Privacy Policy
Effective date: 18 July 2026 Last updated: 18 July 2026
1. Who we are
This Privacy Policy explains how Black Bird OTT ("we", "us", "our") collects and uses your personal data when you use blackbirdott.com and the Black Bird OTT streaming application (the "Service").
- Data controller: Black Bird (Private) Limited (Reg. No. PV 00365247)
- Registered address: 444/1, Shanthai North, Pandaterippu, Jaffna, Sri Lanka
- Phone: +94 77 557 5773
- Privacy contact: privacy@blackbirdott.com
- Data Protection Officer: privacy@blackbirdott.com
2. What this policy covers
This policy covers personal data we process about visitors, registered users, and subscribers of the Service. It does not cover third-party websites or services we link to, which have their own policies.
3. What personal data we collect
Information you give us:
- Account data — your email address (used for sign-in via one-time code) and any display name you set.
- Subscription and payment records — the plan you choose and a record of each transaction (amount, currency, status, order reference). Your full card or bank details are handled by PayHere and are not collected or stored by us.
- Communications — messages you send to support@blackbirdott.com or privacy@blackbirdott.com.
Information we collect automatically as you use the Service:
- Usage data — what you watch, your watchlist, watch history, playback progress, continue-watching, and likes, so we can provide and personalise the Service.
- Technical data — IP address, device and browser type, and log data, used for security, fraud prevention, and to make the Service work.
We do not intentionally collect special categories of personal data (as defined by the PDPA), and we ask that you do not send us such data.
4. How and why we use your data
| Purpose | Examples |
|---|---|
| Provide the Service | Sign you in, show your library, remember where you stopped watching |
| Manage subscriptions | Check your access tier, activate your plan after payment, handle renewals and expiry |
| Process payments | Pass the required details to PayHere and record the result |
| Personalise your experience | Continue-watching rows, likes, and recommendations |
| Keep the Service secure | Detect fraud, abuse, and unauthorised access; enforce our Terms |
| Communicate with you | Service and account notices, and — only with your consent — marketing |
| Meet legal obligations | Tax, accounting, and lawful requests from authorities |
5. Our lawful basis
Under the PDPA we process your personal data on lawful bases including: performance of our contract with you (providing the Service you subscribed to), your consent (for example for marketing), our legitimate interests (such as security and improving the Service), and compliance with legal obligations. Where we rely on consent, you may withdraw it at any time; this does not affect processing already carried out.
6. Marketing and communications
We will send you essential service messages (such as payment confirmations and account notices) as part of operating the Service. We will only send promotional messages to users who have opted in, and every promotional message will include an easy way to unsubscribe.
7. Who we share your data with
We do not sell your personal data. We share it only with:
- PayHere — to process your payments.
- Supabase — for secure authentication and database hosting.
- Bunny.net — to deliver video securely.
- Hosting and infrastructure providers — Vercel (website hosting) and Railway (API hosting).
- Authorities or advisors — where required by law, or to establish or defend legal claims.
Each provider processes your data on our behalf under their own terms and security obligations.
8. International transfers
Some of our providers may store or process data on servers outside Sri Lanka. Where the PDPA applies to such transfers, we will rely on the safeguards it requires so that your data continues to be protected.
9. How long we keep your data
We keep your personal data for as long as your Account is active and for a reasonable period afterwards to meet legal, tax, accounting, and dispute-resolution needs. When data is no longer needed, we delete or anonymise it.
10. How we protect your data
We use technical and organisational measures to protect your data, including encrypted connections, access controls, secure third-party authentication, short-lived signed links for video, and rate limiting and monitoring on our systems. No system is perfectly secure, but we work to protect your data and will notify the Data Protection Authority and affected users of a personal data breach where the PDPA requires.
11. Your rights
Subject to the PDPA and its phased application, you have the right to:
- access the personal data we hold about you;
- correct inaccurate or incomplete data;
- request erasure of your data in certain circumstances;
- withdraw consent where we relied on it;
- object to or restrict certain processing; and
- complain to the Data Protection Authority of Sri Lanka.
To exercise any of these, email privacy@blackbirdott.com. We will respond within the timeframe required by law and may need to verify your identity first.
12. Cookies and similar technologies
We use cookies and similar technologies that are necessary to run the Service (for example to keep you signed in) and, where applicable, to understand usage and improve the Service.
13. Children's privacy
The Service is not directed at children below the age we set for use of the Service (see our Terms). We do not knowingly collect personal data from children below that age without appropriate consent. If you believe a child has provided us data, contact privacy@blackbirdott.com and we will take appropriate steps.
14. Changes to this policy
We may update this policy from time to time. If we make material changes, we will notify you before they take effect. The "last updated" date at the top shows the current version.
15. Contact us
For any privacy question or to exercise your rights, email privacy@blackbirdott.com. You also have the right to contact the Data Protection Authority of Sri Lanka (www.dpa.gov.lk).