Privacy Policy

Account data. When you register we collect your name, email address and password, or your Google account email if you sign in with Google.

Product application data. When you apply for a banking or financial product through AnybanQ we collect the information the application requires, which may include your full name, National Identity Card (NIC) number, date of birth, contact details (phone number, email, address), employment and income information, and documents you upload (for example payslips, bank statements or identity documents).

Identity verification (KYC) data. Where identity verification is required, we process images of your identity document and your face. Face matching runs in your browser where possible; captured images that form part of your application are stored securely.

Content you submit. Product reviews, saved products, contact-form messages and quiz or calculator inputs.

Technical and usage data. Device and browser information, pages visited and approximate location, collected through cookies and Google Analytics; your language preference; and, if you enable them, web-push notification subscriptions.

Product information we publish. The bank and product information displayed on AnybanQ — such as interest rates, fees, features and eligibility criteria — is collected from publicly available sources, including the banks' own websites and published rate sheets, and from information provided to us by partner institutions. This is not personal data; every product page shows when its rates were last verified.

We use personal data to:

• create and manage your account;
• process and forward product applications you choose to submit;
• verify your identity where the product requires it;
• display comparison content, remember your preferences and improve the website;
• send service messages (for example application status updates or password resets) and, only with your separate consent, marketing communications;
• prevent fraud and meet our legal obligations.

Banks and financial institutions. When you submit a product application, we share the application data with the bank or institution you selected — only with your explicit consent, which is recorded with the exact consent text and version you agreed to. The receiving institution processes your data as an independent data controller under its own privacy policy.

Insurance partners. Only if you give the separate, optional consent shown during an application.

Service providers. We use trusted providers to run the service: cloud hosting (DigitalOcean), file storage (Amazon Web Services, stored in the United States), email delivery, analytics (Google Analytics) and translation (Google Translate). These providers process data on our instructions. Where data is stored outside Sri Lanka we take reasonable steps to ensure it receives an adequate level of protection.

Legal requirements. We may disclose data where the law, a court or a regulator requires it.

We do not sell your personal data.

We use cookies and browser storage for signing you in, remembering your language, and analytics (Google Analytics). You can control cookies through your browser settings; blocking some cookies may affect how the site works.

We keep personal data only as long as needed for the purposes above: account data while your account is active; application and consent records for as long as required to evidence the application and meet legal obligations; analytics data per Google Analytics retention settings. You may ask us to delete your account and associated data at any time (see Your rights).

We protect personal data with encryption in transit (HTTPS), encrypted storage of sensitive application fields, access controls and moderated publishing. No online service can guarantee absolute security, but we work to protect your data against unauthorised access, alteration or loss.

Under the PDPA you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to erase your data;
• withdraw a consent you previously gave (this does not affect processing already carried out);
• object to processing, including direct marketing.

To exercise any of these rights, contact us using the details below. We will respond within the timeframes the PDPA requires. If you are not satisfied with our response you may complain to the Data Protection Authority of Sri Lanka.

Our services are intended for adults who can lawfully hold financial products. We do not knowingly collect personal data from children.

We may update this policy from time to time. We will post the updated version on this page with a new "last updated" date, and where a change is significant we will tell you through the website or by email.

Fintech Digital (Private) Limited
Echelon Square, Colombo 00100, Sri Lanka
Email: [email protected]
Or use the contact form on our home page.