Privacy policy

Who we are

Webloom Labs is the trading name of WEBLOOM LABS (PVT) LTD, a private limited company incorporated in Sri Lanka on 18 August 2026 under the Companies Act No. 7 of 2007, company number PV 00371368.

You can reach us at info@webloomlabs.net about anything on this page.

What this policy covers

This policy covers personal data we handle through this website. Work we do for clients under a signed proposal or agreement is governed by that agreement, which takes precedence where the two differ.

What we collect

Only what you choose to send us, plus the technical records any website keeps in order to run.

• Enquiry form — your name, email address, and optionally your company, the type of project, a budget range, a timeline, and whatever you write in the project details field.
• Project form — your name, email address, the type of project, the stage it is at, a budget range, a timeline, and your description of it; and optionally your company, its website, and a phone number with whether it is on WhatsApp.
• Email — if you write to us directly, we hold that correspondence.
• Server logs — our hosting provider records IP addresses, browser user agents, requested pages, and timestamps as part of serving and securing the site.
• Analytics — how you move through the site: pages viewed, referring site, approximate location derived from your IP address, device and browser, and a recording of your session as described below.

We do not run accounts, and we never ask for payment details through this website.

Cookies and analytics

We use Google Tag Manager to load two analytics tools on this site. Both set cookies in your browser and both send data outside Sri Lanka.

• Google Analytics 4 tells us which pages people read, how they arrived, and roughly where in the world they are. It sets cookies to recognise a returning browser and to group page views into a visit.
• Microsoft Clarity records your session — the pages you view, and your mouse movement, clicks, scrolling, and typing behaviour — and replays it as an anonymised recording, plus aggregate heatmaps. It masks the text you type into form fields by default, so we see that a field was filled in, not what you put in it.

We use these to find out which parts of the site are read and which are ignored, and where people get stuck. Advertising is covered separately below.

We should be straight with you about one thing, though. Both tools belong to advertising companies, and both reach their parent's infrastructure as they load — Google Analytics contacts a Google advertising domain, and Clarity, which is a Microsoft Advertising product, sets a Microsoft user identifier. That happens by default in the products themselves, not because we have asked for it. If you would rather it did not happen at all, block the cookies as described below.

In practice the cookies you will see are Google's _ga pair, Clarity's _clck and _clsk, and Microsoft's CLID and MUID identifiers.

Session recording is more intrusive than page counting, and you are entitled to say no. You can opt out with Google's Analytics Opt-out Browser Add-on, through Microsoft Clarity's own opt-out, or by blocking these cookies in your browser or with a content blocker. The site works normally either way.

The Studio at /studio is internal and is not tracked.

Advertising and remarketing

We are not running advertising or remarketing campaigns at the moment. No advertising or remarketing tag is loaded on this site today, and we are not building audiences from your visit.

We expect that to change. As the studio grows we are likely to advertise, and that may include remarketing — showing our ads to people who have already visited this site — on platforms such as Google Ads, Microsoft Advertising, Meta, or LinkedIn. Doing that means an advertising tag setting its own cookies here and matching your visit to a profile the platform already holds.

We are telling you now so that it is not a surprise later, but we are not treating this paragraph as your permission. Before any advertising or remarketing tag goes live we will update this page to name the platforms and say what they receive, move the date at the top, and — where the law requires consent for that kind of tracking, as it does across the EEA and the UK — ask you first rather than switching it on quietly.

Whatever we do here, we will not sell your personal data, and an enquiry you send us will not be handed to an advertising platform.

Why we use it, and on what basis

• To reply to your enquiry and, if it goes further, to scope and quote the work — this is processing at your request, ahead of any contract.
• To keep a record of enquiries and correspondence, which is our legitimate interest in running and defending the business.
• To keep the site available and secure, which is our legitimate interest and the reason server logs exist.
• To understand how the site is used and improve it, which is our legitimate interest — and, where the law requires consent for analytics cookies, on the basis of that consent.
• If we advertise or remarket in future, that will rely on your consent wherever consent is required, and never on legitimate interests alone.

We will not add you to a marketing list from an enquiry unless you ask us to, and we never sell your personal data.

Who else sees it

A small number of service providers process data on our behalf, under contract and only on our instructions: our hosting and infrastructure providers, our email provider, and — for the analytics described above — Google and Microsoft. If we start advertising, the platforms we use will be named here before they are switched on. We do not sell your details, and we do not share them with anyone else unless you ask us to, or unless we are legally required to.

Where it is held

We are based in Sri Lanka, and the providers we use operate infrastructure in several countries. Your data may therefore be stored or processed outside your own country, including outside Sri Lanka and outside the European Economic Area. Analytics data in particular is processed by Google and Microsoft on infrastructure that includes the United States.

How long we keep it

Enquiries that do not turn into projects are deleted within 24 months. Where an enquiry becomes a project, the records are kept for as long as the working relationship lasts and afterwards for as long as we need them for tax, accounting, and legal purposes. Server logs are kept for a short period by our hosting provider and then rotated out.

You can ask us to delete your enquiry sooner, and we will unless we are required to keep it.

Your rights

You can ask us to show you what we hold about you, correct it if it is wrong, delete it, or stop using it. You can object to processing we do on the basis of legitimate interests, and withdraw any consent you have given at any time.

In Sri Lanka these rights sit under the Personal Data Protection Act No. 9 of 2022. If you are in the European Economic Area or the United Kingdom, the equivalent rights under the GDPR apply to you and we will honour them.

Email info@webloomlabs.net and we will respond within 30 days. If you are not satisfied with our answer, you are entitled to complain to your data protection authority.

Security

The site is served over HTTPS, and access to enquiry data is limited to the people who need it. No system is perfectly secure, and we will not pretend otherwise — but if a breach affects your data and puts you at risk, we will tell you.

Children

This site sells business services and is not directed at children. We do not knowingly collect data from anyone under 18.

Changes to this policy

If we change how we handle personal data, we will update this page and move the date at the top. Material changes will be described rather than slipped in quietly.