Privacy Policy

1. What Personal Data Means

For this Policy, personal data generally means information relating to an identified or identifiable individual.

Depending on how you use Thula, this may include information such as your name, contact details, account information, professional information, profile information, reviews, ratings, verification information, device information, and technical information.

2. Information We Collect

3. How We Use Personal Data

We may process personal data to:

1. create and manage accounts;
2. provide Thula services;
3. display profiles and reputation information;
4. calculate reputation metrics;
5. calculate Trust Scores;
6. verify work history and other claims;
7. process reviews and ratings;
8. detect fraudulent or coordinated activity;
9. prevent manipulation of reputation systems;
10. process disputes and appeals;
11. provide customer support;
12. secure the Platform;
13. maintain technical logs;
14. improve Platform functionality;
15. develop and evaluate algorithms;
16. comply with legal obligations;
17. establish, exercise, or defend legal claims;
18. communicate important service information; and
19. perform other purposes permitted by applicable law.

4. Reputation Processing

Thula processes information to calculate reputation-related metrics.

These may include:

• Global Trust Factor;
• Trust Score;
• category scores;
• reputation tiers;
• reviewer-authority signals;
• verification weighting;
• recency weighting;
• percentile rankings; and
• anti-manipulation signals.

These calculations may involve automated processing.

A score is an algorithmic representation of information available to Thula. It should not be interpreted as a statement about a person's inherent character, value, or worth.

5. Automated Processing and AI

Thula may use automated systems and artificial intelligence for:

• fraud detection;
• anomaly detection;
• content moderation;
• review analysis;
• dispute analysis;
• classification;
• reputation-system protection;
• recommendations; and
• service improvement.

AI-generated outputs may be inaccurate.

Where appropriate, Thula may provide human review, correction, appeal, or dispute mechanisms.

We do not represent that an AI-generated result is independently verified merely because AI was used.

6. Legal Bases for Processing

Depending on the circumstances, we may process personal data where permitted or required by applicable law, including where processing is:

• necessary to provide a requested service;
• based on consent;
• necessary to comply with a legal obligation;
• necessary to protect legitimate interests where permitted by law;
• necessary for security, fraud prevention, or abuse prevention;
• necessary to establish, exercise, or defend legal claims; or
• otherwise permitted under applicable data-protection law.

Where consent is required, we will seek consent in an appropriate manner.

7. Public Profiles and Search Engines

Thula is a reputation platform. Some information is intentionally designed to be publicly discoverable.

If you publish information as public, that information may be:

• visible to other Thula users;
• accessible through the internet;
• indexed by search engines;
• copied or cached by third parties; or
• shared by other users.

We cannot guarantee that information once made publicly available can be completely removed from third-party systems.

Users should carefully consider what information they choose to make public.

8. Reviews and Reputation Information

Reviews and ratings are a core part of Thula.

Where permitted by the applicable feature and law, reputation information may remain associated with a profile even after an account is closed if retention is necessary for legitimate purposes such as:

• preventing fraud;
• maintaining integrity of the reputation system;
• resolving disputes;
• maintaining audit records;
• complying with legal obligations; or
• protecting the rights of users and Thula.

Where a review is disputed, it may be temporarily excluded from relevant reputation calculations while the dispute is being processed.

9. Data Sharing

We may disclose personal data to:

• service providers that process data on our behalf;
• authentication providers;
• hosting and infrastructure providers;
• analytics and security providers;
• communication providers;
• AI or machine-learning service providers;
• verification providers;
• professional advisers;
• legal authorities where required or permitted by law; and
• other parties where you have authorized the disclosure or applicable law permits it.

We do not sell personal data merely because it is used to provide Thula's reputation services.

Where third-party processors are used, we seek to require appropriate contractual and technical safeguards.

10. Third-Party Services

Thula may rely on third-party services for authentication, hosting, infrastructure, analytics, security, communications, AI processing, and other functions.

Third-party providers may process information according to their own privacy policies and contractual obligations.

Examples may include authentication services such as Auth0 and cloud infrastructure providers.

The specific providers used by Thula may change as the Platform develops.

11. International Data Transfers

Although Thula initially operates in Sri Lanka, some third-party technology providers may process personal data outside Sri Lanka.

Where personal data is transferred or processed outside Sri Lanka, Thula will seek to use appropriate safeguards and comply with applicable Sri Lankan data-protection requirements.

12. Data Security

We use appropriate technical and organizational measures intended to protect personal data against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

Security measures may include:

• encryption;
• access controls;
• authentication controls;
• logging;
• monitoring;
• secure infrastructure;
• vulnerability management; and
• security procedures.

No internet-based system can be guaranteed to be completely secure.

13. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

Retention periods may depend on:

• the type of data;
• the purpose for which it was collected;
• account status;
• dispute status;
• security requirements;
• fraud-prevention requirements;
• legal obligations; and
• legitimate record-keeping requirements.

Different categories of information may therefore have different retention periods.

14. Your Data Protection Rights

Subject to applicable law and relevant conditions, you may have rights concerning your personal data, including rights relating to:

• access;
• correction;
• updating;
• withdrawal of consent where processing relies on consent;
• deletion or erasure where applicable;
• restriction or objection to certain processing;
• data portability where applicable; and
• other rights provided under applicable Sri Lankan data-protection law.

Some rights may be subject to legal exceptions or conditions.

For example, deleting information may not be possible where retention is legally required or necessary for fraud prevention, dispute resolution, security, or the establishment or defense of legal claims.

15. Reputation and Correction Requests

Because Thula is a reputation platform, requests concerning reputation information may require additional verification.

If you believe information associated with your profile is inaccurate, you may contact us and provide sufficient information for us to identify the relevant record.

Where appropriate, we may:

• correct inaccurate information;
• request supporting evidence;
• initiate a verification process;
• refer the matter to a dispute process;
• temporarily restrict affected information; or
• take other appropriate action.

Submitting a correction request does not automatically mean that the information will be removed.

16. Children's Privacy

Thula is not designed to encourage children to create public professional reputation profiles.

Where the law requires parental or guardian involvement for the processing of a child's personal data, we will apply the appropriate safeguards.

If we learn that personal data has been collected in circumstances where required consent or authorization was not obtained, we may take appropriate steps to delete or restrict the information.

17. Cookies and Similar Technologies

Thula may use cookies and similar technologies for purposes such as:

• authentication;
• security;
• session management;
• preferences;
• analytics;
• performance monitoring; and
• service improvement.

Where required, we will provide appropriate cookie controls or consent mechanisms.

18. Communications

We may send service-related communications including:

• account notifications;
• security alerts;
• verification notifications;
• dispute updates;
• policy changes; and
• important Platform information.

Marketing communications, where used, will be handled in accordance with applicable law and any required consent or opt-out mechanisms.

19. Data Breaches and Security Incidents

If a security incident occurs that affects personal data, Thula will assess the incident and take actions required by applicable law, including notification obligations where applicable.

We may also take steps to contain the incident, investigate its cause, protect affected accounts, and prevent recurrence.

20. Privacy Complaints

If you believe that your personal data has been processed improperly, you may contact Thula using the contact information below.

We will review privacy complaints and take reasonable steps to investigate and respond.

You may also have rights to complain to the relevant data-protection authority where provided by applicable law.

21. Changes to This Privacy Policy

We may update this Privacy Policy as our Platform, technology, business practices, or legal obligations change.

The updated version will be published through Thula with a new "Last Updated" date.

Where required, we will provide additional notice or obtain consent.