Privacy notice

Privacy at Maha Sauna

Maha Sauna is a sauna and spa at Hiriketiya Beach Road, Dikwella 81200, Southern Province, Sri Lanka. You can reach us about anything in this notice at info@mahasauna.com, on WhatsApp or phone +94 76 916 4680, or in person. This notice explains what personal information we collect when you use mahasauna.com, book the circuit or spa, or buy a pass or gift voucher, and what we do with it.

When you book or buy, we collect your name, phone number, email address and date of birth; your acceptance of our health and safety waiver (we record that you accepted it and when); and the details of what you booked. Massage and spa bookings also offer an optional "Anything we should know?" field - if you write something there, for example an injury or pregnancy, we keep that note with your booking so our therapists can prepare. Our system also records your booking's IP address, used only to rate-limit repeated unpaid bookings. If you pay online, your card details go directly to our payment provider, Stripe - we never see or store your card number.

When you browse the website, with your agreement, we use Google Analytics to understand how the site is used (pages opened, buttons clicked, bookings and purchases started or completed). If you pay online and agreed to Analytics, our booking system sends Google Analytics the completed purchase details, linked to your website visit. Google Analytics is off until you accept it on our cookie notice, and you can change that choice at any time. We do not send your name, email, phone number, date of birth, booking notes or card details to Google Analytics.

When you visit us, our till system keeps your bookings, purchases, passes and check-ins to run your sessions.

What we use it for

Running your bookings, sessions, passes and purchases, and sending your confirmations - we need your booking details to do this.
Understanding how the website is used, only for visitors who agree to analytics.
Meeting legal obligations, for example accounting records.

Who we share it with

Google Analytics - website usage and purchase statistics, only if you agree; processed outside Sri Lanka.
Stripe - online card payments; outside Sri Lanka.
Resend - booking and voucher confirmation emails; outside Sri Lanka.
Cloudflare - website hosting and security; outside Sri Lanka.
Google Fonts loads fonts on our pages, so your browser contacts Google servers.

Our online menu is hosted by a separate provider (happychimps.com); visiting it is covered by their own policies.

How long we keep it

Website analytics: our Google Analytics settings automatically delete event-level data after 2 months and user-level data after 14 months. These settings govern analytics data linked to cookies and similar identifiers; aggregated reporting is not affected by them.
Booking, purchase and customer records: kept while needed to run your sessions, passes and our accounts; our system does not delete them automatically. You can ask us to delete them - see Your choices below.

Your choices

You can change or withdraw your analytics agreement at any time under . You can also ask us to access, correct or delete the personal information we hold about you: write to info@mahasauna.com and we will respond within a reasonable time. You can contact the Data Protection Authority of Sri Lanka (www.dpa.gov.lk, info@dpa.gov.lk) about how your information is handled.

Cookies

With your agreement, our site uses cookies for Google Analytics (usage statistics) - those are the only cookies our pages set for guests. The booking system saves your booking reference in your browser's local storage, so you can find your bookings again under My Maha; it stays on your device. You can block cookies and storage in your browser settings; browsing still works, but booking and My Maha may not.

Children

Guests under 18 take part in the circuit (sauna, ice bath, steam room and magnesium bath) only with a parent or guardian, who accepts the waiver for them.

Last updated: 27 October 2026