Privacy Policy

This Privacy Policy explains how Cognet Labs (Pvt) Ltd ("Cognet Labs", "we", "us") collects, uses, shares, retains and protects personal data when you visit cognetlabs.lk, use an application or service we publish, or contact us.

Cognet Labs (Pvt) Ltd is a private limited company incorporated in Sri Lanka under the Companies Act No. 7 of 2007, registration number PV00363614, with its registered office in the District of Colombo. For the purposes of data protection law we are the controller of the personal data described in this policy, except where we process data on a client's behalf, in which case we act as a processor and the client's own privacy notice governs.

1. Data we collect

Data you give us

• Contact details. your name, email address, telephone number, company and the content of your message, when you email us or make an enquiry.
• Account data. Where an app or service requires an account, we hold your email address, a display name, and authentication credentials. Passwords are stored only as salted hashes, so we never see the original.
• Content you submit. files, text, images, audio or other material you upload to a product so it can do what you asked it to do.
• Support correspondence. the bug reports, screenshots, logs and diagnostic details you choose to send us.

Data collected automatically

• Technical data. IP address, device type, operating system version, app version, browser type, and the date and time of a request.
• Usage data. which screens or endpoints were used and when, and crash and error diagnostics, so we can fix faults and improve the product.

What we do not collect

We do not sell personal data. We do not collect special-category data (health, biometric identification, religious or political data, and similar) unless a specific project requires it, in which case it is described to you separately and collected on an explicit legal basis. We do not use your content to train general-purpose AI models.

2. Why we use it, and our legal basis

3. AI and machine learning

Some of our products use large language models, speech recognition, computer vision or other machine learning systems, and some of those run on third-party infrastructure. Where a product sends your content to such a service in order to produce a result, this is disclosed in that product. We contract with those providers on terms that prohibit them from using your content to train their own models, and we do not use your content to train our own general-purpose models. Outputs generated by AI systems can be inaccurate and should be reviewed before being relied on.

4. Who we share it with

We share personal data only with:

• Service providers acting on our instructions, such as cloud hosting, email delivery, error monitoring, payment processing and AI model providers. Each one is bound by a written contract to protect the data and use it only for the service they provide to us.
• App stores. Apple and Google, where an app is distributed through them. They handle purchases and subscriptions under their own privacy policies, and we do not receive your payment card details.
• Our clients, where we built and operate a system on their behalf and you are their user.
• Authorities or advisers, where we are required to by law, or to establish or defend legal claims.

We do not sell or rent personal data, and we do not share it for third-party advertising.

5. International transfers

We are based in Sri Lanka and our providers may process data in other countries, including in the European Economic Area, the United Kingdom, the United States, Singapore and India. Where personal data leaves its country of origin we rely on appropriate safeguards, such as standard contractual clauses or an equivalent mechanism, and we require providers to apply a comparable standard of protection.

6. How long we keep it

• Account data. for as long as the account is active, then deleted within 30 days of a deletion request or of the account being closed.
• Content you submit. for as long as you keep it in the product, then deleted with your account.
• Enquiry and support correspondence. up to 24 months after the matter is closed.
• Technical logs and diagnostics. normally up to 12 months.
• Invoices and accounting records. for the period required by Sri Lankan tax and companies legislation.

Backups are cycled out on a rolling schedule, so deleted data may persist in backups for a short period before being overwritten.

7. Your rights

Subject to the law that applies to you, you may ask us to:

• confirm what personal data we hold about you, and give you a copy;
• correct data that is wrong or incomplete;
• delete your data (see Deleting your account below);
• restrict or object to a particular use, including profiling;
• provide your data in a portable, machine-readable format;
• withdraw a consent you previously gave, without affecting what we did before you withdrew it.

These rights are given by the Sri Lanka Personal Data Protection Act No. 9 of 2022 and, where they apply to you, by the EU/UK GDPR and the California Consumer Privacy Act. California residents also have the right not to be discriminated against for exercising them; we do not sell or share personal information as those terms are defined in that Act.

To exercise any of these, email info@cognetlabs.lk. We will verify that the request comes from you and respond within 30 days. There is no charge. If you are not satisfied with our response you may complain to your data protection authority. In Sri Lanka that is the Data Protection Authority established under the Personal Data Protection Act No. 9 of 2022.

8. Deleting your account and your data

You can delete your account and the personal data associated with it at any time. Use the in-app account deletion option where the app provides one, or email info@cognetlabs.lk from your registered address, naming the app or service concerned.

We will confirm receipt, verify the request, and delete the account and its associated personal data within 30 days. The exception is records we are required by law to keep, such as invoices, which are retained for the statutory period and then deleted.

9. Children

Our services are not directed at children under 13, and we do not knowingly collect personal data from them. In jurisdictions where a higher age of digital consent applies, that higher age governs. If you believe a child has given us personal data, email info@cognetlabs.lk and we will delete it promptly. Where a specific app is intended for children, it says so in its store listing and follows the additional rules that apply to it.

10. Cookies and similar technologies

This website uses only what is necessary to serve the pages; it sets no advertising or cross-site tracking cookies. If we add analytics in future, this policy will be updated first and, where consent is required, we will ask for it before anything is set. Individual apps and services may use local storage on your device to keep you signed in and remember your settings.

11. Security

We use encryption in transit (TLS), encryption at rest for stored data, role-based access control, least-privilege administrative access, and logging of access to production systems. Passwords are stored only as salted hashes. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authority as required by law.

12. Changes to this policy

We may update this policy as our products or the law change. The "last updated" date at the top of this page always reflects the current version. If a change materially affects your rights we will give notice in the product or by email before it takes effect.

13. Contact us

Questions about this policy, or about how we handle your data:

Cognet Labs (Pvt) Ltd
83/1, Ramya Mawatha, Kalapaluwawa,
Rajagiriya 10107, Sri Lanka
info@cognetlabs.lk