1. Two kinds of data
- Academy owners and staff — the people who sign up for lms.lk. For their data, we decide how it is used.
- Students of an academy — the academy decides what it collects and why. We only store and process that data on the academy's behalf to run its website. Questions about a student's data should go to that academy first.
2. What we collect
- Account details: name, email address, password (stored only as a secure hash), phone number if you add one.
- Academy details: academy name, web address, logo, colours, contact details, and connected domain.
- Billing records: plan, amounts, dates, invoice numbers, and bank slips you upload. Card payments are handled by PayHere — we never see or store card numbers.
- Learning activity (on behalf of academies): enrollments, lesson progress, assignment submissions, discussion posts, payment slips for course fees.
- Technical data: IP address, browser type and access times, kept in server logs for security.
3. Why we use it
- To create and run your account and academy website.
- To take and confirm subscription payments and keep billing records.
- To send service messages (sign-in, payment confirmations, reminders).
- To keep the service secure, prevent abuse and fix problems.
- To meet legal and accounting obligations.
We do not sell personal information and we do not use it for advertising.
4. Who we share it with
Only with service providers that help run lms.lk, and only what each needs:
- PayHere — card and wallet payments.
- Cloudflare — website delivery, security and domain connection.
- Our hosting provider — the servers that store the data.
- Email and SMS providers — to deliver messages. An academy's SMS goes through that academy's own text.lk or notify.lk account.
We may also disclose information when the law requires it.
5. Where data is stored
Data may be stored and processed on servers outside Sri Lanka. We use providers that protect it with encryption in transit and access controls, and each academy's records are kept separate from every other academy's.
6. Cookies
We use only the cookies needed to keep you signed in and the site secure. We do not use advertising or tracking cookies.
7. How long we keep it
- Account and academy data — while your academy is active, and for up to 90 days after you ask us to close it, so it can be restored if needed.
- Billing records — as long as Sri Lankan tax and accounting law requires.
- Server logs — up to 90 days.
8. Children
Academies often teach students under 18. An academy that enrolls minors is responsible for having a parent's or guardian's consent where the law requires it.
9. Your rights
You can ask to see the personal information we hold about you, correct it, have it deleted, or withdraw consent you have given. Contact us using the details below — we will reply within 30 days. If you are a student, contact your academy, which controls your data; we will help it respond.
10. Security
Connections are encrypted (HTTPS), passwords are hashed, payment card data never touches our servers, and access to stored data is restricted. No system is perfectly secure; if a breach affects you we will tell you as the law requires.
11. Changes
We will post any changes here with a new effective date. See also our Terms & Conditions.
12. Contact
- Hayaku (PVT) LTD, operating lms.lk, Sri Lanka
- Email: [email protected]
- Phone: +94 76 604 9654