Privacy Policy

1. Introduction

DGTL is a digital and AI services company based in the Democratic Socialist Republic of Sri Lanka.

This Privacy Policy explains how we collect, use, share, and protect personal data when you use our websites, apps, software platforms, APIs, AI tools, professional services, customer support, and related marketing or trial offerings (together, our “Services”).

This Notice applies to personal data we process as a controller. Where we provide Services to business customers and process personal data only on their instructions, we typically act as a processor in those cases, the customer’s own privacy notice usually governs how end-user data is handled, and our processing is governed by our agreement with that customer. Our Services may contain links to third-party sites or tools. We are not responsible for their privacy practices. Please review those parties’ policies separately.

We aim to align our practices with Sri Lanka’s Personal Data Protection Act, No. 9 of 2022 (as amended by Act No. 22 of 2025). Core controller and processor obligations and Part I processing rules are scheduled to take fuller operational effect from 1 January 2027 (Gazette Extraordinary No. 2498/16).

2. Highlights

We collect personal data needed to provide and improve our Services, communicate with you, and meet legal duties. We do not sell personal data. AI features may process prompts, uploads, and related logs; we use safeguards and offer limits where available. You have PDPA-oriented rights (access, correction, erasure, and others where applicable). Contact us at [Privacy Email] or [DPO / Privacy Contact Email] with questions or requests.

3. Personal data we collect

Depending on how you interact with us, we may process: Account & identity data name, username, credentials, organisation, role. Contact & communications data email, phone, postal details, messages, support tickets. Payment & billing data billing contact, invoices, limited payment details processed via payment providers (we do not store full card numbers where providers handle them). Service / product data content you upload or submit, including AI prompts, outputs, files, and conversation logs. Device & technical data IP address, device/browser type, OS, identifiers, logs. Usage & analytics data feature use, performance metrics, crash/diagnostic data. Marketing & preference data newsletter opt-ins, event registrations, communication preferences. Professional / business contact data work email, company, job title (e.g. from demos, partnerships, or public business sources where lawful). Special category data only if you voluntarily provide it; we apply extra care and do not seek it as a matter of course. AI note: When you use AI features, we may process prompts, generated outputs, uploaded files, and related logs to deliver the feature. Where we use such data to improve models or Services, we apply safeguards (including anonymisation or aggregation where practicable) and honour product options to limit improvement uses where offered.

4. Sources of personal data

We obtain personal data from:

You (forms, accounts, uploads, support, events, trials); Your devices and browsers (cookies and similar technologies; Our systems (logs, analytics, product telemetry); Service providers and partners (e.g. payments, hosting, reseller channels), where lawful; Publicly available sources, where collection is lawful and appropriate.

5. How we use personal data

We use personal data to: Provide, operate, and maintain the Services; Create and manage accounts and authentication; Process payments and billing; Deliver customer support; Improve and develop products (including AI features, with safeguards); Protect security, prevent fraud and abuse; Send marketing where permitted (and with consent where required); Comply with legal and regulatory obligations; Conduct limited research and analytics in a privacy-respecting way. Lawful bases (PDPA-style, in plain language): we rely mainly on consent (where required), performance of a contract, legal obligation, and legitimate interests (balanced against your rights e.g. security, product improvement, B2B relationship management). Vital interests or public interest grounds are generally not applicable to our ordinary operations.

6. Automated decision-making & AI

Some Services use AI-assisted processing (e.g. chatbots, content generation, analytics, recommendations). Where profiling or automated decisions could produce significant effects, we will provide appropriate information and, where required, a path to human review. Generative AI outputs may be incomplete or inaccurate; you should not treat them as sole advice for important decisions.

7. Children’s data

Our Services are not directed to children under 18 (or the applicable age of majority). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us immediately and we will take reasonable steps to delete it.

8. How we share personal data

We may share personal data with: Processors / service providers (cloud hosting, payments, analytics, support tools, email delivery) under appropriate contracts; Affiliates, where needed to deliver the Services; Partners / resellers, where you engage through those channels; Authorities or advisers, when required by law or to protect rights and safety; Parties in a corporate transaction (e.g. merger or acquisition), subject to appropriate protections. We do not sell personal data. Processors are required to process data only on our instructions and to protect it appropriately.

9. International / cross-border transfers

Personal data may be processed outside Sri Lanka (for example, in cloud regions used by our providers). Where cross-border transfers occur, we take steps consistent with PDPA section 26 as applicable including contractual protections, risk assessment, and other suitable safeguards.

10. Retention

We keep personal data only as long as needed for the purposes described above, or as required by law. Retention depends on factors such as account status, contract length, legal hold needs, and the nature of the data. Typical examples: Account data while the account is active, then a reasonable wind-down period; Payment / billing records for statutory accounting periods; Support communications for a limited period after resolution; Product / AI logs for shorter operational windows unless needed for security, disputes, or improvement under your settings. When data is no longer needed, we delete or anonymise it where practicable.

11. Security

We use technical and organisational measures appropriate to the risk such as access controls, encryption in transit and/or at rest where suitable, and pseudonymisation where helpful. No method of transmission or storage is completely secure. To report a security concern, contact us immediately.

12. Your privacy rights

Subject to the PDPA and applicable exceptions, you may have the right to:

Access your personal data; Rectify inaccurate or incomplete data; Erase data in certain circumstances; Restrict or object to certain processing where applicable; Withdraw consent where processing is consent-based (without affecting prior lawful processing); Data portability, where applicable; Lodge a complaint with the Data Protection Authority of Sri Lanka. We may need to verify your identity before responding. We aim to respond within a reasonable timeframe consistent with applicable law. Contact us to exercise these rights.

13. Cookies and similar technologies

We and our providers may use cookies and similar technologies for essential operation, preferences, analytics, and (where permitted) marketing.

14. Controllers, processors, and B2B customers

For our own websites, marketing, and direct consumer-facing offerings, DGTL is typically the controller. For enterprise SaaS or similar B2B arrangements, the business customer is often the controller of end-user data, and we act as processor. End users of an enterprise customer’s instance should review that customer’s privacy notice and raise requests with them first; we will assist the customer as required by contract and law.

15. Changes to this Notice

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may also be notified via our website, email, or in-product notice where appropriate. Continued use of the Services after an update means you acknowledge the revised Notice, to the extent permitted by law.