Last updated · 20 October 2026
1.Who we are
Ceylon Envoy designs private journeys in Sri Lanka. Ceylon Envoy is Ceylon Envoy LLC, registered at 30 N Gould St Ste R, Sheridan, WY 82801, United States. Ceylon Envoy LLC decides how the information described in this policy is used, so in data protection law it is the controller of that information. Our team works from Sri Lanka.
In this policy, “we”, “us” and “our” mean Ceylon Envoy LLC. For anything to do with your information, write to concierge@ceylonenvoy.com.
2.In brief
- We collect what you give us to plan and deliver your journey, and the technical information any website receives.
- We use it to answer you, design and arrange your journey, run your account, and keep the site secure.
- We share it only with those who help us do that: our travel partners in Sri Lanka, and the providers who run our systems. We do not sell it, and we do not use it for advertising.
- Analytics cookies are set only if you accept them, and you can change your choice at any time.
- You can ask to see, correct or delete your information by writing to concierge@ceylonenvoy.com.
3.What we collect
- When you visit. Like any website, our servers receive your IP address, your browser and device type, and the pages you ask for. Our host keeps these server records for a short time, for security and to put faults right. Some pictures on the site, such as hotels’ own photographs, load directly from the hotel’s or photographer’s website, which receives the same technical information from your browser; if you sign in with Google, your own profile picture loads from Google in the same way. We ask browsers not to tell those sites which of our pages you are reading.
- In ChatGPT, Claude and other assistants. If you use Ceylon Envoy inside another company’s assistant, such as ChatGPT or Claude, that assistant sends our server what you asked of Ceylon Envoy: places, dates and how many are travelling. We use it to answer and keep none of it, unless you connect the assistant to your Ceylon Envoy account and ask it to save a trip. Then the trip is kept in your account, as a trip planned on ceylonenvoy.com is, and the assistant can list your trips, open them, add to them and change them while they are being planned. It cannot see your passports, your messages with us, the people you have saved or your payments, and it is told how many are travelling, never their names. To disconnect it, remove Ceylon Envoy from the assistant; a connection not used for 30 days ends by itself, and deleting your account ends every one. Our host’s records note only which of our tools was used and which assistant asked. What you write in that assistant is held by the company that runs it, under its own privacy policy.
- When you ask the Envoy. Ask the Envoy, in Explore, is for guests who are signed in. What you write to it and its answers, with the places, hotels and trips it shows you, are kept in your account, so you can return to a conversation, and a trip it drafts is kept in your Trips as any trip you plan is. Our team does not read your conversations, and the people you plan with do not see them. To answer, the conversation so far is sent to Anthropic, whose AI writes the Envoy’s replies. We do not ask for health or dietary details here: your profile asks for them, with your consent. Anything you write in a conversation is kept with it until you delete it. Our host’s records note only which tools were used and how long each answer was, never your words.
- Analytics, if you accept. Google Analytics records which pages are read, how visitors arrive and move through the site, and their country and type of device. It sets cookies only after you accept them. Before you choose, and if you decline, it sets no cookie and no identifier, and Google receives only basic signals that a page was viewed or an action taken, such as sending a form, which it uses to estimate totals. The cookie policy has the details.
- When you plan a trip with us. Through the trip questions, Explore, email or WhatsApp: your name, email address, phone or WhatsApp number, nationality or country of residence, travel dates, the number of adults and children and the children’s ages, the places, stays and experiences you like, the occasion, your budget, your notes, and how you heard about us. You answer the trip questions while signed in, and your answers are kept in your account as a trip as you go, so you can come back to them on any device.
- Health, diet and access needs. If you tell us about allergies, dietary requirements, medical needs or mobility, we use them only with your explicit consent, which you give with the tick box beside the question or in writing. This is special category information, and we handle it with particular care.
- When you book. For every traveller: full name, date of birth, passport details or a copy of the passport (hotels in Sri Lanka must register foreign guests), and arrival and departure flights. You pay by bank transfer to our account with Wise. We receive confirmation of each payment, with the payer’s name and the details their bank sends with it.
- Your account. If you create one: your name and email address, and your profile picture if you sign in with Google; the phone or WhatsApp number and country of residence you give us; the journeys you build; the names and email addresses of the people you invite by email to plan with you, and any link you make for others to join; and when you last used your account, which is how we know when one has gone unused.
- Your preferences. If you save them in Me: your age, how you like to share a room, your pace, your interests, and your dietary needs, which we keep only with your explicit consent.
- People you travel with. If you save them in Me: their names and ages, and, if you add them, how they share a room, what they love and their dietary needs, which we keep only with your explicit consent, given in Me for each person. We use them to plan each trip around everyone on it. Save someone only with their agreement, or as their parent or guardian. When you choose who is travelling on a journey, their names and ages are shown to everyone planning it with you. If you invite one of them by email from a journey, we send them your invitation, which greets them by name; once they join with their own account, it takes their place on the journey, and your card for them in Me shows the name and age on their account and whether they have given their needs, never the needs themselves.
- Passports, in your account. If you add them in Me once you have accepted a trip’s plan: for each traveller, the full name as it is printed in the passport, the nationality, the passport number, the date of birth and the date it expires, with the time you agreed to our keeping them. They are encrypted before we store them, only our own team can open them, each opening is recorded, and we pass on only what each booking needs.
- On a trip you have accepted. What our team adds so that the app can show you each day: your chauffeur’s name and number, your hotels’ numbers and each day’s pickup time. Your device keeps a copy of the trip, so the app opens without a signal; the cookie policy has the details.
- Notifications. If you turn them on: an address from your browser’s notification service, for each device. On a trip you have accepted, it is also how we send each morning’s plan.
- Your journey’s plan and thread. When you send a journey from Explore, or your answers to the trip questions: what you and the people planning it with you write to us in its thread; the plan we price for it; our team’s own notes on it, which only our team reads; a record of each step it takes, when, and who took it; and, if it is accepted, the extras chosen, the total, and who accepted it and when.
- If someone invites you. The email address they give us, so that we can send you their invitation, and your name once you join. They may also have given your name and age, to plan around you. When you join with your own account, it takes the place of what they gave: they see your name and age as your account holds them, and whether you have told us your needs, but never the needs themselves. You can stop that at any time in Me, under Who sees your name and age. If you do not join, the address is deleted 30 days after the invitation lapses. If they share a link with you instead, we hold nothing about you until you sign in and join.
- A private proposal. If we prepare one for you: your name, email address and travel dates, the choices and notes you send us, and when the proposal was opened. To protect it from guessing, we record the network address behind each failed attempt to enter its key, for 30 days.
- The letter. If you ask for it: your email address, once you have confirmed it through the link we send you.
- What you send us. Emails, WhatsApp messages and anything attached to them.
We do not buy lists, and we do not collect information about you from data brokers.
4.Information from Google
You can sign in to a Ceylon Envoy account with Google. This section explains exactly what we receive from Google when you do, and what we do with it.
- What we access. With your permission, Google shares your name, email address and profile picture with us. That is all. We do not ask for, and cannot see, your contacts, emails, files, calendar or any other information in your Google Account.
- How we use it. Only to provide the features of your account: to create it, to sign you in, to show your name and picture in your account, your name on the journeys you share, and your name and picture to our own team on a trip you send us, and to email you about your account, your journeys and your bookings.
- Who we share it with. Only the 2 service providers who run those features for us, on our instructions: Supabase, which runs our account sign-in and database, and Resend, which sends our emails. Your name is also shown to the people you invite to a journey. We share it with no one else, except where the law requires us to.
- What we never do with it. We do not use it for advertising of any kind, we do not sell it or give it to data brokers or information resellers, we do not use it to judge creditworthiness or for lending, we do not build databases or profiles from it, and we do not use it to develop, improve or train artificial intelligence or machine learning models.
- How we protect it. It is encrypted in transit and encrypted where it is stored. Our database rules let each account be read only by its owner and by the few members of our team who need it to help you.
- How long we keep it, and deleting it. We keep it for as long as you have an account. When you delete your account from your account page, or ask us to by writing to concierge@ceylonenvoy.com, we delete it within 30 days. An account that is not used for 24 months is deleted, after we have told you by email.
Ceylon Envoy’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can remove Ceylon Envoy’s access at any time in your Google Account’s connections settings.
5.How we use it, and the law we rely on
- To answer your enquiry and design your journey: the steps you ask us to take before a contract, and our legitimate interest in replying to people who contact us.
- To book and deliver your journey: our contract with you.
- To use health, diet and access details: your explicit consent, which you can withdraw at any time. Without it, we may be unable to arrange some parts of a journey.
- To run your account and the journeys you share: our agreement with you when you create an account.
- To answer you in Ask the Envoy and keep your conversations: our agreement with you when you create an account.
- To send the letter: your consent, which you withdraw by unsubscribing.
- To measure how the site is used: your consent to analytics cookies.
- To keep the site and your information secure, and to prevent fraud and misuse: our legitimate interests.
- To keep accounting and tax records and meet other legal duties: legal obligation.
We do not make decisions about you by automated means. Explore suggests vehicles from the size of your party, but a person always reviews and confirms your journey.
7.Where it is held
Our team works in Sri Lanka, our systems keep data in Japan and the United States, and your journey is delivered by partners in Sri Lanka. Where the law of your country restricts sending personal information abroad, we rely on the safeguards it allows: an adequacy decision where one exists, the European Commission’s standard contractual clauses or the United Kingdom’s equivalent with our service providers, and, for the partners who deliver the journey you ask for, the fact that the transfer is necessary to carry out our contract with you. You can ask us for details of these safeguards.
8.How long we keep it
- Journeys that go ahead: 36 months after the journey ends, so we can help with anything that follows. If the account that started a journey is deleted before then, the journey, its plan and its thread are deleted with it, and our letters about it follow the mailbox periods below. Records of payments and invoices are kept for as long as tax law requires.
- Passport copies: deleted within 90 days of the end of the journey.
- Passport details you add in Me: deleted automatically 30 days after the last trip you accepted ends, or at once if you remove them or delete your account.
- Enquiries and journeys that do not go ahead: 24 months after our last contact with you.
- Accounts: until you delete your account. If an account is not used for 24 months, we delete it and the journeys it started, and tell you by email beforehand; journeys others started and shared with you stay with them, as do the messages you wrote in their threads, which then carry no name. An address that asks for a sign-in link and never uses it is deleted within 7 days.
- A journey’s plans, thread, notes and record of steps: kept, and deleted, with the journey they belong to.
- Conversations with the Envoy: until you delete them, or your account is deleted.
- Invitations: 30 days after the invitation is used or lapses.
- Shared links: 30 days after the link is switched off or lapses.
- The letter: until you unsubscribe. An address that is never confirmed is not kept.
- Security records: 30 days.
- Server records: kept by our host for no more than 30 days.
Records in our database are deleted automatically when their time is up. Emails in our mailbox follow the same periods, and we review and delete them at least once a year. What sits on your own device is described in the cookie policy.
9.Your rights
Wherever you live, you can ask us to show you the information we hold about you and give you a copy; to correct it; to delete it; to stop or limit how we use it, or object to it; to give it to you or to another company in a portable form; and to withdraw any consent you have given, without affecting what we did before you withdrew it.
Write to concierge@ceylonenvoy.com. We may ask you to confirm who you are, and we reply within 1 month, or within 45 days where a US state law sets that period. There is no charge.
- In the United Kingdom and the European Economic Area, you may also complain to your data protection authority: in the United Kingdom, the Information Commissioner’s Office.
- In Sri Lanka, you may complain to the Data Protection Authority of Sri Lanka.
- In California and other US states with privacy laws, you have the right to know what we hold, to correct and delete it, and to opt out of the sale or sharing of personal information. We do not sell or share it, so there is nothing to opt out of. We will not treat you differently for using your rights, and someone you authorise may ask on your behalf.
10.Keeping it safe
Everything you send us travels over encrypted connections, and our database encrypts what it stores. It admits only the people and services who need it; each account and journey is visible only to the people on it and our team, and a journey we send our ground partner to price leaves out your name and contact details; the keys to private proposals and the links in invitations are stored in a form that cannot be read back, and a link you share is held only as a fingerprint; and only our team reads enquiries. No system is perfectly secure. If something goes wrong that puts you at risk, we will tell you, and the authorities, as the law requires.
11.Children
Accounts and the letter are for adults aged 18 or over. We collect children’s details only from the parent or guardian who books their journey, and use them only to arrange it.
12.Changes to this policy
When we change this policy, we update the date at the top of the page. If a change affects how we use your information, we tell account holders and subscribers to the letter by email before it takes effect.
13.How to reach us
Email concierge@ceylonenvoy.com, or send a WhatsApp message to +94 77 567 1016. Ceylon Envoy is Ceylon Envoy LLC, registered at 30 N Gould St Ste R, Sheridan, WY 82801, United States.