Privacy policy

IRO Fashion, [registered legal entity name], of 178 Thevaththa Gamagoda, Kalutara South, Sri Lanka, decides how and why your personal data is used. For any question about this policy, contact [data protection contact email].

• Identity and contact details. Your name, phone number, email address and delivery address.
• National Identity Card (NIC) number. Used solely to identify a tailoring record so that repeat customers are matched to their existing measurements rather than duplicated. [confirm whether NIC is mandatory or optional]
• Body measurements. The measurements needed to cut and stitch your garment, plus any fitting notes.
• Reference photographs you upload. Sample or inspiration images attached to a stitching request. These are stored privately and are not published.
• Order and payment records. What you ordered, the amount, the payment status and the delivery status. We do not receive or store your card number.
• Account data. If you sign in with Google, we receive your name, email address and profile picture from Google. We do not receive your Google password.
• Technical data. Basic server and security logs generated when you use the site.

• To make your garment and fulfil your order — because we need it to perform our contract with you. Measurements and NIC fall here.
• To take payment and prevent fraud — contract performance and our legitimate interest in being paid.
• To keep accounting and tax records — because the law requires it.
• To answer your questions and handle complaints — our legitimate interest in running the business properly.
• To send marketing messages — only with your consent, which you can withdraw at any time.

We do not sell your data, and we do not use your measurements or photographs for advertising.

Your NIC identifies your tailoring record. It is not a password. Knowing an NIC number does not give anyone access to an online account here, and having an online account does not reveal an NIC-linked tailoring record. The two are kept deliberately separate in our systems, and are only connected when you explicitly ask us to connect them.

Our website and database are hosted on Supabase, which acts as our data processor and stores data in [Supabase project region]. Uploaded reference photographs are held in private storage and are served only through short-lived signed links. The site itself is served by Vercel.

Access is restricted by database-level row security: a customer account can read only its own records, and staff access requires a separate administrator profile that is granted by us, never by signing in with Google.

• Supabase — hosting and database processor.
• Vercel — website hosting processor.
• Google — only if you choose to sign in with Google, and only to authenticate you.
• [payment gateway name] — to process payments. They handle your card details under their own privacy policy.
• [courier / delivery partners] — your name, address and phone number, so a parcel can reach you.
• Government authorities, where we are legally required to disclose.

• Order and payment records: [accounting retention period], as required for tax and accounting.
• Measurements and NIC: [tailoring record retention period], so repeat orders do not require re-measuring. You may ask us to delete them sooner.
• Reference photographs: [photograph retention period] after the order is completed.

Under the Personal Data Protection Act No. 9 of 2022 you may ask us to give you a copy of your data, correct it, delete it, or stop using it for a particular purpose. Write to [data protection contact email] and we will respond within [response time commitment].

Some requests have limits: we cannot delete records we are legally required to keep for accounting, and deleting your measurements means a future order will need new ones.

If you are not satisfied with our response, you may complain to the Data Protection Authority of Sri Lanka.

We use cookies that are necessary for the site to work: keeping you signed in, remembering the contents of your cart, and protecting against abuse. If we later add analytics or advertising cookies, we will ask for your consent first and update this page. [confirm whether analytics tooling is used]

We stitch for customers of all ages, but an order must be placed by an adult. We do not knowingly create online accounts for children under 16.

Write to [data protection contact email], call [customer contact phone], or post to IRO Fashion, 178 Thevaththa Gamagoda, Kalutara South, Sri Lanka. See also our terms of service.