Privacy Policy

Who we are and how to contact us

This website is run by CeylonDev, a software company based in Sri Lanka. If you have any question about this notice or about your information, write to us at asithawanigasekara99@gmail.com.

What we collect through the inquiry form

When you send us an inquiry, we collect only what you type into the form:

• your name
• your business or company name (optional)
• your email address
• your phone or WhatsApp number (optional, unless you choose phone or WhatsApp as the way we reach you)
• the services you are interested in
• a description of your project
• your budget range
• your timeline
• your preferred contact channel
• your preferred reply language
• your confirmation that you have read this notice and agree to it

To protect the form from abuse, the inquiry record keeps only a keyed hash of your IP address, not the address itself, and the hash cannot be turned back into it. Separately, when you submit the form we create a short-lived security session record that holds your IP address and browser details (such as your browser type) for the length of that session.

What we collect when you create an account

When you register for an account, we keep:

• your name
• your email address
• your password, only as a one-way hash: we cannot read it or send it back to you
• the language you were using (English or Sinhala), so that we write to you in it
• the time you confirmed your email address, once you have

Every sign-in attempt, whether it succeeds or fails, and every sign-out is recorded in a security log. Each record holds the time and a keyed hash of your IP address, not the address itself; the hash cannot be turned back into it. A sign-in record also holds the email address that was entered. The same log notes when an account is created, an email address is confirmed, a password is reset, and an order is placed, cancelled or claimed.

While you are signed in, a session record in our database holds your IP address and browser details (such as your browser type), so that we can keep you signed in. Signing out ends that session, but the site then starts a new, signed-out session record that holds the same kind of details. A session record that has been idle for two hours is no longer valid, and a daily clean-up deletes it.

The links we email you to confirm your address or to choose a new password are stored only as hashes, together with the account they belong to (and, for a password link, your email address) and the time they were made. The record is removed when its link is used or when a newer link replaces it. An account email that could not be sent is removed from our mail queue within a week, and the short-lived record that slows down repeated failed sign-ins (a keyed hash of the email address entered and your IP address) within a day of expiring.

What we collect when you order or claim a product

When you place an order, or claim a free product with your account, we keep:

• the order: its reference (such as ORD-AB12CD), the product, the price and currency when you ordered, how it is paid, its status, and the times it was placed, paid, cancelled or refunded
• payment events: when our staff confirm that your bank transfer has arrived, they record a note and, if they choose, the reference printed on the bank statement, together with their own account reference. A free claim is recorded as an event too
• your access: which product you may download, whether it came from a purchase, a free claim or a grant by our staff, and whether it is still active

You pay by bank transfer to our account, so we never receive or keep card numbers or card security codes. We see only what reaches our own bank account, such as the amount and the reference written on the transfer. Your bank keeps its own record of your transfer.

Each step of an order, and each time access is given or ended, is also written to the security log described above, with the note our staff wrote.

What we record when you download a file

Each time a download link is issued, whether or not you have an account, we record:

• the time
• the product and the version
• a keyed hash of your IP address, not the address itself
• the text your browser sends to describe itself (its user agent), cut to 255 characters

For a signed-in customer the record is also tied to the account and the access it used. A free product that anyone may download without an account is recorded in the same way, with no account attached.

Why we use it

We use your details to reply to your inquiry and to prepare a proposal for your project; to run your account, take your orders and let you download the products you are entitled to; and to keep accounts, orders and downloads secure and spot misuse. We do not use them for anything else, and we do not use them for advertising or analytics.

Our legal basis

Inquiries: we handle your details because you agree to it. By ticking the checkbox on the inquiry form you give us your consent, and you cannot send the form without it.

Accounts, orders and downloads: we need your details to give you what you ask for, which is an account, an order or a file. We cannot do that without them, and you ask for it when you register, place an order or download.

The security log and the download log: we keep them because it is in our interest, and yours, to keep accounts and downloads safe and to settle any question about an order.

Who we share it with

We do not sell your information. Your details pass through:

• our email provider, which delivers your inquiry to our team and your confirmation to you, and the account emails we send you: the link to confirm your email address, a notice if you register an address that already has an account, and the link to choose a new password
• Cloudflare Turnstile, a bot check that we use only if it is switched on for the inquiry form, the registration form and the forgot-password form. When it is on, the form widget shares browser signals with Cloudflare, and our server sends Cloudflare the challenge token and your IP address to check it. Cloudflare does not receive what you write in the form.

Inside the company, only staff whose work needs it can see account, order and download records: they can see your name, email address, orders, payment events and download history.

Cookies and local storage

We use only the cookies the site needs to work:

• NEXT_LOCALE remembers the language you chose. It lasts one year.
• ceylondev_session and XSRF-TOKEN keep you signed in and protect the site against forged requests. They are set when you submit a form and when you sign in, and they expire after two hours without activity.

We do not use advertising cookies or analytics cookies.

Your browser's session storage keeps a few things on your device while you use the forms. While you fill in the inquiry form it keeps an unsent draft of your answers, under the name inquiry-draft:v1. After you send an inquiry it keeps the inquiry's reference number (never your answers), under the name inquiry-last:v1, so that the confirmation is still there after a reload or a language switch. While you fill in the registration form it keeps your name and email address, under the name register-draft:v1, and never your password. After you ask for a confirmation email or a password-reset email, it keeps the email address you used, under the name register-sent:v1 or forgot-sent:v1, so that the “check your email” message is still there if you switch language. All of it stays on your device and is deleted when you close the tab. The inquiry draft is also deleted when the inquiry is sent, the inquiry reference when you choose “Send another inquiry”, the registration draft when you register, and the saved email address when you choose “Use a different email”.

How long we keep it

Until automatic deletion is in place we delete records by hand, and you can ask us to delete yours at any time. We keep:

• inquiries: until about 24 months after our last contact with you
• your account (name, email address, password hash, language and confirmation time): for as long as you have an account. You can ask us to close it at any time; the orders and downloads tied to it are handled as set out below
• orders, payment events and access records: for as long as you have access to the product or an account, and for 24 months after that ends (after your access is withdrawn or refunded, an order is cancelled, or your account is closed); then we delete them by hand
• the download log: for as long as you have access to the product or an account, and for 24 months after that ends, then we delete it by hand; a download made without an account is kept for 24 months after the download
• the security log (sign-in attempts and account and order events): 24 months, then we delete it by hand
• sessions: signing out ends your signed-in session, but a new signed-out session record takes its place; a session record is no longer valid two hours after its last activity, and a daily clean-up deletes it
• confirmation and password-reset link records: until the link is used or a newer one replaces it

Your rights

You can ask us to show you the information we hold about you, to correct it, to delete it, or to close your account. Write to asithawanigasekara99@gmail.com and we will deal with your request.

Changes to this notice

If we change this notice, we will publish the new version on this page and update the date at the top.