What we collect and why

The Teaholic is an independent software studio based in Kandy, Sri Lanka. We control the personal information described in this policy. For privacy questions or requests, write to hello@theteaholic.com.

This policy covers the website at theteaholic.com, project enquiries, and information we hold during a client relationship.

The Teaholic also develops and operates its own software products. A product that collects personal information will provide its own privacy notice. That notice governs the product and should be read alongside this policy where both apply.

When you submit the contact form, we receive:

• Your name and email address.
• Your company, budget range, ideal timeline, and existing website or product, if you choose to provide them.
• What you want to build and the problem you are trying to solve.

If you contact us another way, we keep the message and the information you include. If we work together, we also keep proposals, agreements, billing records, project files, meeting notes, and correspondence created during the engagement.

Our hosting provider may record limited technical information when you use the site, such as your IP address, request time, requested page, and browser information. The contact form also sends your IP address and browser signals to Cloudflare Turnstile for an anti-bot check. We do not use this data to build advertising profiles or track you across websites.

We do not run analytics, advertising, session recording, or fingerprinting on this site. We do not buy or enrich contact data from third parties.

We use personal information to:

• Review and respond to enquiries.
• Prepare a proposal and take steps towards an agreement you request.
• Deliver client work, communicate about it, and manage the relationship.
• Operate, secure, troubleshoot, and prevent abuse of this site.
• Keep records required for tax, accounting, dispute resolution, and other legal obligations.

Depending on the circumstances, we rely on our legitimate interests in responding to you and protecting the site, steps taken at your request before a contract, performance of a contract, compliance with legal obligations, or consent where the law requires it.

We do not add enquiries to a marketing list. There is currently no newsletter or mailing list.

We use a small number of providers to run the site and handle enquiries:

• Resend sends the enquiry to our inbox and the acknowledgement to yours. The contact-form content passes through Resend.
• Cloudflare Turnstile checks contact submissions for automated abuse. It receives the Turnstile token, IP address, and browser signals needed to perform the check.
• Our website hosting provider processes requests and keeps server and security logs.
• Our email provider stores messages delivered to and sent from the studio inbox.

Professional advisers may receive information when we need legal, accounting, or insurance advice. Trusted collaborators may receive project information when their work requires it. We limit access to what is needed and use confidentiality or contractual protections where appropriate.

We may disclose information when the law requires it, or when necessary to protect our rights, users, or systems. We do not sell personal information.

Some providers operate in more than one country. Personal information may therefore be processed outside Sri Lanka or the country where you live. We take the steps required by applicable law, which may include contractual or other recognised safeguards for those transfers.

This site does not use analytics, advertising, or preference cookies. Cloudflare Turnstile may store a short-lived cookie or similar browser data on the contact page when needed for its security check. We do not use that data for advertising or cross-site tracking.

We delete enquiries that do not become client work when the conversation has ended, and no later than two years after the last contact. We keep project, contract, and billing records for the engagement and for any longer period required by tax, accounting, or other applicable law.

Hosting, security, and email providers keep technical logs and backups according to their own retention schedules. Copies scheduled for deletion may remain in backups until the normal backup cycle replaces them.

Depending on the law that applies, you may ask us to access, correct, delete, or restrict our use of your personal information. You may also object to processing, ask for a portable copy, or withdraw consent where we rely on it. Withdrawal does not make earlier processing unlawful.

Email hello@theteaholic.com. We may ask for enough information to confirm your identity and locate the relevant records. We will respond without undue delay and normally within one month. If a lawful extension is needed, we will explain why. You may also complain to the Data Protection Authority of Sri Lanka or the data protection authority where you live.

We use HTTPS, anti-bot protection, access controls, and multi-factor authentication where available. We limit access to personal information to people who need it for their work. No system can guarantee complete security. If a breach affects your information, we will notify you and the relevant authority when the law requires it.

This is a business website and is not directed at children. We do not knowingly collect information from anyone under 16 through this site.

We will update the date at the top when this policy changes. If a change materially affects how we use personal information, we will provide a clear notice where practical. Questions go to hello@theteaholic.com.