Legal

Privacy Policy

How CrysoLabs Tech Solutions collects, uses, and protects personal data across our website, client portal, and engagements.

Last updated: March 2026

1. Scope of this policy

This Privacy Policy describes how CrysoLabs Tech Solutions ("CrysoLabs", "we", "us") collects, uses, and protects personal data when you interact with our website, client portal, or engagement process.

It applies to visitors to crysolabs.com, users of the CrysoLabs Client Portal, prospective clients who contact us or submit a project brief, and current or former clients working with the studio under a signed agreement.

2. Information we collect

Identity and contact details you provide (name, company, email, phone, role).
Project brief information you submit (project type, budget range, timeline, summary, references).
Client Portal account data (email, hashed password, session and authentication metadata).
Project and billing data (scope documents, milestones, approvals, invoices).
Payment metadata from our payment processors (Paddle, Stripe) — we do not store full card numbers.
Basic website analytics (aggregated page views, referrers, device type) with privacy-respecting tooling.
Communications you send us by email, contact form, or portal message.

3. How we use your information

Respond to enquiries, review project briefs, and provide quotes.
Deliver services under a signed engagement and manage milestones and payments.
Operate and secure the Client Portal, including authentication and fraud prevention.
Send service-related notifications (contract updates, milestone approvals, invoices).
Improve our website, offerings, and engagement process using aggregated analytics.
Comply with legal, tax, and accounting obligations.

4. Legal bases

Where applicable, we rely on the following lawful bases: performance of a contract (to provide services you have engaged us for), legitimate interests (to operate, secure, and improve our studio and website), consent (for optional communications), and legal obligation (to meet tax and accounting duties).

5. Retention

We keep personal data only as long as it is needed for the purpose it was collected, or as required by law. Client Portal accounts are retained while the engagement is active; project and billing records are typically retained for 7 years for tax and accounting compliance. You can request deletion of personal data that is not required by law to be retained.

6. Sharing with third parties

Payment processors (Paddle, Stripe) — to process deposits, milestones, and subscriptions.
Infrastructure providers (Supabase, Vercel, and similar) — to host the Client Portal and websites.
Email and communication providers — to deliver transactional messages.
Accountants and legal advisors — where required to meet our obligations.
We never sell personal data, and we never share client information with advertisers or data brokers.

7. Cookies and analytics

Our website uses a small number of cookies or similar technologies for essential functionality (session, security) and privacy-respecting analytics. We do not use cross-site advertising trackers. Where required by law, we ask for consent before setting non-essential cookies.

8. Security

We apply standard security practices including encrypted transport (HTTPS), hashed password storage, role-based access to internal systems, and principle-of-least-privilege access for team members. No system is perfectly secure — if you suspect an issue, please contact us immediately at the address below.

9. International processing

CrysoLabs is based in Sri Lanka and works with clients globally. Your personal data may be processed in other jurisdictions by us or our service providers. We take reasonable steps to ensure it remains protected to a similar standard wherever it is processed.

10. Your rights

Access the personal data we hold about you.
Request correction or update of inaccurate information.
Request deletion, subject to legal and contractual retention requirements.
Object to or restrict certain uses of your personal data.
Withdraw consent at any time where processing is based on consent.
Lodge a complaint with the data protection authority in your jurisdiction.

11. Children

Our services are intended for businesses and professionals. We do not knowingly collect personal data from children. If you believe a child has provided us information, please contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected on this page with a new "last updated" date. Continued use of our website, Client Portal, or services after an update constitutes acceptance of the revised policy.

Contact

For privacy-related requests or questions (including access, correction, and deletion requests), please contact us at:

[email protected]

[email protected](general enquiries)