Privacy policy
Most privacy policies are written to protect the company from you. This one is written so you can actually tell what happens to your information. It is short, it is specific, and where the answer is “nothing leaves your device” we say so plainly.
Last updated 8 September 2026 · Applies to and everything on it
1. Who we are
ThaDigital Enterprise (also written “ThaDigital”) is a software and system development practice based in Sri Lanka. We design and build custom business systems, and we operate this website at .
To be straightforward about it: ThaDigital Enterprise is a trading name and is not at present a registered company. It is operated by an individual sole practitioner in Sri Lanka. We would rather tell you that plainly here than imply a corporate structure that does not exist. Should that change, this page will be updated with the registered name and number.
For anything to do with your personal information - a question, a correction, a request for a copy, or a request to delete it - contact us at . That address is the single point of contact for all of it, and a person reads it.
2. What this policy covers
This policy covers the information handled through this website: the contact form, the demo applications, and the ordinary technical records created when any website is visited.
It does not cover the systems we build for clients. Where we work on a client's system, that client is the data controller for the information inside it and we act on their instructions. Those arrangements are dealt with in the contract for that project, not here.
3. What we collect, and when
When you send us a project brief
The contact form asks for your name and email address, and optionally your business name, phone number, industry, budget range, timeline, what you need, and a description of your situation. You choose how much of that to provide; only your name, email and a description are required.
You should also know how that form actually sends. If we have not configured an email delivery service, pressing Send the brief opens your own email program with the message already written - nothing is transmitted until you press send there, and it travels through your own email provider. If we have configured a delivery service, the message is sent through Web3Forms, which forwards it to our inbox. The “send on WhatsApp” button hands the text to WhatsApp on your device; again, you press send.
When you use the live demos
The demo applications run entirely inside your browser. There is no account, no login and no server behind them. Anything you type into a demo - a customer name at the till, a product description in the classifier - stays on your own device and is never transmitted to us or to anyone else.
The retail POS demo saves its state in your browser's local storage so the demo survives a page refresh. That data never leaves your device, and pressing Reset inside the demo deletes it. Clearing your browser's site data removes it too.
Ordinary technical records
This site is hosted on Vercel. Like any web host, their servers record standard request information - IP address, the page requested, timestamp, browser and operating system - for delivery, security and abuse prevention. We do not use these records to build a profile of you, and we do not combine them with anything else.
The site loads typefaces from Google Fonts. That means Google's servers receive your IP address when a page loads. If you would rather that did not happen, a content blocker will prevent it and the site will simply fall back to the fonts already on your device.
What we do not do
- We do not set advertising or tracking cookies.
- We do not run analytics or behavioural tracking on this site.
- We do not use social media pixels or conversion trackers.
- We do not buy, sell, rent or trade personal information, ever.
- We do not add anyone to a mailing list. There is no mailing list.
4. Why we hold it, and on what basis
We use the information you send us for exactly one purpose: to reply to you and, if it goes further, to discuss and carry out a project. That is it.
| What | Why | Basis |
|---|---|---|
| Name, email, phone | To reply to your enquiry and stay in touch about it | Your request - you asked us to |
| Business, industry, needs, budget, timeline | To give you a useful and accurate answer rather than a generic one | Your request |
| What you wrote in the message | To understand the problem before quoting | Your request |
| Server request records | To deliver the site and defend it against abuse | Our legitimate interest in a working, secure website |
We handle personal information in line with the principles of Sri Lanka's Personal Data Protection Act, No. 9 of 2022 - collecting only what is needed, using it only for the purpose it was given, keeping it no longer than necessary, and giving you access to it on request.
5. Who else sees it
A very short list, and it does not include anybody who wants to sell you something.
| Who | What they see | Why |
|---|---|---|
| Vercel (hosting) | Standard server request records | They serve the website |
| Google Fonts | Your IP address when a page loads | They serve the typefaces |
| Web3Forms (only if enabled) | The contents of a submitted brief, in transit | They deliver it to our inbox |
| Our email provider | Messages you send us | That is where our inbox is |
| WhatsApp (only if you choose it) | The message you send | You chose to send it that way |
Some of these providers operate outside Sri Lanka, which means information may be processed abroad. We will disclose information to a public authority only where we are legally required to, and we will tell you if that ever happens unless we are prohibited from doing so.
6. How long we keep it
Enquiries that do not become projects are kept for up to 24 months, because people often come back a year later and it is useful to remember the earlier conversation. After that they are deleted.
Where an enquiry becomes a project, the correspondence is kept for as long as we work together and for a reasonable period afterwards, so we can support what we built and meet any tax or record-keeping obligations.
You can ask us to delete your information sooner at any time, and we will - unless we are legally required to keep a specific record, in which case we will tell you exactly what and why.
7. Your rights
You can ask us, at any time, to:
- Show you what personal information we hold about you.
- Correct anything that is wrong or out of date.
- Delete it, where we are not legally required to keep it.
- Stop using it for a particular purpose.
- Send you a copy in a portable, readable format.
- Object to how we are handling it, and have a person consider that objection.
Write to and say what you would like. We will reply within 30 days. There is no charge, and you do not need to give a reason for a deletion request.
If you are not satisfied with how we have handled a request, you may raise it with the data protection authority established under the Personal Data Protection Act, No. 9 of 2022. We would appreciate the chance to put it right first.
8. How we protect it
The site is served only over an encrypted connection (HTTPS). Enquiry correspondence sits in an email account protected by a strong, unique password and two-factor authentication. Access is limited to the people who actually need it, which is a very small number.
We will not pretend that any system is perfectly secure, because none is. What we will commit to is this: if a breach occurs that affects your information, we will tell you and the relevant authority promptly and honestly, including what happened and what we are doing about it.
9. Children's information
This site is aimed at businesses and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has sent us information, tell us and we will delete it.
10. Changes to this policy
If we change how we handle information - for example by adding analytics, which we currently do not use - we will update this page and change the date at the top. Material changes will be described plainly rather than buried in a paragraph.
This policy was last updated on 8 September 2026.
Questions about any of this?
Ask us directly. We would far rather answer a question about how we handle your information than have you guess at it.