Privacy Policy.

1. Data collected

The contact form collects your name, email address, optional project type and budget, and message. Chat may collect your messages, a name and email when you request live chat, consent timestamps, chat status, and message timestamps. Google Analytics collects pseudonymous usage and device data to measure public-page visits and engagement.

For security, the service processes request IP addresses through rate limiting and Cloudflare Turnstile. Verification records store a keyed hash of the IP rather than the plain address.

2. How data is used

• Answer portfolio, service, project, availability, and contact questions.
• Deliver contact messages and email verification codes.
• Provide requested live chat and preserve conversation context.
• Prevent spam, credential attacks, automated abuse, and excessive API spending.

3. Storage and retention

Chat records are stored in MongoDB and automatically scheduled for deletion no later than 30 days after creation. MongoDB TTL cleanup runs asynchronously, so physical deletion may occur shortly after the displayed expiry time. Email verification records expire after 10 minutes.

Contact and notification emails are placed in an encrypted delivery outbox. The encrypted message is removed immediately after successful delivery and otherwise expires within seven days. Delivery metadata, without the message body, expires within 30 days. A delivered copy may remain in Suranga's mailbox, the sender's mail system, and Resend under their respective retention settings until separately deleted.

Administrator security actions are recorded in an audit log without message content. Audit records expire after the configured retention period, which defaults to 180 days.

You can export or permanently delete your current chat using the controls inside the chat widget. Suranga can also export or delete a conversation from the protected admin panel.

4. Service providers

• MongoDB: stores portfolio content, encrypted pending emails, audit metadata, and chat records.
• Resend: delivers contact messages, verification codes, and the initial live-chat notification, and reports delivery events through signed webhooks.
• Google Analytics: measures public-page visits and engagement through the Google tag.
• Cloudflare Turnstile: processes browser and request signals to distinguish people from abusive automation.
• OpenAI: processes redacted chat text only after optional AI consent.

No chat or contact data is sent to WhatsApp.

5. Automated assistant

OpenAI processing is optional and is enabled only when you select the AI-consent checkbox. Email addresses and phone-number patterns are redacted before messages are sent. Requests use store: false, disabling Responses API application-state storage. OpenAI may still retain limited abuse-monitoring logs under its API data-control policy unless the API project has approved Zero Data Retention controls.

Messages are screened for unsafe content and subject to per-session and daily usage limits. Automated responses may be incomplete or inaccurate and should not be treated as professional, legal, financial, or security advice.

6. Cookies and security

The site uses an HttpOnly chat-session cookie and, for administrators, an HttpOnly admin-session cookie. Google Analytics may also use measurement cookies or similar identifiers on public pages. The functional cookies are used for requested functionality and are not advertising cookies. Production traffic is protected with HTTPS, restrictive response headers, origin checks, rate limits, and access controls.

Where local law requires consent before analytics storage, an appropriate consent mechanism must be enabled before deploying Google Analytics to those visitors.

7. Your choices

You may decline AI processing and continue using local portfolio answers or the contact form. You may export or delete the current chat from the widget. To request access, correction, or deletion of other information, email hello@surangasandaruwan.com. Identity verification may be required before acting on a request.

8. Transfers, children, and changes

Service providers may process data outside Sri Lanka, including in the United States. This portfolio is intended for professional enquiries and is not directed to children. Material policy changes will be posted on this page with a revised effective date.

Provider details are available from the Google privacy policy, OpenAI API data controls, Resend privacy policy, Cloudflare Turnstile documentation, and MongoDB privacy policy.