Who We Are
This Privacy Policy explains how MetaSyntax (Pvt) Ltd. ("MetaSyntax," "we," "us," or "our") collects, uses, shares and protects personal information when you visit metasyntax.io, contact us, or do business with us. MetaSyntax is the controller of the personal information described in this policy.
- Company: MetaSyntax (Pvt) Ltd., incorporated in Sri Lanka
- Address: Periyakallar, Batticaloa, Sri Lanka
- Privacy contact: hello@metasyntax.io
Privacy at a glance
- We collect only what you choose to send us through our forms or by email, plus the basic technical data every website receives.
- We use it to reply to you, to provide our services, and to keep the website secure.
- We do not sell personal information, use it for advertising, or use cookies on this website.
- You can ask us to access, correct, or delete your information at any time.
This policy does not cover personal information we process on behalf of our clients inside the systems we build or support for them. For that information, see Client Data in Our Projects.
Information We Collect
Information you give us
- Project request form ("Let's Talk"): your name, email address, the service area you're interested in, and any project details you choose to include.
- "Ask Us Anything" form: an inquiry category, your message, and your WhatsApp phone number (with country code).
- "Don't see your problem?" form: your email address and a short description of your problem.
- Direct communication: anything you send us by email, WhatsApp, or phone, including your name, company, job title, and the content of your messages.
- Clients and prospective clients: business contact details, billing information, and the information needed to scope, contract, and deliver our services.
Please don't send us sensitive personal information (such as health, financial account, or identity document details) through our website forms. If a project requires it, we'll agree a secure way to handle it.
Information collected automatically
Like any website, our servers and hosting provider receive technical information when your browser requests a page or submits a form:
- IP address
- Browser and device type, operating system, and language
- Pages requested, date and time of the request, and the referring page
We use this information to deliver the website, keep it secure, and prevent abuse. For example, form submissions are rate-limited by IP address to stop spam. We do not use analytics, advertising, or tracking tools on this website.
How We Use Your Information
We use personal information only for the purposes below, each with a lawful basis under applicable data protection law:
- To respond to your inquiry or request and to prepare proposals and quotations, based on the steps you ask us to take before entering into a contract, and our legitimate interest in answering business inquiries.
- To provide, manage, and invoice our services, to perform our contract with you or your organization.
- To operate and secure our website, including preventing spam, fraud, and misuse, based on our legitimate interest in keeping our systems safe.
- To send service-related communications about an inquiry or engagement, based on our contract or legitimate interests.
- To comply with legal obligations, such as tax, accounting, and record-keeping requirements, and lawful requests from authorities.
- To establish, exercise, or defend legal claims, based on our legitimate interests.
We will not send you marketing emails unless you have asked to receive them, and you can opt out at any time. Where we rely on your consent, you may withdraw it at any time without affecting processing that has already taken place.
AI & Automated Decision-Making
Submissions from our website are delivered to and read by our team. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, and we do not use the personal information you send through our website to train artificial intelligence models.
The "Pick a problem like yours" section of our homepage shows pre-written example scenarios. It does not analyze or store what you type.
Where we use AI tools in delivering client projects, we do so under human review and the confidentiality and data protection terms agreed with that client.
Client Data in Our Projects
When we build, integrate, or support systems for a client, we may process personal information held in those systems (for example, a client's customer or employee records). In that role, the client is the controller and MetaSyntax acts as a processor or service provider on the client's behalf.
We process that information only on the client's documented instructions and under the confidentiality, security, and data processing terms in our agreement with that client, including a data processing agreement where required. Questions about that information should be directed to the client that controls it.
International Data Transfers
We are based in Sri Lanka, and some of our service providers (including Resend) process data in the United States and other countries. Those countries may have different data protection laws from your own.
Where we transfer personal information across borders, we do so as permitted by the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka and, where it applies, the EU/UK General Data Protection Regulation, for example by relying on the provider's standard contractual clauses or other recognized safeguards.
Data Retention
We keep personal information only for as long as we need it:
- Inquiries that don't lead to an engagement: up to 24 months after our last contact, so we have context if you get in touch again. You can ask us to delete them sooner.
- Client and contract records: for the duration of the engagement and afterwards for as long as required by applicable tax, accounting, and company laws, or as needed to resolve disputes.
- Rate-limiting data (IP addresses): held in memory for up to 15 minutes and not stored.
- Server and security logs: kept for a limited period, typically no longer than 90 days, unless needed to investigate a security incident.
When information is no longer needed, we securely delete or anonymize it.
Your Privacy Rights
Depending on where you live (including under Sri Lanka's Personal Data Protection Act and, where it applies, the GDPR), you have the right to:
- Access the personal information we hold about you and receive a copy of it
- Correct inaccurate or incomplete information
- Request deletion of your information
- Object to, or ask us to restrict, certain processing
- Withdraw consent where our processing is based on consent
- Receive your information in a portable format, where applicable
- Not be subject to decisions based solely on automated processing that significantly affect you
To exercise any of these rights, email hello@metasyntax.io with the subject line "Privacy request." We may need to verify your identity before acting on your request. We respond within the time required by applicable law and in any event within one month, and we don't charge a fee for reasonable requests.
If you're not satisfied with our response, you may complain to the Data Protection Authority of Sri Lanka, or to the data protection authority in the country where you live or work.
Data Security
We use reasonable technical and organizational measures to protect personal information against unauthorized access, loss, alteration, or disclosure. These include encrypted (HTTPS) connections, access limited to people who need it, spam and abuse protection on our forms, and careful selection of service providers.
No method of transmitting or storing information electronically is completely secure, so we cannot guarantee absolute security. If a data breach affects your personal information, we will notify you and the relevant authorities where the law requires us to.
Children's Privacy
Our website and services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child has sent us personal information, please contact us and we will delete it.
Links to Other Websites
Our website may link to or mention third-party websites and products. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.
Changes to This Policy
We may update this Privacy Policy to reflect changes to our services, technologies, legal requirements, or business practices. We will post the updated version on this page with a new "Last Updated" date and, for significant changes, provide additional notice where appropriate.
This policy should be read together with our Terms of Service.