Privacy policy

What we collect

We only collect what we need to answer you and to look after your stay.

• When you book — your name, email address, telephone number, country, arrival and departure dates, the room and board you chose, and any request you make (a late arrival, a dietary need, an airport pickup).
• When you choose the local LKR route — the website checks whether the birth date encoded in the Sri Lankan NIC matches the birth date entered. This happens only in your browser. The NIC number and birth date are not saved, sent to Ocean Bliss, sent to analytics, placed in the page address, or included in the WhatsApp message. Only a successful local check allows the LKR room-selection step to open.
• When you prepare a direct booking — the primary guest name, email, phone number, country and any optional request stay in the open page while you review the rooms and full bill. They are not placed in the booking URL or sent to analytics. They leave your device only when you explicitly continue: the secure Ocean Bliss booking coordinator sends them to Beds24 to create the temporary room hold and booking. If direct checkout is unavailable and you instead choose to share or copy a request, they leave your device only through the service you choose.
• When you pay — the amount, the date, and a reference number from the bank. We never see or store your full card number. Card details are entered on Sampath Bank's own secure page, not ours.
• When you message us — the messages themselves, and any photograph or document you choose to send us, such as a bank transfer slip.
• When you check in — the identity details Sri Lankan law requires a hotel to record for every guest, including passport details for visitors from abroad.
• When you use this website — ordinary technical information such as the pages you visited, so we can keep the site working. Booking analytics use aggregate information such as the chosen USD or LKR route and room, adult and child counts; they do not include stay dates, NIC details or birth dates.

Messages you send us

This section is here because we want to be plain about it: if you write to us on WhatsApp, Facebook Messenger, Instagram Direct, or the chat box on this website, we keep that conversation.

• We keep it so we can answer you, so a colleague picking the conversation up later knows what you already asked, and so we do not ask you the same question twice.
• Our Facebook Page is Ocean Bliss by Sugar Co-Living and our Instagram account is @sugaroceanbliss. Messages sent to either reach the same team.
• You will often be answered by an automated assistant called Zara. Zara is software, not a person. A member of our staff can take over the conversation at any time, and you can ask for a person whenever you like — just say so and we will pass you to one.
• We reply only to people who have written to us first. We do not send marketing broadcasts on these channels and we do not add you to any list because you messaged us.
• We do not read, and have no access to, anything on your Facebook or Instagram profile beyond the name and profile picture the platform shows us alongside your message.
• Who operates the messaging system. The assistant and the shared inbox our staff answer from are run for us by Sugar Coliving (Pvt) Ltd, which operates the guest-messaging system for both Sugar properties, and the Meta application connecting our Facebook Page and Instagram account to it is registered to that company. It processes your messages only to answer you on our behalf, under this policy.

Why we are allowed to hold it

• To perform our contract with you — making, changing and honouring your booking.
• To meet a legal obligation — guest registration and tax records required in Sri Lanka.
• Our legitimate interest in running the hotel — answering enquiries, preventing fraudulent bookings, and keeping our own accounts.
• Your consent, where you have given it — for example if you ask us to keep a preference for a future stay.

Who else sees it

We do not sell your information, we do not rent it, and we do not share it for anyone else's advertising. We use a small number of service providers who process data on our behalf:

• Sugar Coliving (Pvt) Ltd — operates the guest-messaging system and the staff inbox for both Sugar properties.
• Beds24 — our reservation system, which holds the booking itself.
• Meta Platforms — WhatsApp, Facebook Messenger and Instagram carry the messages you send us, under their own privacy terms.
• Anthropic — our assistant Zara is built on an AI model operated by Anthropic, so the text of your message is sent to Anthropic to produce a reply. It is not used to train their models.
• Sampath Bank — card payments, on their own secure gateway.
• Cloudflare — hosts this website and its server functions, protects the site, and temporarily caches the public CBSL exchange rate used for LKR display.
• Google Maps — the illustrated location guide is hosted on our website. If you choose an Open in Google Maps link for the hotel or a nearby place, Google receives your visit under its own privacy terms. Your room choices, NIC details and guest details are not included in those map links.
• Our accounting system — the invoice and payment record, kept for tax.

The Central Bank of Sri Lanka provides the public USD selling rate used for the LKR display. Our server reads that public rate without sending your NIC, birth date or booking details to CBSL.

We will also disclose information where the law requires it, for example to the police or to a tax authority.

How long we keep it

• Booking and payment records — for as long as Sri Lankan tax and company law requires us to keep them.
• Conversations — while they are useful for looking after you, and then no longer than we need them.
• Identity documents taken at check-in — only for as long as the law requires.
• The website's local LKR check — the NIC number and birth date are not retained by us because the comparison happens only on your device.
• An unsent guest-details form — the website does not store it. Closing or refreshing the page clears it unless you already chose to continue to the secure booking coordinator, or to share or copy it elsewhere.

Asking us to delete your data

You can ask us to delete the information we hold about you at any time.Email ocean@sugarcoliving.com from the address you booked with, or send us a message on the same channel you wrote to us on, and say that you want your data deleted.

• Tell us your name and, if you have one, your booking reference. If you are asking about a Facebook or Instagram conversation, sending the request as a message in that same conversation is the easiest way for us to find it.
• We will confirm within 7 days and complete the deletion within 30 days.
• What we may have to keep: if you have stayed with us or paid us, Sri Lankan tax and guest-registration law requires us to retain the booking, invoice and registration record. We will delete everything else, including the conversation, and we will tell you exactly what was kept and why.

Your other rights

You can ask us for a copy of what we hold about you, ask us to correct anything that is wrong, or object to how we are using it. Write to ocean@sugarcoliving.com and we will answer within 30 days.

Keeping it safe

• Our systems are reached over encrypted connections only.
• Access is limited to the staff who need it to do their job.
• Card numbers never reach our systems at all — they are handled by Sampath Bank.
• If a breach ever affects your information, we will tell you.

Children

Our booking service is not intended for children, and we do not knowingly collect information from a child except as part of a family booking made by an adult.

Changes to this policy

If we change this policy we will update the date at the top of the page. If the change is significant we will say so on our website.

Contact

Ocean By Sugar (Pvt) Ltd
228 Kalukanda Road, Kapparathota, Weligama 81700, Sri Lanka
ocean@sugarcoliving.com