Privacy Policy

1. Introduction

RJ Gold Palace ("we", "us", or "our") operates the RJ Gold Palace mobile application (available on iOS and Android) and the RJ Gold Palace web admin portal (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By using the Service, you consent to the practices described in this policy. If you do not agree, please do not use the Service.

2. Information We Collect

We collect the following categories of personal information:

• Contact Information: Phone number and/or email address provided during sign-in via OTP (one-time password).
• Profile Information: Your name, as entered by an administrator.
• Device Identifiers: Expo push notification tokens, used solely to deliver push notifications to your device.
• Account Data: Jewellery account balances (cash & gold), customer group memberships, saved/favourite designs, design enquiry messages, account statement requests, and notification history.
• Media: Images uploaded by administrators when publishing jewellery designs (camera and photo library access, granted via OS-level permissions).

We do not collect location data, browsing history, contacts, health data, advertising identifiers, analytics data, or crash reports. We do not use any third-party analytics or tracking SDKs.

3. How We Use Your Information

• To authenticate your identity via SMS or email one-time passwords.
• To display your jewellery account information, balances, and gold prices.
• To let you save favourite designs and share design information with others.
• To process your design enquiries and account statement requests, and relay them to administrators.
• To send push notifications about new designs, gold price updates, offers, and announcements.
• To enable authorised administrators to manage customers, designs, groups, enquiries, notifications, and gold prices.

We do not use your data for advertising, marketing analytics, profiling, or any purpose other than operating the Service.

4. SMS & Email Authentication

We use Supabase Auth to send one-time passwords for authentication. For email OTP, Supabase's built-in email service (or a configured SMTP provider) delivers the code. For SMS OTP, a local Sri Lankan SMS gateway delivers the code to your phone. Your phone number or email is transmitted to these providers solely for OTP delivery. We do not use your contact information for marketing communications.

5. Push Notifications

We use the Expo Push Notification Service to deliver notifications to your device. Your device push token is stored securely and used only to send relevant notifications such as new design announcements, gold price updates, and account activity alerts. You can disable push notifications at any time through your device's system settings.

6. Data Storage & Security

Your data is stored securely using Supabase (powered by PostgreSQL) with row-level security (RLS) policies that ensure users can only access their own data. Authentication tokens are stored on-device using platform-native secure storage (iOS Keychain / Android Keystore via Expo SecureStore). All data transmission occurs over HTTPS/TLS encryption.

7. Data Sharing & Third Parties

We do not sell, rent, or trade your personal information. We share data only with the following service providers, solely for operating the Service:

• Supabase: Cloud database, authentication, and file storage.
• SMS Gateway (text.lk): SMS OTP delivery within Sri Lanka.
• Expo: Push notification delivery.

These providers process data only as necessary to provide their services and are bound by their own privacy and security obligations.

8. Data Retention & Deletion

We retain your data for as long as your account is active. You can delete your account at any time directly from the app by navigating to Profile → Delete Account. This will permanently and immediately remove your account. Alternatively, you may contact your RJ Gold Palace administrator or email us at rjgoldpalace@gmail.com to request deletion. Upon deletion, your profile, authentication records, push tokens, enquiries, favourites, and all associated data are permanently removed from our systems.

9. Your Rights

You have the right to:

• Access your personal data (visible in the app's Profile screen).
• Request correction of inaccurate data by contacting your administrator.
• Delete your account and all associated data directly from the app (Profile → Delete Account).
• Request account deletion by emailing rjgoldpalace@gmail.com as an alternative to self-service deletion.
• Opt out of push notifications at any time via your device's system settings.
• Sign out of the app at any time from the Profile screen.
• Withdraw consent by discontinuing use of the Service.

10. Children's Privacy

Our Service is not directed to children under 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children. If we discover we have collected data from a child under the applicable age, we will delete it promptly. If you believe a child has provided us with personal information, please contact us.

11. International Data Transfers

Your data may be processed and stored in countries other than your own, including where our cloud infrastructure provider (Supabase) operates. By using the Service, you consent to the transfer of your information to these countries, which may have different data protection laws than your jurisdiction.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and revising the "Effective date" above. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at: rjgoldpalace@gmail.com