Policy
Privacy Policy
Last updated: 2 November 2026
This policy explains what personal information Cookie Monster LK ("we", "us") collects when you visit www.cookiemonster.lk, order from us, chat with our order assistant or contact us. It also explains how we use and protect that information. We follow the Personal Data Protection Act No. 9 of 2022 of Sri Lanka.
1. Who we are
Cookie Monster LK is a home bakery at 288/12 Temple Road, Kalubowila, Dehiwala-Mount Lavinia, Sri Lanka. We are responsible for (the "controller" of) the personal information described here. Contact us on +94 77 352 8700 (phone or WhatsApp).
2. What we collect
- Order details: your name, mobile number, pickup or delivery choice, delivery address, the date and time you need the order, what you ordered, and any notes you add. Notes might include a message for a cake, a name, or allergy information.
- Email address: only if you pay by card. PayHere uses it to send your payment receipt.
- Payment records: the amount, date and method of each payment, and the reference number PayHere gives us. We never see or store your card number. Card details are entered on PayHere's secure page. PayHere is a licensed payment service provider that meets the card industry's PCI DSS security standard.
- Chat messages: what you type to our "Order by chat" assistant, so it can understand your order.
- Messages you send us on WhatsApp, Instagram or by phone.
- Technical data: your IP address and basic browser details. We use these to keep the website secure and to stop spam and abuse, for example by limiting how many orders one connection can place.
Your bag, checkout details and chat conversation are also saved in your own browser, so they're still there if you come back. They stay on your device until you clear your browser data.
3. How we use it
- To make, deliver and hand over your order, and to confirm it with you on WhatsApp or by phone.
- To take payment and give refunds.
- To answer questions, sort out problems and handle allergy requests.
- To keep the business records we must keep for accounts and tax.
- To protect the website from fraud and misuse.
- To send you offers on WhatsApp, only if you have agreed. You can say "stop" at any time.
We use your information because we need it to fulfil your order (our contract with you), because we must keep records by law, because we have a legitimate interest in running a safe and well-run business, or because you have given consent (for marketing). We never sell your personal information.
4. Who we share it with
We share only what each party needs:
- Delivery riders or couriers: your name, mobile number and delivery address.
- PayHere (payment processing): your name, email, mobile number and the amount, when you pay by card.
- Cloudflare: hosts our website and order database.
- AI services for the chat assistant: your chat messages are processed by an AI model, Cloudflare Workers AI, or Anthropic's Claude when enabled, to understand your order. Please don't type card numbers or other sensitive details into the chat.
- Meta (WhatsApp, Instagram): when you message us there.
- Google: our website loads fonts from Google, which receives your IP address. If you follow our links to Google Maps, Google's own privacy policy applies.
- Authorities: only if the law requires it.
Some of these providers may process data outside Sri Lanka. We use well-known providers that protect personal data to recognised international standards.
5. How long we keep it
- Order and payment records: kept for as long as Sri Lankan tax and accounting rules require, then deleted or anonymised.
- Chat messages: not stored on our servers after your reply is sent, apart from short technical logs that expire automatically.
- Marketing contacts: kept until you ask us to stop.
6. Your rights
Under the Personal Data Protection Act you can ask us to:
- show you the personal information we hold about you;
- correct it if it is wrong or incomplete;
- delete it, where we don't need to keep it for the law or an open order;
- stop using it for marketing, or withdraw consent you gave; or
- look at a decision again, if you object to how we used it.
To make a request, WhatsApp or call us on +94 77 352 8700. We may ask you to confirm your identity, and we will reply within the time the law allows. If you are not happy with our answer, you can complain to the Data Protection Authority of Sri Lanka.
7. Security
Our website uses HTTPS encryption throughout. Order records sit in a secure database that only our staff can reach, with their own password-protected logins. Card payments are handled entirely by PayHere.
8. Children
Our website is for adults placing orders. If you are under 18, please ask a parent or guardian to order for you.
9. Changes
If we change this policy we will update the date at the top of this page. Big changes will also be shown on our website.
10. Contact
Cookie Monster LK · 288/12 Temple Road, Kalubowila, Dehiwala-Mount Lavinia, Sri Lanka
Phone and WhatsApp: +94 77 352 8700 · Instagram: @cookie.monster.lk