Privacy Policy

1. Introduction & Who We Are

uvin.lk (“the Platform”, “we”, “us”, or “our”) is a Bitcoin education platform owned and operated by Uvin Vindula, trading as IAMUVIN. We are based in Sri Lanka and the United Kingdom. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you access or use our website at uvin.lk, including all associated services, educational content, merchant store, blog, and tools.

By accessing or using the Platform, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the Platform immediately.

2. Information We Collect

We collect various categories of information depending on how you interact with the Platform:

2.1 Account Information

When you register for an account, we collect your name and email address. Authentication is handled via email and one-time password (OTP) through our database provider. We do not collect or store passwords.

2.2 Usage Data

We automatically collect information about your interactions with the Platform, including pages visited, course progress, content engagement, referral sources, session duration, and click patterns.

2.3 Device & Technical Data

We collect device type, operating system, browser type and version, screen resolution, IP address, approximate geographic location (country/city level), and language preferences.

2.4 Payment Data

All payment processing is handled by CeyPay, our crypto-to-LKR payment gateway. We do not directly collect, store, or process cryptocurrency wallet addresses, private keys, or transaction hashes. CeyPay processes this data independently under its own privacy policy.

2.5 Cookie Data

We use cookies and similar tracking technologies to collect certain information automatically. For full details, please refer to our Cookie Policy.

2.6 Communications

If you contact us via email or any other channel, we retain the content of your communications, your contact details, and our responses for record-keeping and service improvement purposes.

3. Legal Basis for Processing

We process your personal data on the following legal grounds:

• Contractual Necessity: To provide the services you have requested, including account creation, course access, and order fulfilment.
• Consent: Where you have given explicit consent, such as opting in to marketing communications or accepting non-essential cookies.
• Legitimate Interests: To improve and secure the Platform, analyse usage patterns, prevent fraud, and ensure the integrity of our services, provided such interests are not overridden by your fundamental rights.
• Legal Obligation: Where processing is necessary to comply with applicable laws or regulations.

4. How We Use Your Information

We use the information we collect to:

• Create, maintain, and secure your user account
• Track and display your course and module progress
• Process and fulfil orders placed through our merchant store
• Send transactional communications, including OTP codes, order confirmations, and shipping notifications
• Send marketing newsletters and promotional content (only with your explicit opt-in consent)
• Analyse Platform usage to improve content, features, and user experience
• Detect, prevent, and address fraud, abuse, and security incidents
• Comply with legal obligations and enforce our Terms of Service
• Respond to your inquiries and provide customer support

5. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data. We share data only with the following categories of third-party service providers, strictly as necessary to operate the Platform:

• CeyPay — Our payment gateway for processing cryptocurrency payments and converting them to LKR. CeyPay receives only the data necessary to process your transaction.
• Supabase — Our database and authentication provider, hosted in the Singapore region. Supabase stores account data, course progress, and platform content.
• Google Analytics 4 — We use GA4 to collect anonymised and aggregated usage analytics. IP anonymisation is enabled.
• Meta Pixel — Where you have consented to marketing cookies, Meta Pixel is used to measure advertising effectiveness. This cookie is optional and only set with your consent.
• Hostinger — Our email infrastructure provider for transactional and marketing email delivery.

We may also disclose your information if required by law, regulation, legal process, or government request, or to protect the rights, property, or safety of IAMUVIN, our users, or the public.

6. International Data Transfers

As our services operate across multiple jurisdictions, your personal data may be transferred to and processed in countries outside your country of residence, including Singapore (Supabase), the United States (Google Analytics, Meta), and any jurisdiction where our service providers maintain infrastructure. Where such transfers occur, we take reasonable steps to ensure your data is treated securely and in accordance with this Privacy Policy. By using the Platform, you consent to these transfers.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with our services. Specifically:

• Account data: Retained for the duration of your account and for up to 30 days following account deletion to allow for recovery.
• Transaction records: Retained for a minimum of 6 years to comply with applicable tax and accounting obligations.
• Analytics data: Aggregated and anonymised analytics data may be retained indefinitely as it cannot be linked back to individual users.
• Communications: Retained for up to 2 years from the date of the last correspondence.

When data is no longer required, it is securely deleted or irreversibly anonymised.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Right to Data Portability: Request your data in a structured, commonly used, machine-readable format.
• Right to Object: Object to the processing of your data for specific purposes, including direct marketing.
• Right to Restrict Processing: Request that we limit the processing of your data under certain circumstances.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at hello@uvin.lk. We will respond to all legitimate requests within 30 days.

9. Children's Privacy

The Platform is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at hello@uvin.lk and we will take steps to delete such information promptly. Users between the ages of 13 and 18 should use the Platform only with the involvement and consent of a parent or legal guardian.

10. Cookie Policy

We use cookies and similar technologies to operate the Platform, remember your preferences, and analyse usage. For comprehensive information about the cookies we use, their purposes, and how to manage your cookie preferences, please refer to our dedicated Cookie Policy.

11. Data Security

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to:

• HTTPS/TLS encryption for all data in transit
• Row-level security (RLS) policies enforced at the database level
• Server-side storage of all API keys and sensitive credentials
• Passwordless authentication via OTP to eliminate credential-based attacks
• Regular security reviews and dependency updates

However, no method of electronic transmission or storage is completely secure. While we strive to protect your personal data, we cannot guarantee its absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you via email or a prominent notice on the Platform. Your continued use of the Platform after any changes constitutes your acceptance of the revised policy.

13. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Data Controller: Uvin Vindula (IAMUVIN)
• Email: hello@uvin.lk
• Website: uvin.lk