Privacy Policy

Effective date: 26 September 2026

Wildscape Sri Lanka (“we,” “us,” or “our”) operates this website. This Privacy Policy explains what information we process when you use it, why, and the choices available to you. It describes our actual, current practices — nothing here describes a feature the site doesn't actually have.

Information We Process

The inquiry form on our Plan Your Trip page processes the information you submit: your name, email address, phone number (optional), tour interest, preferred travel date (optional), group size (optional), and your message. Certain technical information, including your IP address, may also be processed automatically as part of operating the form securely — see “Spam and Abuse Prevention” below.

Beyond the analytics cookies described below, we do not use cookies, browser local storage, or session storage for our own website functionality, and we do not require an account, login, or payment information anywhere on the site.

How We Use Your Information

We use the information submitted through the inquiry form to:

• respond to your inquiry and help plan your trip;
• send you a confirmation that we've received your message; and
• keep a record of the correspondence so we can follow up appropriately.

We do not sell or rent your information, and we do not use it for advertising.

Spam and Abuse Prevention

To keep the inquiry form free of automated abuse, it uses a hidden field genuine visitors never interact with (a “honeypot”), a check on how quickly a form is submitted, and a rate limit on how many inquiries can be sent in a short period. Specifically: submissions are limited to 5 per 10 minutes per IP address, and confirmation emails are limited to 2 per hour per recipient, identified by a one-way (SHA-256) scrambled version of the email address rather than the address itself. Where our rate-limiting service (Upstash) is configured, these counters expire automatically and are never retained for longer than their window — a maximum of one hour. These mechanisms assess whether a submission looks automated; they are not used to build a profile of you.

Email Communications

When you submit the form, we send two emails: one to our team with your submitted details so we can respond, and one to you confirming receipt and repeating your message back to you. We use Resend, a third-party transactional email provider, to deliver both. Resend receives the information necessary to deliver these emails (your name, email address, and message). For details on how Resend itself handles data it processes on our behalf, please refer to Resend's own privacy and terms documentation. We do not use your email address for marketing, and submitting an inquiry does not add you to any mailing list.

Other Third-Party Services

We use the following third-party services to operate this website:

• Vercel — hosts this website and runs the server-side processing behind the inquiry form.
• Resend — delivers the emails described above.
• Upstash (where configured) — supports the rate limiting described above. It only processes an IP address and a one-way hashed email identifier for this purpose; it does not receive your name or message.

We provide each of these third parties only the information necessary for them to perform their respective service for us. For details of how they process information on their own systems, please refer to their individual privacy documentation.

WhatsApp

This site includes a link to message us on WhatsApp. Clicking it opens WhatsApp with a pre-filled message. Our website itself does not transmit your form data to WhatsApp — once you follow that link, your conversation is handled directly by WhatsApp/Meta under its own privacy policy and terms.

Analytics and Cookies

We use Google Analytics 4 (GA4), a web analytics service provided by Google, to help us understand how visitors use this website — for example, which pages are visited, how visitors found the site, approximate device and browser information, and general traffic patterns. This helps us improve the site and understand what visitors are looking for. GA4 does not receive the name, email address, or message content you submit through our inquiry form — that information is never passed to Google Analytics.

Google Analytics may use cookies and similar technologies (such as browser storage) to distinguish visitors and measure activity across a visit. We have not enabled Google Signals, Google Ads remarketing, or advertising-audience features — GA4 is used here for site analytics only. You can control or delete cookies through your browser's own settings at any time. For more detail on how Google itself processes this data, see Google's Privacy Policy and how Google Analytics uses data.

No Database of Submissions

This website does not maintain a database of inquiry submissions. Once an inquiry is sent, its only record is the email itself — in our inbox and in Resend's own delivery records — plus the short-lived, automatically-expiring rate-limit counters described above.

Data Retention

We retain inquiry and correspondence information for as long as reasonably necessary to respond to your request, manage the resulting travel inquiry or relationship, and meet applicable legal, accounting, or record-keeping requirements. Automated rate-limit counters expire within their configured window, a maximum of one hour, and are never retained longer than that. If you would like us to delete your inquiry information sooner, contact us using the details below.

Data Security

We take reasonable technical measures to protect the information you provide, including: server-side validation and length limits on every form field, the anti-spam and rate-limiting measures described above, keeping service credentials in server-side environment variables that are never exposed to your browser, and encoding (HTML-escaping) any text you submit before it's placed into an email. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your Rights

Depending on where you are located and the law that applies to you and to our processing of your personal information, you may have rights such as access, correction, deletion, restriction, or objection regarding the information we hold about you. To exercise any of these rights, contact us at wildscapesrilanka@gmail.com and we will respond to your request.

Children's Privacy

This website is intended for people planning travel and is not directed at children. We do not knowingly collect information from children.

Changes to This Policy

We may update this Privacy Policy from time to time — for example, if we introduce analytics or change how the inquiry form works. Any changes will be posted on this page with an updated effective date.

Contact Us

If you have any questions about this Privacy Policy or how we handle your information, please get in touch:

Wildscape Sri Lanka
Email: wildscapesrilanka@gmail.com
WhatsApp: Message us