Privacy Policy

INFODM PRIVATE LIMITED ("INFODM," "we," "us," or "our") is a digital agency registered and operating in Sri Lanka. We are committed to protecting the privacy of our clients, website visitors, and users of our services. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website at infodm.lk or engage our services, including web development, social media content management, AI services, and digital marketing.

By accessing our website or using our services, you consent to the data practices described in this policy. If you do not agree with the terms of this Privacy Policy, please do not access our website or use our services.

1. Information We Collect

1.1 Personal Information You Provide

We collect personal information that you voluntarily provide when you:

• Register for an account on our client portal
• Place an order for web development, social media content management, or other services
• Subscribe to a service plan (e.g., monthly social media content packages)
• Submit a contact form or send us an inquiry
• Provide project materials, business data, or content for service delivery
• Make a payment through our checkout process

This information may include your name, email address, phone number, business name, billing address, payment details, login credentials, and any project-related data you submit.

1.2 Information Collected Automatically

When you visit infodm.lk, we automatically collect certain technical information, including:

• IP address and approximate geographic location
• Browser type, version, and language preferences
• Operating system and device type
• Pages visited, time spent on pages, and navigation paths
• Referring URL and search terms used to find our site
• Date and time of each visit

1.3 Information from Third Parties

We may receive information about you from third-party platforms when you interact with our services through those platforms, including Meta (Facebook) for social media management services and Google for advertising and analytics services.

2. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyze site traffic, and understand user behavior. The types of cookies we use include:

• Essential Cookies: Required for the website to function properly, including session management and authentication.
• Analytics Cookies: Used via Google Analytics to understand how visitors interact with our website. These cookies collect information in an aggregated form to help us improve site performance.
• Functional Cookies: Remember your preferences, such as language settings and login status.
• Marketing Cookies: Used by Meta (Facebook Pixel) and Google to deliver relevant advertisements and measure the effectiveness of our marketing campaigns.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

3. Third-Party Services

We use the following third-party services in the operation of our website and delivery of our services:

3.1 Railway & Cloudflare

Our website and application infrastructure are hosted on Railway and Cloudflare. Data is protected by enterprise-grade security measures. For more information, refer to the Railway Privacy Policy and Cloudflare Privacy Policy.

3.2 PayHere (Payment Gateway)

We use PayHere, a Sri Lanka-based payment gateway, to process online payments. When you make a payment, your payment card details are collected and processed directly by PayHere. We do not store your full credit or debit card numbers on our servers. PayHere is PCI DSS compliant. For details, see the PayHere Privacy Policy.

3.3 Meta (Facebook)

For clients who use our social media content management services, we access and manage content on Facebook Business Pages through the Meta Business Suite. We may also use the Facebook Pixel on our website for advertising analytics. Data shared with Meta is governed by the Meta Privacy Policy.

3.4 Google Analytics

We use Google Analytics to collect and analyze website traffic data. Google Analytics uses cookies to gather information about how visitors use our site. This data is aggregated and anonymized where possible. You may opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on. For more details, see the Google Privacy Policy.

4. How We Use Your Information

We use the information we collect for the following purposes:

• To deliver and manage the services you have purchased (web development, social media content, AI services, digital marketing)
• To create and manage your client portal account
• To process payments and send transaction-related communications
• To communicate with you about your projects, service updates, and support requests
• To improve our website, services, and user experience
• To send marketing communications, where you have opted in to receive them
• To comply with legal obligations and protect our rights
• To detect, prevent, and address technical issues or security threats

5. Data Security

We take the security of your personal data seriously and implement industry-standard measures to protect it. Our security practices include:

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS/SSL. Sensitive data at rest is protected with AES-256 encryption.
• Authentication: User authentication is managed using JSON Web Tokens (JWT) with secure token rotation and expiration policies. We also support OAuth 2.0 for third-party integrations.
• Access Controls: Access to personal data is restricted to authorized personnel on a need-to-know basis. Role-based access control is enforced across our systems.
• Infrastructure Security: Our hosting infrastructure on Railway benefits from enterprise-grade physical and network security, including firewalls, intrusion detection, and regular security audits.
• Password Security: User passwords are hashed using strong one-way hashing algorithms and are never stored in plain text.

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share your data in the following limited circumstances:

• Service Providers: With trusted third-party service providers who assist in operating our business (e.g., Railway for hosting, Cloudflare for CDN and storage, PayHere for payment processing), subject to their own privacy policies and data protection obligations.
• Platform Partners: With Meta (Facebook) and Google as necessary to deliver social media management and advertising services on your behalf.
• Legal Requirements: When required by law, regulation, or legal process, or to protect the rights, property, or safety of INFODM, our clients, or others.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

• Account Data: Retained for the duration of your account and for up to 12 months after account closure.
• Project Data: Web development project files and related data are retained for 6 months after project completion, unless otherwise agreed.
• Transaction Records: Payment and billing records are retained for a minimum of 6 years to comply with applicable tax and financial regulations in Sri Lanka.
• Analytics Data: Website analytics data is retained in aggregated form for up to 26 months.
• Marketing Data: If you opt in to marketing communications, we retain your contact information until you unsubscribe.

8. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct any inaccurate or incomplete personal data.
• Deletion: Request that we delete your personal data, subject to our legal retention obligations.
• Objection: Object to the processing of your personal data for marketing purposes.
• Data Portability: Request a machine-readable copy of the personal data you have provided to us.
• Withdrawal of Consent: Where processing is based on your consent, you may withdraw that consent at any time.

To exercise any of these rights, please contact us at hello@infodm.lk. We will respond to your request within 30 days.

9. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at hello@infodm.lk, and we will take steps to delete such information.

10. International Data Transfers

INFODM PRIVATE LIMITED is based in Sri Lanka. Our hosting infrastructure on Railway and Cloudflare may store data in regions outside of Sri Lanka. By using our services, you acknowledge and consent to the transfer and processing of your data in locations outside of Sri Lanka, where data protection laws may differ from those in your country of residence. We take reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy.

11. Sri Lanka Legal Context

This Privacy Policy is governed by and construed in accordance with the laws of Sri Lanka, including the Personal Data Protection Act No. 9 of 2022 (PDPA) where applicable. INFODM is committed to aligning its data protection practices with the requirements of the PDPA as the Act comes into full effect. We reserve the right to update this policy to reflect changes in applicable law.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically. Your continued use of our website and services after any changes constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: