Privacy Policy | Lakshan Weerasingha

This policy explains what information lakshanweerasinghe.com ("this site", "I", "me") collects when you visit, how it's used, and the choices you have — in plain language, and matched to what is actually implemented on this site rather than boilerplate legal text.

1. Who runs this site

This site is operated by Lakshan Weerasingha, based in Colombo, Sri Lanka. For any privacy question or request, contact hello@lakshanweerasinghe.com.

2. Information I collect

Information you provide directly — when you use the contact form:

Name, email address, company (optional), enquiry type, and your message
Which page or button you contacted me through (e.g. a specific service or project), so I can reply with relevant context

Information collected automatically:

Your IP address, held briefly in server memory to prevent spam submissions (rate limiting) — it is not stored in the database or linked to your message
Standard technical data (browser type, device, approximate location) via analytics, only if you accept analytics cookies

I do not require account creation, and there is no newsletter or marketing email list on this site.

3. How I use this information, and why

Purpose	Legal basis
Responding to your contact form message or call booking	Necessary to take steps you requested, prior to any engagement
Preventing spam and abuse of the contact form	Legitimate interest in keeping the site secure and usable
Understanding site traffic (Google Analytics)	Your consent, given via the cookie banner
Aggregated page-view counts (Vercel Web Analytics)	Legitimate interest — no personal data or cookies are involved

I never sell your information, and I don't share it for third-party marketing.

4. Cookies and similar technologies

Google Analytics is configured with Google Consent Mode and defaults to denied — it does not set cookies or track you until you click “Accept All” in the cookie banner. The live chat widget (Tawk.to) is treated as an essential communication tool rather than an analytics cookie, so it loads regardless of that choice — you only need to use it if you want to start a conversation.

Cookie / storage	Type	Purpose	Duration
`gdpr-consent`	Essential (browser storage)	Remembers whether you've accepted or declined analytics cookies.	Until you clear your browser storage
`_ga, _ga_*`	Analytics (Google Analytics 4)	Distinguishes visitors and sessions to measure traffic and popular pages.	Up to 2 years — only set if you accept analytics cookies
`cf_clearance / __cf_bm`	Essential (Cloudflare Turnstile)	Verifies the contact form is being submitted by a human, not a bot.	Session to 30 minutes
`TawkConnectionTime, twk_*`	Functional (Tawk.to live chat)	Keeps your chat session connected and remembers the conversation if you reopen the widget.	Session to 1 year

You can change your choice at any time using the “Cookie Preferences” link in the footer, or by clearing cookies and local storage in your browser.

5. Third-party services I use

This site is built on a small number of infrastructure and communication providers. Each processes data under its own privacy policy, linked below.

Service	What it does here
Supabase	Database and image storage for site content and contact form submissions.
Vercel	Website hosting and infrastructure.
Vercel Web Analytics	Cookieless, aggregated page-view analytics. Does not use cookies or store personal identifiers, so it runs regardless of your cookie choice below.
Google Analytics	Traffic and behaviour analytics — only runs if you accept analytics cookies.
Cloudflare Turnstile	Spam and bot protection on the contact form.
Resend	Delivers contact form submissions to my inbox by email.
Cal.com	Powers the optional call-booking link on the Contact page. Cal.com is a separate service with its own privacy policy — I only receive the booking details you choose to share.
Tawk.to	Powers the live chat widget. If you start a conversation, your messages and the information you provide are visible to me. Runs on every page as a functional communication tool, independent of the analytics cookie choice below.

6. International data transfers

Because these providers operate global infrastructure, your data may be processed in countries outside your own — including the United States and the European Union. Each provider listed above maintains its own safeguards (such as EU Standard Contractual Clauses) for these transfers; see their linked policies for specifics.

7. How long I keep your data

Contact form messages are kept for as long as needed to respond to you and for a reasonable follow-up period, and are deleted sooner on request. Analytics data (when you've consented) is retained by Google under its own default retention window.

8. Your privacy rights

Depending on where you live, you may have some or all of the following rights over your personal data. This site aims to honour these regardless of your location, in line with frameworks including the EU/UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), Australia's Privacy Act, Singapore's PDPA, and South Africa's POPIA:

Access — ask what data I hold about you
Correction — ask me to fix inaccurate data
Deletion — ask me to delete your data
Objection / opt-out — object to a specific use, or withdraw analytics consent at any time
Portability — request a copy of your data in a portable format

To exercise any of these, email hello@lakshanweerasinghe.com. I do not sell personal information, so there is nothing to opt out of a “sale” of under CCPA/CPRA.

9. Children's privacy

This site is intended for a professional, adult audience (recruiters, hiring managers, and business clients) and is not directed at children. I do not knowingly collect data from anyone under 16.

10. Changes to this policy

If the tools or services this site uses change, I'll update this page and the “Last updated” date above. Significant changes affecting how your data is handled will be reflected here before they take effect.

11. Contact

Questions about this policy or your data are welcome at hello@lakshanweerasinghe.com.