Privacy Policy

GRAVTY ("we", "us", "our") is committed to protecting the privacy and security of our clients' personal information. This Privacy Policy explains how we collect, use, and safeguard your information when you visit gravty.lk, submit a project request, or use our client portal to manage quotations, agreements, and payments. By using our website or platform, you consent to the practices described in this policy.

Information We Collect

When you interact with our website or client portal, we may collect:

• Personal identification information — your name, email address, phone number, and company name — provided when you submit a project request or create a client account.
• Project information — details about your project requirements, budget range, and any files or briefs you share with us to prepare a quotation.
• Payment and billing information necessary to process invoices, including transactions made via PayHere or bank transfer. Card details are handled entirely by PayHere, a licensed and PCI-DSS compliant payment gateway — we never see or store your full card number.
• Authentication data — your mobile number, used to send one-time passcodes (OTPs) for secure login to your client account.
• Browsing information, such as your IP address, browser type, and device information, collected automatically using cookies and similar technologies.

Use of Information

We use the information we collect to:

• Prepare and send you accurate quotations, invoices, and project agreements.
• Verify your identity and secure your client account through OTP authentication.
• Process payments and payment confirmations through PayHere or verify bank transfer proofs you submit.
• Communicate with you about your project's progress, milestones, and support requests.
• Improve our website, services, and client portal based on feedback and usage patterns.
• Detect and prevent fraud or unauthorized use of our platform.

Information Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties, except in the following circumstances:

• Trusted service providers — we share necessary information with providers who help us operate our platform, including PayHere (payment processing), Cloudflare R2 (secure document and file storage), Resend (transactional email), and our SMS provider (OTP delivery). These providers are contractually obligated to handle your data securely and only for the purpose we specify.
• Legal requirements — we may disclose your information if required to do so by law, regulation, or a valid legal request from a Sri Lankan or foreign authority.

Data Security

We implement industry-standard security measures to protect your personal information, including hashed passwords and OTP codes, encrypted connections (HTTPS), and access controls limiting who on our team can view client data. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

Cookies and Tracking Technologies

We use cookies and similar technologies to keep you signed in to your client account, remember your preferences (such as light or dark mode), and understand how visitors use our website. You can disable cookies through your browser settings, but this may limit certain features, such as staying logged in to the client portal.

Data Retention

We retain project, quotation, agreement, and payment records for as long as necessary to fulfil the purposes described in this policy, and as required to meet our legal, accounting, and tax obligations under Sri Lankan law.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised "last updated" date. We encourage you to review this policy periodically to stay informed about how we collect, use, and protect your information.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal information, please contact us at hello@gravty.lk.