What happens to your data.
Last updated 23 October 2026. Written plainly, because a security consultant should practise what he advises.
Who is responsible
This site is operated by Ravindu Fernando, Colombo, Sri Lanka. Enquiries marked for Innov8 are shared with Innov8 (Pvt) Ltd so its Application Security Business Unit can respond.
What is collected
- Enquiry forms: name, work email, organisation, role, country, phone (optional), what you need, timeline and your message.
- Maturity scorecard: answers are scored in your browser. If you request the full report, your name, email, organisation and scores are stored.
- Technical data: the page you submitted from, the referrer and a one-way hash of your IP address, used only to block spam and abuse.
- Sound preference: stored in your own browser, never sent anywhere.
This site sets no advertising or tracking cookies.
Why, and on what basis
To reply to your enquiry and, if you asked for it, send your scorecard report. The basis is your consent, given with the checkbox on each form. You are not added to any mailing list without a separate opt-in.
Where it is stored
Submissions are stored in a Cloudflare D1 database and, where email delivery is enabled, forwarded by a form-delivery service to the relevant inbox. Data is kept for up to 24 months after our last contact, then deleted.
Your rights
You can ask to see, correct or delete your data at any time, including under Sri Lanka's Personal Data Protection Act, No. 9 of 2022, and the GDPR where it applies. Contact [email].
Security
The site is served over HTTPS with a strict content security policy and security headers. Form endpoints are origin-checked and rate-limited, and access to stored submissions is restricted to the site owner.