Privacy Policy

Last updated: April 24, 2026

Who we are

SriAI is an AI access platform built for Sri Lankan students. We provide affordable access to frontier AI models with local LKR pricing and payment via bank transfer. We are based in Sri Lanka and operate under Sri Lankan law.

For any privacy-related questions, contact us at [email protected].

What data we collect

When you create an account and use SriAI, we collect:

• Account information: your name, email address, and a hashed (never plain-text) password
• Conversation data: the messages you send and the AI responses you receive, stored to power your conversation history
• Credit and payment records: your credit balance, top-up history, and bank transfer references (we do not store card numbers — we use bank transfer only)
• Usage data: which models you use, token counts per request, and session timestamps
• Technical data: IP address, browser type, and device information collected automatically when you access the service

How we use your data

• To operate your account and provide the AI chat service
• To manage your credit balance and process top-ups
• To send transactional emails: account confirmation, payment receipts, and low-credit alerts
• To detect abuse, prevent fraud, and keep the service secure
• To improve the platform based on aggregate (never individual) usage patterns

We do not sell your data. We do not use your data for advertising. We do not share your conversation content with third parties except as described below.

AI providers and third parties

To generate AI responses, your messages are sent to AI model providers. Depending on the model you select:

• Anthropic (Claude models):Messages are sent to Anthropic's API. Anthropic processes these under their own Privacy Policy. Anthropic does not use API conversations to train models by default.
• Local/open-source models (Ollama): These run on our own infrastructure. Your messages do not leave our servers for these models.

We also use standard infrastructure services (hosting, database) that process data on our behalf under data processing agreements.

Data retention

• Your account data is retained as long as your account is active
• Conversation history is retained until you delete it or your account
• Payment records are retained for 7 years as required by financial regulations
• After account deletion, we purge personal data within 30 days (except legally required records)

Your rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data in your account settings
• Delete your account and associated data (from your account settings or by emailing us)
• Export your conversation history from your account settings
• Object to specific processing by contacting us

To exercise any of these rights, email [email protected] and we will respond within 14 days.

Cookies and local storage

We use a single session cookie to keep you logged in. We do not use tracking cookies or third-party analytics cookies. Local storage is used only to store your UI preferences (such as language selection).

Security

Passwords are hashed using bcrypt with a cost factor of 12 — they are never stored in plain text. All data is transmitted over HTTPS. We follow industry-standard security practices for our database and infrastructure. However, no system is perfectly secure — if you discover a vulnerability, please report it to [email protected].

Children

SriAI is intended for students aged 13 and above. We do not knowingly collect data from children under 13. If we become aware that a user is under 13, we will delete their account.

Changes to this policy

We may update this policy as the service evolves. When we make significant changes, we will notify you via email and update the “Last updated” date above. Continued use of SriAI after changes constitutes acceptance of the updated policy.

Contact

For any privacy questions or requests, email [email protected]. We aim to respond within 3 business days.