Privacy Policy

1. Introduction and Scope

Fontage ("Company", "we", "us", or "our") is committed to protecting the privacy and security of personal data. This Privacy Policy explains how we collect, use, disclose, and protect personal data across our public website https://fontage.dev/, client relationships, AI solutions, web development services, and related digital systems.

This policy applies to website visitors, prospective clients, active clients, and end-users of our services. (Note: Where we process personal data on behalf of corporate clients as a Data Processor, our processing is governed by our client contracts and Data Processing Agreements).

2. Personal Data We Collect

We collect personal data only when necessary for our legitimate business operations, contract performance, or legal compliance. Depending on your interaction with us, we may collect the following categories of personal data:

• Contact & Identity Information: Full name, business email address, phone number, and postal address (Applicable to enquiries, client onboarding, and communications).
• Business & Billing Information: Company name, billing address, tax identification details, and financial account references (Applicable to client billing and invoicing).
• Account Credentials: Username, password hashes, and authentication tokens (Applicable where client portals or systems are provided).
• Website Usage & Technical Data: IP address, browser type, operating system, device identifiers, referral URLs, access logs, and page interaction analytics (Applicable to website visitors).
• Communications & Support Data: Enquiries, customer support tickets, emails, feedback, and meeting transcripts or notes.
• Project & Client Content: Files, documents, source code repositories, and business assets provided by clients during software development or AI integration projects.
• AI Inputs and Prompt Data: Text prompts, queries, files, and data uploaded by users into our AI tools or demonstration interfaces, along with generated AI responses.
• Cookies & Tracking Technologies: Analytics identifiers, session cookies, and preference cookies (See Section 7 for details).
• Payment Information: Processed securely by our third-party payment gateway providers. We do not store full credit card numbers on our servers.

3. Purpose of Processing and Lawful Grounds

We process your personal data for specified, explicit, and legitimate purposes. Where the EU GDPR applies, we rely on the following lawful bases:

• Contract Performance (Art. 6(1)(b) GDPR): To deliver web development, and AI solutions; to manage client onboarding; and to fulfill contractual obligations.
• Legitimate Interests (Art. 6(1)(f) GDPR): To secure our website and IT infrastructure, prevent fraud, analyze website traffic to improve our user experience, and conduct B2B marketing.
• Legal Compliance (Art. 6(1)(c) GDPR): To comply with applicable tax, accounting, anti-money laundering, and legal reporting obligations under Sri Lankan law.
• Consent (Art. 6(1)(a) GDPR): For optional marketing communications, non-essential cookies, or specific AI prompt logging where required by law. You may withdraw consent at any time.

4. Sri Lankan Data Protection Compliance (PDPA)

For operations subject to Sri Lanka’s Personal Data Protection Act (PDPA) No. 9 of 2022, we adhere to core data protection principles, including lawfulness, purpose limitation, data minimization, accuracy, storage limitation, and confidentiality.

• Data Subject Rights: As substantive provisions of the PDPA take effect, individuals in Sri Lanka have rights to access, correct, object to, or request deletion of their personal data, subject to statutory exemptions. Requests should be submitted to our privacy contact.
• Security Safeguards: We implement appropriate technical and organizational measures to protect personal data against unauthorized access, destruction, or disclosure.

5. GDPR and International Privacy Rights

If you are located in the European Union (EU) or the United Kingdom (UK), you benefit from statutory rights under the GDPR/UK GDPR, including:

• Right of Access: Request copies of your personal data.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data under specific conditions.
• Right to Restriction & Objection: Restrict or object to our processing of your personal data.
• Right to Data Portability: Request transfer of your data to another controller.
• Right to Lodge a Complaint: File a complaint with your local supervisory authority.

6. Artificial Intelligence, Machine Learning, and Third Party Processing

• AI Inference vs. Training: When you interact with our AI solutions or customized AI integrations, your inputs (prompts and uploaded documents) are processed via AI inference APIs provided by third-party model providers.
• Model Training Policy: We do not use client confidential data, private project files, or client prompts to train public AI models or foundation models, unless explicitly agreed upon in writing for a custom fine-tuning project.
• Third-Party Subprocessors: We utilize secure cloud hosting, email, and analytics providers. All subprocessors are vetted for security and data protection compliance.

7. Cookies and Tracking Technologies

Our website may use cookies and similar tracking technologies to enhance user experience and analyze traffic:

• Strictly Necessary Cookies: Essential for the operation and security of the website.
• Analytics Cookies: Used to measure visitor interactions and improve website performance (e.g., Google Analytics).
• Preference Cookies: Remember your settings and preferences. You can manage or disable non-essential cookies via your browser settings or our cookie preference center (if applicable).

8. Data Retention, Security, and Cross Border Transfers

9. Privacy Contact Information

To exercise your data privacy rights, ask questions, or submit a privacy complaint, please contact our Data Privacy Team: