Privacy policy

Who is responsible

This site is run by Ruchira Sachinthana in Sri Lanka, who decides how your information is used. Questions or requests go to the email address at the end of this page.

This policy follows Sri Lanka's Personal Data Protection Act, No. 9 of 2022, and is written to meet the GDPR for visitors from the EU and UK.

What is collected, and why

• Contact form: your name, email, and anything you choose to add (WhatsApp number, company, service, budget, timeline, message). Used only to reply and discuss your project.
• Gated resources: your name and email when a resource asks for them before download. Used to send or unlock the resource and, occasionally, a relevant follow-up.
• Website checkers in the free tools: the address you check and the resulting report, so the report has a shareable link.
• For abuse prevention on all of the above: a one-way, keyed hash of your IP address. The address itself is never stored, and the hash can't be turned back into it.
• Analytics: only if you accept cookies. See “Cookies and analytics” below.

What is not collected

• No accounts or sign-ups for visitors.
• Files you open in the free PDF, image, document and finance tools are processed in your own browser. They are never uploaded.
• Your information is never sold, rented or used for advertising profiles.

Cookies and analytics

Analytics tools, such as Google Analytics through Google Tag Manager, start switched off. They only run if you choose Accept in the cookie notice, and you can change your mind at any time by clearing this site's cookies, which brings the notice back.

The site also keeps a few strictly necessary items in your browser, such as your theme (light or dark) and your cookie choice. These don't track you.

Who helps run the site

These services process data on this site's behalf, under their own security and privacy commitments:

• Vercel: hosting and the servers that run the site (Singapore region, with a global network for pages).
• Supabase: the database and file storage (Singapore region), encrypted at rest.
• Google: Gmail for replying to you, and Google Analytics only if you accept cookies.
• Cloudflare Turnstile: a privacy-friendly check that a form was sent by a person, when it is shown.
• Cal.com and WhatsApp: only if you choose to book a call or send a message there, under their own policies.

How long it is kept

• Contact form messages: for as long as needed for our conversation and any work that follows. They are reviewed at least once a year and deleted when no longer needed.
• Resource download records: up to 24 months, then deleted automatically.
• Website checker reports: up to 12 months, then deleted automatically.
• Analytics data: as set in Google Analytics, at most 14 months.

How it is protected

Everything travels over HTTPS. Stored data is encrypted at rest and protected by row-level access rules, so only the site owner can read it, through an admin that needs a second sign-in step. Access is logged.

Your rights

You can ask, at any time and free of charge, to:

• see the information held about you, and get a copy;
• correct anything that is wrong;
• have it deleted;
• withdraw consent, for example to analytics or follow-up emails;
• object to how it is used.

Contact and complaints

Email the address below with your request. You'll get a reply within a month, usually much sooner. If you're not satisfied, you can complain to the Data Protection Authority of Sri Lanka, or to the data protection authority where you live.