Privacy policy

apt is a property website operating in Sri Lanka, for renting and buying homes, with paid tools for agents and agencies. For questions about this policy or your information, write to hello@apt-ai.com.lk.

Only what the site needs to work. In practice that is:

• Your account — email address and password. Passwords are handled by our authentication provider and we never see or store them ourselves.
• Your contact details, if you list a property — the phone number you enter for WhatsApp and calls, and a display name.
• Your listings — everything you type in, the map pin you place, the address you display, and the photographs you upload.
• Enquiries — when you ask to contact a lister, we record which listing and when, and identify you to that lister so they can respond. Messages you exchange about it, including email replies sent through our reply address, are kept with the enquiry.
• Saved homes — the listings you favourite.
• Your workspace, if you are an agent or agency — your team members, the enquiries and viewing appointments for your listings, and notes you add to them.
• Payments, if you buy a plan or promotion — what you bought, the amount, the date, our order reference, and the reference of the bank transfer you paid with.
• Agency verification, if you are an agency and choose to submit it — your business registration type and number, the registered entity name, an optional tax registration number, and any document you upload as evidence. All of it is optional; without it your account works normally and simply carries no verification mark.
• Basic usage data — aggregate page views and performance timings, through Vercel Analytics. This does not use cookies and does not build a profile of you across sites.

We do not take card payments yet, so we hold no card details. We do not ask for your National Identity Card number, and you should not send it to us — a business registration document is about a business, and we do not need identity documents about a person.

• To show your listing to people searching, including its position on the map.
• To let a person who is interested reach you, and to email you that they were.
• To keep your saved homes and your own listings attached to your account.
• To understand which pages are used, in aggregate, so we can improve them.
• To take payment for plans and promotions, issue receipts, and handle refunds.
• To run optional AI features, such as plain-English search and drafting listing descriptions or replies.
• To check that an agency is a registered business before showing a verification mark.
• To detect and remove fraudulent or abusive listings.

A published listing is public. Its title, description, photographs, rent, terms, area and map pin can be seen by anyone, including search engines.

Your phone number is not public. It is shown only after somebody signs in and asks to contact you, which is deliberate — it keeps your number away from scrapers and means every enquiry is attributable. When someone does enquire, we tell you, and we share their email address with you so you can reply.

Your email address is never shown on a listing page.

Verification details are never published. Registration numbers, tax registration numbers and any document you upload are read by us, with help from the AI service listed below, to decide whether to show a verification mark. What appears publicly is the mark itself — never the numbers behind it. Documents are kept in private storage, separate from listing photographs.

We use a small number of services, each doing one job:

• Supabase — database, sign-in and photo storage.
• Vercel — hosting and aggregate analytics.
• Resend — sending transactional email, such as confirming your address or telling you about an enquiry.
• OpenAI, Anthropic and Google (Gemini) — AI models behind search and drafting, used through their paid services. They receive the text needed for the task: your search words, the listing details being described, and, when an agent drafts a reply, the enquirer's first name and message. Google's model also reads the registration documents agencies submit for verification. We do not send passwords, phone numbers or payment details. Common searches are understood without sending them to a model.
• An SMS provider, once we offer text messages — it would receive your mobile number and the message. Text messages are not switched on yet.
• A payment provider, once we take card payments — it would receive your name, email address and phone number to start a payment, and you would enter your card on its own secure page; we would never see your card number. Card payments are not switched on yet.
• OpenFreeMap and OpenStreetMap — map tiles and the transit, shop and school data behind walk times. Your browser requests map tiles directly from OpenFreeMap when you use the map.

These providers host data outside Sri Lanka. We do not sell your information, and we do not share it for advertising.

We use one kind of cookie: the session cookie that keeps you signed in. There are no advertising or tracking cookies, and so there is no consent banner to dismiss.

Listings stay until you remove them or they expire. Account information stays until you ask us to delete it. Enquiry records are kept so listers can see who contacted them.

We keep payment records for as long as tax and accounting law requires, even after an account is closed.

One-time codes are short-lived and are discarded once used or expired. Verification documents are kept while the verification stands, so we can show why a mark was given, and deleted when an account is closed.

Sri Lanka’s Personal Data Protection Act gives you rights over information about you. You can ask us to:

• Show you what we hold about you.
• Correct anything that is wrong.
• Delete your account and the personal information attached to it.
• Stop sending you email.

Write to hello@apt-ai.com.lk and we will respond. Deleting your account removes your listings from the site.

apt is not intended for anyone under 18, and we do not knowingly collect information from children.

If this policy changes we will update the date at the top. Material changes affecting how we use your information will be notified by email.

See also our terms of service.