Privacy Policy

Last updated 25 September 2026

Mr.Paint ("we", "us") repairs, paints and services vehicles. This policy explains what personal information we collect when you bring a vehicle to us, use our Digital Service Book, or use our business system at https://crm.mrpaintauto.lk, and what we do with it.

1. Information we collect

From customers

• Contact details — your name, mobile number, and, if you give them, your email address and VAT number.
• Vehicle details — registration number, make, model, year, chassis number, mileage and insurance company.
• Job records — estimates, the work carried out, parts used, invoices, payments, warranties and loyalty points.
• Photos and videos of your vehicle taken before, during and after the work.
• Messages we send you by SMS or WhatsApp, and the one-time codes used to sign in to the Digital Service Book.

From staff and business users

• Name, username, role, branch and the actions taken in the system.
• Records of work such as cash books, cheques, stock counts and the photos attached to them.

Collected automatically

• A session cookie that keeps you signed in. We do not use advertising or tracking cookies.
• Basic server logs (IP address, time, page requested) used to keep the system secure and working.

2. How we use it

• To carry out and invoice the work on your vehicle, and to handle insurance claims.
• To tell you about your job's progress, send invoices and receipts, and remind you when a service or warranty is due.
• To let you see your vehicle's history in the Digital Service Book, after confirming it is you with a one-time code.
• To run loyalty points, keep our accounts and meet tax and legal obligations.
• To keep the system secure and prevent fraud.

We do not sell your personal information, and we do not use it for advertising by anyone else. You can ask us to stop sending you SMS or WhatsApp messages at any time.

3. Who we share it with

We share information only as far as each purpose needs:

• Your insurance company, when the job is an insurance claim.
• Service providers that work for us — our hosting provider, the SMS and WhatsApp messaging services that deliver our messages, Google (for sending email through Gmail), and AI services we use to help staff read documents and photos. They may use the information only to provide their service to us.
• Authorities, when the law requires it.

4. Google user data (Gmail)

An administrator can connect a company Gmail account to our system so that it can send email such as invoices and reports. When they do, we ask Google for these permissions only:

• gmail.send — to send email from that account;
• openid and email — to record which Gmail address was connected.

We do not read, search, store, modify or delete any email in the connected mailbox. We keep only the connected email address and the access token Google issues, stored in our own database and used solely to send the email our system creates. That data is not shared with anyone, not used for advertising, and not used to train AI models. The account owner can withdraw access at any time from their Google Account under Third-party access, after which we can no longer send from it.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. How long we keep it

We keep job, invoice and payment records for as long as tax and accounting law requires, and vehicle history for as long as it is useful to you and to any warranty we gave. One-time codes expire within minutes. When information is no longer needed we delete or anonymise it.

6. How we protect it

The system is served over HTTPS, access is restricted by user and role, staff sign-in uses a one-time code, and passwords are never shown or sent back to a browser. No system is perfectly secure, but we work to protect your information and will tell you if a breach affects you.

7. Your rights

Under Sri Lanka's Personal Data Protection Act, No. 9 of 2022, you may ask us to:

• tell you what information we hold about you and give you a copy;
• correct anything that is wrong;
• delete information we no longer need to keep;
• stop sending you messages, or stop a particular use of your information.

Contact us using the details below. We may need to confirm who you are before acting on a request.

8. Children

Our services are for vehicle owners and are not directed at children. We do not knowingly collect information from anyone under 18.

9. Changes to this policy

If we change this policy we will update this page and the date at the top. Significant changes will also be announced in the system or by message.

10. Contact us