it is needed to provide the service you ask for, because we have a legitimate interest in running and improving our business safely, because the law requires it, or because you have agreed (for example to location or camera access).

3. Who we share it with

We do not sell your personal information, and we do not share it with advertisers or data brokers. We share it only as follows:

  • Riders and pickup points — your name, phone number and delivery address go to the rider delivering your order, and your name to the outlet or pickup point handing it over.
  • Your organisation — for canteen or company-billed orders, the organisation paying for the order receives the order and invoice details.
  • Service providers who work for us under contract and only on our instructions:
    • Google — cloud hosting and database, account sign-in, Google Maps, and Google Play app distribution;
    • Apple — Sign in with Apple and App Store distribution;
    • HNB and Cybersource — card payments;
    • SMS gateway providers — verification codes and order messages;
    • Meta (WhatsApp) — order messages and chat, where WhatsApp is enabled;
    • Amazon Web Services — sending email;
    • artificial-intelligence (AI) service providers — to generate Keeri's replies (section 4).
  • Legal reasons — where the law, a court or a public authority requires it, or to protect the rights and safety of our customers, staff and business.
  • Business transfer — if Curry King is merged, sold or restructured, to the new owner, under this policy.

4. Keeri, our ordering assistant

Keeri helps you browse the menu, build a cart and follow your order. When you chat with Keeri, your messages, your name and contact details, your cart and your recent orders are sent to an AI service provider to generate the reply. Conversations are stored in your account history so Keeri can continue them and so our team can review them to give support and improve the service. Do not share card numbers or passwords with Keeri.

5. Offers and marketing

We may send you offers and vouchers — for example a discount if you have not ordered for a while — by SMS or email. We choose offers using your order history and preferences. We do not use advertising networks or track you on other apps or websites. To stop marketing messages, email regulatory@curryking.lk or tell our support team; we will stop them within 7 days. Messages about your orders and account are part of the service and continue while you have an account.

6. Cookies and local storage

The website and the apps store small amounts of data on your device to work:

  • a device identifier cookie (kept for up to one year) and a session identifier, to keep your session and recognise returning visits;
  • your sign-in session;
  • your cart, saved addresses, favourite pickup points, guest contact details and any voucher you opened from a link;
  • copies of the menu and settings, so pages load faster.

We do not use advertising or third-party tracking cookies. Clearing your browser or app data removes this storage. See also our Cookie & Tracking Policy.

7. Where your information is stored

Our main databases and servers are in Google Cloud's Mumbai (India) region. Some of our service providers process information in other countries — email is sent through Amazon Web Services in the United States, and AI service providers may process Keeri conversations abroad. We use reputable providers and contracts that require them to protect your information.

8. How long we keep it

  • Account, address and preference information — while your account is open. It is deleted when you delete your account (section 10).
  • Orders, payments, invoices and the records needed to prove them — for as long as tax and accounting law requires, even after your account is deleted.
  • Keeri and support conversations, cart and usage records — while your account is open, unless we need them longer to handle a complaint, dispute or legal matter.
  • Sign-in error logs — 7 days. Verification codes — 10 minutes.

9. Security

Information is encrypted in transit (HTTPS). Saved card tokens are encrypted with keys held in Google Cloud's key management service, and only our payment service can use them. Access to customer information is limited to staff who need it for their work. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

10. Your choices and rights

You can:

  • see and update your name, phone number, addresses, preferences and saved cards in your account;
  • remove a saved card at any time — its stored token is destroyed;
  • withdraw location or camera access in your device or browser settings;
  • stop marketing messages (section 5);
  • ask for a copy of your information, ask us to correct it, or object to how we use it, by emailing regulatory@curryking.lk;
  • delete your account (below).

We answer requests within 30 days and may need to confirm your identity first. You also have the right to complain to the Data Protection Authority of Sri Lanka.

Deleting your account

You can ask us to delete your Curry King account — the same account on the website and in the Android and iOS apps — in any of these ways:

We confirm the request with you on the email or phone number registered to the account, then delete the account within 30 days.

What we delete: your sign-in, profile (name, email, phone number, preferences), saved addresses, saved cards (their stored tokens are destroyed), canteen memberships, Keeri and support conversations, and the usage records linked to your account.

What we keep: records of the orders you placed, payments and tax invoices, for as long as tax and accounting law requires (they are no longer linked to an active account), and any information we need to resolve an open complaint, refund or dispute.

Wallet and loyalty: unused wallet balance, loyalty points and vouchers end when the account is deleted. If you have a wallet balance, contact us before you request deletion.

Deleting the app from your phone does not delete your account.

11. Platform notes

  • Android app — asks for Location (optional, map screens only, used on your device) and Camera (optional, canteen QR codes, used on your device), and uses the internet. Google sign-in uses the Google account on your device. The app checks Google Play for updates and may ask you to install an important update. You can change permissions in Android Settings → Apps → Curry King → Permissions.
  • iOS app — offers Sign in with Apple, and uses Location and Camera in the same way, only with your permission. It does not track you across other companies' apps or websites and does not use the advertising identifier (IDFA).
  • Website — uses the cookies and local storage described in section 6, and asks your browser before reading your location.

12. Children

Our services are for adults. Orders must be placed by people aged 18 or over, and we do not knowingly collect information from children under 13. If you believe a child has given us information, contact us and we will delete it.

13. Changes to this policy

We may update this policy when our services or the law change. The current version is always published at policy.curryking.lk/privacy-policy with its effective date at the top. If a change is significant, we will tell you in the app, on the website or by email before it takes effect.

14. Contact us

Curry King (Private) Limited
55/2 Vauxhall Lane, Colombo 2, Sri Lanka
Email: regulatory@curryking.lk
Phone: +94 11 444 1300

Curry King (Private) Limited · regulatory@curryking.lk