Privacy policy

IRO Fashion, of 170/A, Thewatte, Gamagoda Rd, Kalutara 12016, Sri Lanka, decides how and why your personal data is used. For any question about this policy, contact support@irofashion.com.

• Identity and contact details. Your name, phone number, email address and delivery address.
• ID number: your National Identity Card (NIC), passport or driving licence. Used solely to identify a tailoring record so that repeat customers are matched to their existing measurements rather than duplicated. Providing your NIC is optional; without it we keep your tailoring record under your name and phone number.
• Body measurements. The measurements needed to cut and stitch your garment, plus any fitting notes.
• Reference photographs you upload. Sample or inspiration images attached to a stitching request. These are stored privately and are not published.
• Photos of your ID, when you rent. A photo of the front and back of the NIC, passport or driving licence you rent against, so we know who has a piece. Stored privately and seen only by staff who handle rentals.
• Order and payment records. What you ordered, the amount, the payment status and the delivery status. We do not receive or store your card number.
• Account data. If you sign in with Google, we receive your name, email address and profile picture from Google. We do not receive your Google password.
• Technical data. Basic server and security logs generated when you use the site.

• To make your garment and fulfil your order, because we need it to perform our contract with you. Measurements and ID numbers fall here.
• To take payment and prevent fraud: contract performance and our legitimate interest in being paid.
• To keep accounting and tax records, because the law requires it.
• To answer your questions and handle complaints: our legitimate interest in running the business properly.
• To send marketing messages, only with your consent, which you can withdraw at any time.

We do not sell your data, and we do not use your measurements or photographs for advertising.

Your ID number (NIC, passport or driving licence) identifies your tailoring record. It is not a password. Knowing an ID number does not give anyone access to an online account here, and having an online account does not reveal an ID-linked tailoring record. The two are kept deliberately separate in our systems, and are only connected when you explicitly ask us to connect them.

Our website and database are hosted on Supabase, which acts as our data processor and stores data in Singapore. Uploaded reference photographs are held in private storage and are served only through short-lived signed links. The site itself is served by Vercel.

Access is restricted by database-level row security: a customer account can read only its own records, and staff access requires a separate administrator profile that is granted by us, never by signing in with Google.

• Supabase: hosting and database processor.
• Vercel: website hosting processor.
• Google: only if you choose to sign in with Google, and only to authenticate you.
• PayHere: to process payments. They handle your card details under their own privacy policy.
• Our courier partners: your name, address and phone number, so a parcel can reach you.
• Government authorities, where we are legally required to disclose.

• Order and payment records: 7 years, as required for tax and accounting.
• Measurements and ID numbers: 2 years after your last order, so repeat orders do not require re-measuring. You may ask us to delete them sooner.
• Photos of your ID for a rental: about 30 days after the rental is returned or cancelled. We keep the type of ID and its last four characters with the booking.
• Reference photographs: 90 days after the order is completed.

Under the Personal Data Protection Act No. 9 of 2022 you may ask us to give you a copy of your data, correct it, delete it, or stop using it for a particular purpose. Write to support@irofashion.com and we will respond within 14 days.

Some requests have limits: we cannot delete records we are legally required to keep for accounting, and deleting your measurements means a future order will need new ones.

If you are not satisfied with our response, you may complain to the Data Protection Authority of Sri Lanka.

We use cookies that are necessary for the site to work: keeping you signed in, remembering the contents of your cart, and protecting against abuse. We do not set analytics or advertising cookies. If we later add them, we will ask for your consent first and update this page.

We stitch for customers of all ages, but an order must be placed by an adult. We do not knowingly create online accounts for children under 16.

Write to support@irofashion.com, call 071 628 5427, or post to IRO Fashion, 170/A, Thewatte, Gamagoda Rd, Kalutara 12016, Sri Lanka. See also our terms of service.