Privacy Policy
DreamFundSL holds some of the most personal information a family has. This page explains, in plain language, what we collect, why, who can see it and what control you have.
The short version
- We store the records you enter, plus the account details needed to run the Service.
- We keep only the last 4 digits of an account number. We never ask for bank passwords, PINs or OTPs.
- We do not sell your data and we show no advertising. There are no advertising or analytics trackers on the Service.
- Your family’s records are kept separate from every other family’s.
- You can export or delete your data and ask us about it at any time.
1. Who we are
DreamFundSL is operated by Batti Express Technologies, Sri Lanka (“we”, “us”). We decide how and why the information described here is processed, so we are the responsible party (“controller”) for it. We aim to handle personal data in line with Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, and other applicable law. You can reach us at support@dreamfundsl.com.
2. What we collect
| Type | What it includes | Where it comes from |
|---|---|---|
| Account details | Family name; each member’s name, email address, role (Admin or member), optional mobile number, optional profile picture, family relationships you record; password (stored only as a salted one-way hash); two-step verification settings if you turn it on. | You, when you sign up or the Admin adds a member. |
| Financial records | Transactions, categories, budgets, bills and debts, recurring items, savings goals, the emergency fund, the investment box, cash in hand and cash handovers between members, financial health scores and notes you write. | You and your family members. |
| Bank account records | Bank name, an account nickname, account type, balance and activity you enter, currency, a credit limit if you set one, and only the last 4 digits of the account number. | You. |
| Imported files | When you import a CSV or Excel file we read it to extract the rows. We keep the resulting transactions and a record of the import (so it can be undone), not the original file. | You. |
| Billing information | The plan you chose, billing period, amounts, and payment and subscription reference numbers returned by PayHere. We do not receive or store your card number. | You and PayHere. |
| Security and usage data | Sign-in times and counts, when you were last active, IP address and device or browser details used for security and for limiting repeated sign-in attempts, and an audit trail of sensitive account actions. | Your device, automatically. |
| Messages to us | Anything you send to our support address, including your email address. | You. |
3. What we never collect
- Bank or card passwords, PINs, one-time passwords (OTPs), or full account or card numbers. There is nowhere in the Service to enter them, and we ask you not to type them into notes or descriptions.
- Your precise location.
- Any link to your bank. DreamFundSL does not log in to banks or read your bank data; you enter it.
4. How we use it
We use your information to:
- Provide the Service: store and show your records, calculate balances, budgets, reports and the Financial Health score, and keep each family’s data separate (this is the basis on which we handle your data: to perform our agreement with you).
- Send you messages the Service needs: password resets, email verification, bill and budget reminders, notification digests, and notices about your Free trial or plan. Depending on your settings and the number you provide, some alerts may also be sent by SMS.
- Take payment and manage your plan.
- Keep the Service secure: detect and block misuse, limit repeated sign-in attempts, investigate problems, and keep an audit trail (our legitimate interest in protecting you and the Service).
- Support you when you contact us.
- Meet legal obligations, such as keeping payment records.
We do not use your financial records to build advertising profiles, and we do not sell or rent them.
5. Who can see your data
Inside your family
A family account is shared by design. Members of your family can see the records the family shares in the app. The Admin manages who is in the family. Some actions are limited by role or by who owns a particular bank account. Add only people you want to see this information.
Our team
A small number of authorised Batti Express Technologies staff use an internal operator console to run the Service. They can see which families are registered and carry out account-administration and support actions, such as changing a plan, suspending an account or deleting one when asked. These actions are recorded in an audit log. We access the contents of a family’s records only when it is needed to provide support you have asked for, to keep the Service secure, or to meet a legal duty.
Other families
Never. Every request is checked against the family you signed in as, so another family’s data cannot be reached from your account.
Legal and safety
We may disclose information if the law or a valid legal process requires it, or where necessary to protect people’s safety or our rights. If we are allowed to, we will tell you first.
6. Service providers
We use trusted companies to run parts of the Service. They process data only for that purpose and under their own security commitments.
| Provider | What it does | What it receives |
|---|---|---|
| Cloudflare | Hosts the app and its database. | All data stored in the Service, and technical request data such as IP address. |
| PayHere | Takes card and other payments for paid plans. | Payment details you enter on PayHere’s own secure pages, and the plan you are buying. Their privacy policy applies to that data. |
| Resend | Sends our emails. | Recipient email address, name and the message content (for example a password reset link or a reminder). |
| Text.lk | Sends SMS alerts, where used. | The mobile number and the text of the message. |
7. Cookies and device storage
We use a small amount of storage on your device, all of it needed to make the Service work. We do not use advertising or analytics cookies.
- Sign-in cookie (
ff_session). Keeps you signed in. It is a session cookie (removed when you close the browser), is not readable by scripts, and is only sent to our own site. - Theme preference. Your light or dark choice is remembered on your device.
- Offline support. The installed or desktop app stores the app files, and some reference data and transactions you enter while offline, on your device so it can open and queue entries without a connection. Reference data is cleared when you sign out yourself.
You can clear this storage in your browser settings at any time. The Service may then ask you to sign in again.
8. How long we keep it
- While your account is active we keep your records so the Service works.
- Free trial families that do not choose a paid plan are locked after 30 days and permanently deleted after a further 30 days, with warning emails to the Admin (see the Terms).
- If you delete your account (Profile > Delete account in the app, or at dreamfundsl.com/delete-account), your data is removed from our live database immediately. If you are the family’s only Admin, the whole family’s data is deleted; otherwise your personal details are deleted and shared family records stay with the family. Backup copies are replaced on a rolling basis, as explained on the deletion page.
- Some records are kept longer where needed: payment and billing records for as long as the law requires, and security and audit logs for as long as they are needed to protect the Service.
9. How we protect it
- All traffic uses HTTPS.
- Passwords are stored as salted one-way hashes (PBKDF2-SHA256). Nobody, including our staff, can read them back.
- After 5 wrong passwords for the same email, sign-in pauses for 15 minutes.
- You are signed out after 3 minutes without activity, and a session never lasts longer than 24 hours. Changing your password signs you out of your other devices.
- Optional two-step verification using an authenticator app.
- Strict separation between families, and an audit log of sensitive administrative actions.
No online service can promise perfect security. If a breach affecting your personal data occurs, we will investigate promptly and notify you and the authorities where the law requires. To report a security concern, see our contact page.
10. Your rights
Under Sri Lankan data protection law and our own commitment to you, you can ask us to:
- give you access to the personal data we hold about you;
- correct data that is wrong or incomplete (you can also edit most of it yourself in the app);
- delete your data or your family’s data (you can do this yourself: see Delete your account);
- stop or limit certain uses, or withdraw a consent you gave;
- give you a copy in a usable format. You can already export transactions and reports as CSV, Excel and PDF from the Reports page.
To use any of these rights, email support@dreamfundsl.com from the address registered on your account so we can confirm it is you. For a whole family’s data we will usually need the request to come from the family Admin. We aim to reply within 30 days. If you are not happy with our response, you can complain to the data protection authority in Sri Lanka.
11. Data outside Sri Lanka
Our providers run international infrastructure, so your data may be processed in countries other than Sri Lanka. We choose providers with appropriate security and contractual commitments, and we share only what each one needs to do its job.
12. Children
Only adults (18 or over) may create a family account. The Admin may add a child as a family member, and is responsible for doing so appropriately. We do not knowingly collect information directly from children for any other purpose. If you believe a child has been added without a parent or guardian’s knowledge, contact us and we will help.
13. Changes to this policy
We will update this page when our practices or the law change, and change the “Last updated” date. For important changes we will tell you in the app or by email.
14. Contact
Batti Express Technologies
Email: support@dreamfundsl.com
See also our contact page.