Privacy Policy

Last updated: October 13, 2026

1. Information We Collect

We only collect the information you give us when you use a feature of the site, plus basic, anonymous usage statistics:

• Accounts (optional): if you create an account, your name and email address, and the phone number and delivery address you choose to save. If you sign in with Google, Google shares your name, email address and an account ID with us; we never see your Google password. If you use a password, we store only a secure, one-way scrambled form of it, never the password itself.
• Orders: your name, phone number, delivery address and district, and optionally your email address and an order note, along with the items you order and how you choose to pay.
• Restock requests: when you ask to be notified that an out-of-stock product is back, the email address and/or phone number you give us, and your name if you choose to provide it.
• Contact form: your name, email address and message.
• Messages to our team: article corrections, issue reports and messages you send from your account, and our replies. They are visible only to you and our team.
• Newsletter: your email address.
• Comments and product reviews: your name, email address, rating and what you write. Your name and comment or review are shown publicly once approved; your email address is never published.
• Order tracking: the order number and phone number you enter, used only to find your order.
• Usage statistics: the pages you visit, the referring website, your country, and your device, operating system and browser type. We do not store your IP address for this: it is turned into a code with a secret that changes every day and is then deleted, so visits cannot be traced back to you.

2. How We Use Your Information

• To process, deliver and support your orders, including order confirmation and status emails when you give us an email address.
• To let you know when a product you asked about is back in stock, by email, or by a phone call or WhatsApp message from our team.
• To reply to your messages and, if you subscribed, to send our newsletter.
• To moderate and publish comments and reviews.
• To protect the site from spam and abuse. For this we briefly record the IP address of form submissions and keep it for no more than one day.
• To understand which content is useful and improve the website.

We do not sell, trade, or rent your personal information to others.

3. Content Generation and AI

While we write the majority of our content, we use Artificial Intelligence to assist in content improvement, editing, and translation. All medical claims and scientific references provided in our articles are thoroughly reviewed to ensure safety and accuracy.

4. Third-Party Links

Our website may contain links to scientific journals or external references. We do not have control over the privacy policies of these third-party sites and encourage you to review them independently.

5. Services We Use

Some trusted services help us run the site. They receive only what they need to do their job and have their own privacy policies:

• Cloudflare delivers and protects the website, and so handles your connection to it.
• Google Analytics helps us count visits and understand how the site is used.
• Google reCAPTCHA checks that the contact, comment and review forms are used by people rather than bots.
• Google Fonts provides the fonts used on the site.
• PayHere processes card payments when you choose to pay by card. You enter your card details on PayHere’s secure page; we never see or store them.
• Google Sign-In lets you sign in with your Google account, if you choose to.
• Cloudflare Email and SMTP2GO deliver the emails we send, such as order confirmations, account emails, restock notices and replies.
• Tawk.to provides the live chat window, when live chat is switched on.
• WhatsApp is used if you choose to contact us there, or when we message you about an order or a restock request.

6. Cookies and Local Storage

Browsing Herb.lk does not set any cookie of our own. A session cookie is set only once you use the cart, checkout, order or account pages, so your cart and sign-in work; it ends when you close your browser. When you are signed in, a small cookie also tells our pages to fill in your name and email on forms; it contains no personal information. Google Analytics, Google reCAPTCHA and Tawk.to (when live chat is on) may set their own cookies. Your light or dark theme choice is saved in your browser’s local storage. The site language (English or Sinhala) is chosen by the page address, not a cookie. You can block or delete cookies in your browser settings, but the cart and checkout need the session cookie to work.

7. How Long We Keep Your Information

• Order details are kept for as long as we need them for delivery, customer support and our business and accounting records.
• Messages with our team are kept with your account.
• Accounts are kept until you ask us to delete them. Deleting an account does not delete past orders, which we keep for our records.
• Restock requests, newsletter subscriptions, comments and reviews are kept until you ask us to remove them, or until we delete them.
• Usage statistics are kept for 12 months, and spam-protection records for one day.

8. Your Choices

You can unsubscribe from our newsletter at any time using the link in any newsletter email. If you have an account, you can update your details on your account page. To see, correct or delete the information we hold about you (including deleting your account), or for any privacy question, please get in touch through our Contact page.