Lexiata Studio

Privacy Policy

Last updated: 27 October 2026

1Who we are

Lexiata Studio (lexiatastudio.com) is the software and product studio of Lexiata.lk, a web design and development agency in Ratnapura, Sri Lanka. In this policy, “we”, “us” and “our” mean Lexiata.lk. We decide how your personal information is used, so we are the “controller” of it under Sri Lanka’s Personal Data Protection Act, No. 9 of 2022.

This policy covers the lexiatastudio.com website, your Lexiata Studio account, licences, purchases, our e-mails and our support. Each app can also have its own privacy policy that explains what happens inside the app — for example the LexiCapture Privacy Policy. When you use an app, both policies apply.

2Information we collect

When you create an account

• Your name and e-mail address.
• Your password — stored only in a one-way scrambled (hashed) form, so nobody at Lexiata Studio can read it.
• The date you signed up, and whether you joined during our launch (founding user).
• Whether you have confirmed your e-mail address. We send a confirmation link when you sign up with a password.

When you sign in with Google or Facebook

This is optional — you can always use your e-mail address and a password instead. If you choose it:

• From Google we receive your name, your e-mail address, whether Google has verified that address, and your Google account ID (a number). For Google Workspace accounts we also see your organisation’s domain, which we use only to check the address.
• From Facebook we receive your name, your e-mail address and the ID that Facebook gives you for our website.
• We keep your name, your e-mail address, the Google or Facebook account ID (so we can find your account next time), and which one you used last.
• We do not receive your Google or Facebook password. We do not ask for your contacts, friends, photos or posts, we do not store your profile photo, and we never post anything for you.
• Google and Facebook give us a short-lived key to read these details once. We use it at that moment and do not keep it.
• You can disconnect Google or Facebook any time under Sign-in methods on your account page. See also Deleting your data.

Your licences and the computers or websites you use them on

• Your plans, licence keys, their status, start, end and renewal dates, and whether auto-renew is on.
• For each computer or website where you sign in or activate a licence: its name or address, a one-way scrambled id (not a hardware serial number), the system type, the product version, and when it last checked in. Its IP address is kept only in a one-way scrambled (hashed) form.

When you buy a plan

• The plan, price, currency, order number, payment method and the payment reference from the payment provider.
• Your mobile number, when the payment method you choose needs it.
• If you pay by bank transfer: the reference number and the photo or PDF of the payment slip you upload. Slips are kept in a private folder that is not public on the internet.
• Card and bank details are entered on the payment provider’s own page. We never see or store your full card number.

When you join our “Get notified” list

• Your e-mail address. We use it only to tell you about new Lexiata Studio products and important updates.

When you contact us

• What you write to us by e-mail, WhatsApp or a form, and your contact details.
• Problem reports that you choose to send from an app. The app shows what a report contains before you send it — see the app’s privacy policy.

Anonymous app usage counts

• Some apps, like LexiCapture, send one anonymous count a day (a random install number, the app and Windows version and a country code — never your name, e-mail or files). You can turn it off in the app. The app’s privacy policy explains it in full.

Collected automatically when you visit the website

• Server and security logs: like every website, our web host and our security network (Cloudflare) record IP addresses, browser type and the pages requested, for a short time, to keep the site running and safe.
• Abuse protection: to stop spam and attacks, we count sign-ups, sign-ins and requests per IP address. We store the IP address only in a one-way scrambled (hashed) form. We may also use Cloudflare Turnstile, a privacy-friendly check that you are not a robot.
• Google Analytics: see Cookies and analytics.

3Cookies and analytics

Cookies are small files that a website stores in your browser. We use:

To stop Google Analytics, you can block cookies in your browser settings or install Google’s Google Analytics opt-out add-on. Learn how Google uses this information in How Google uses information from sites that use its services.

We do not use advertising or retargeting cookies. If we add them in the future, we will update this policy first.

4How we use your information

We do not sell or rent your personal information, we do not use it to show ads, and we do not make decisions about you that are based only on automated processing.

Our use of information we receive from Google follows the Google API Services User Data Policy, including its Limited Use requirements: we use it only to sign you in and run your account, and we never sell it or use it for ads.

5Who we share it with

We share personal information only with companies that help us run Lexiata Studio, and only what they need for that job:

• Web hosting — the servers that run lexiatastudio.com and store its data.
• Cloudflare — security and fast delivery of the website.
• Google — Google Analytics (website statistics), and Google sign-in if you choose it.
• Meta (Facebook) — Facebook sign-in, only if you choose it.
• GitHub — hosts our app downloads and updates, and some sound effects and other files the apps download from our library. When you download an app, or an app checks for updates or downloads a library file, GitHub receives your IP address.
• Payment providers — such as PayHere and Dialog Genie, and your bank when you pay by bank transfer. They handle your payment under their own privacy policies.
• E-mail delivery — the service that sends our e-mails.

When you sign in with Google or Facebook, that company knows that you signed in to Lexiata Studio, under its own privacy policy. We do not send them anything else about you.

We may also share information when the law requires it, to protect our rights or the safety of others, or if Lexiata Studio is ever sold or merged — in that case we will tell you first.

6Information stored outside Sri Lanka

Some of the companies above (for example Google, Meta, Cloudflare and GitHub) process information on servers outside Sri Lanka. We use well-known providers that protect personal information with strong security and contracts, and we transfer information only as the Personal Data Protection Act allows.

7How long we keep it

8How we protect it

We use HTTPS on the whole website, store passwords and IP addresses only in scrambled (hashed) form, keep payment slips in a private folder, sign licence data so it cannot be faked, and limit who can access our systems. If someone signs up with your e-mail address, the person who really owns the address can take the account back — through the confirmation link, or with “Forgot your password?” — and every earlier sign-in on that account ends. No system is 100% secure, but we work hard to protect your information. If a data breach could affect you, we will tell you and the Data Protection Authority as the law requires.

9Your rights

Under Sri Lanka’s Personal Data Protection Act you can:

• ask what personal information we have about you, and get a copy of it;
• ask us to correct or complete it;
• ask us to delete it — including your whole account;
• withdraw your consent, for example to leave the “Get notified” list;
• ask us to stop or limit using it, or object to how we use it;
• complain to the Data Protection Authority of Sri Lanka.

To use any of these rights, e-mail us from the address on your account (or tell us how we can confirm who you are). We will reply as soon as we can, and within the time the law allows. You can also remove computers and websites, and turn off auto-renew, yourself on your account page.

10Deleting your data

You can remove your information in these ways:

• Disconnect Google or Facebook: on your account page, under Sign-in methods, choose Disconnect. We delete the link to that Google or Facebook account at once. Your Lexiata Studio account stays, and you can still sign in with your e-mail address (if you never set a password, choose “Forgot your password?” once to make one).
• Remove Lexiata Studio from Google or Facebook: in your Google Account (how to stop using Sign in with Google for an app), or in Facebook → Settings and privacy → Settings → Apps and websites. This stops Google or Facebook from sharing your details with us again. To delete what we already have, also ask us as below.
• Delete your whole account: e-mail [email protected] from the address on your account and write “Delete my account”. We delete your account and the information connected to it within 30 days, and confirm by e-mail. We keep only the order and payment records that tax and accounting laws require (see How long we keep it).

11Children

Lexiata Studio accounts and purchases are for people aged 18 or over. If you are under 18, please ask a parent or guardian to create the account or to give you permission first. We do not knowingly collect personal information from children without that permission — if you think we have, contact us and we will delete it.

12Changes to this policy

If we change this policy, we will update the date at the top of this page. If a change is important, we will also tell you by e-mail or with a notice on the website before it applies.