Privacy policy

What data do we collect?

Only what you give us and what the site needs to run.

• Contact form: your name, email address, business name, the services you are interested in, your timeline, your message, and optionally your WhatsApp number and current website
• AI visibility check form: your business name, website, industry and email address
• WhatsApp and email: whatever you send us directly, held in those services
• Analytics: pages viewed, approximate location (city level), device and browser type, how you arrived, and interactions such as form submissions, WhatsApp clicks, phone taps and scroll depth. Google Analytics 4 does not log or store IP addresses
• Technical logs: our hosting provider records requests to the site, including IP address, for security and reliability

Why do we collect it?

To reply to you, to deliver what you asked for, and to understand whether the website is working.

• Form data: to answer your enquiry, send a quote, or run and return your AI visibility check. Legal basis: taking steps at your request before entering a contract, and our legitimate interest in responding to enquiries
• Analytics: to see which pages people use and whether enquiries are coming through, so we can improve the site. Legal basis: your consent, given through the cookie notice
• Technical logs: to keep the site secure and available. Legal basis: legitimate interest

Do we use cookies?

Yes, and only after you agree. The site sets no analytics cookies until you accept the cookie notice. Before that, Google Analytics runs in a consent-denied mode that sends cookieless, aggregated pings only.

The site also stores two preferences in your browser's local storage, which are not cookies and are never sent to us: your light or dark theme choice, and your cookie notice choice. You can clear both from your browser settings.

• _ga: Google Analytics, distinguishes visitors, expires after 2 years
• _ga_[container id]: Google Analytics, keeps session state, expires after 2 years

Who do we share data with?

Three service providers, each processing data on our behalf, and nobody else. We do not sell personal data.

• Vercel Inc.: hosts the website and processes request logs. Servers are located globally with data processed in the United States and the European Union
• Resend Inc.: delivers form submissions to our inbox as email. Processed in the United States
• Google LLC: Google Analytics 4 and Google Search Console. Processed in the United States. Google's own privacy policy applies to its processing

How long do we keep it?

Enquiries and AI visibility check requests are kept in our email for as long as needed to respond and, if you become a client, for the duration of our work together and up to 7 years afterwards for accounting and legal purposes. If you do not become a client, we delete the enquiry within 12 months of our last contact.

Google Analytics data is retained for 14 months, the longest standard setting, then deleted automatically. Hosting logs are retained by Vercel according to its own retention policy.

What are your rights?

You can ask us what personal data we hold about you, ask for it to be corrected or deleted, ask us to stop using it, or ask for a copy. Email info@ccinocode.com and we respond within 30 days. If you are in the European Economic Area or the United Kingdom you also have the right to complain to your local data protection authority. Sri Lanka's Personal Data Protection Act No. 9 of 2022 applies to our processing of data about people in Sri Lanka.

How do we protect it?

The site is served over HTTPS. Form submissions are validated, rate limited and protected against automated abuse. Email and hosting accounts are protected by two-factor authentication. Only the partners of CcinoCode have access to enquiries.

Children

The site is aimed at businesses. We do not knowingly collect data from anyone under 18. If you believe a child has sent us data, contact us and we delete it.

Changes to this policy

When the policy changes, the effective date at the top is updated. Significant changes are noted on this page for 30 days.