1. Who we are
Exceat Lab (registered in Sri Lanka, CPC/HP/DS/3974) is the data controller for personal data processed through exceatlab.com, our client portal and our referral portal. For our hosted software products (such as MediTrack or ProTune), our customers are the controllers of their own end-users’ data and we act as their processor under our agreement with them.
Privacy contact: hello@exceatlab.com
2. What we collect
| Source | Data |
|---|---|
| Contact form | Name, email, optional phone and company, topic, your message. |
| Software request form | Name, email, phone, business name, country, optional billing address, chosen product and package, requirements, referral code, preferred currency and payment method. |
| Partner application | Name, email, phone, country, optional company, website and how you plan to find clients; later, commission records and any payout notes you provide. |
| Client & referral portals | Your account details, projects, documents, invoices, notifications and sign-in timestamps. |
| Technical | A one-way hashed IP address on form submissions (for abuse prevention), security logs, and an essential session cookie. |
| Analytics (only with consent) | Pseudonymous usage data via Google Analytics 4. |
We do not ask for special-category data. Please don’t include health, financial account or ID numbers in free-text fields.
3. Why we use it and our legal bases
| Purpose | Legal basis (GDPR Art. 6 / PDPA §5) |
|---|---|
| Responding to enquiries and preparing quotes | Steps prior to a contract at your request; legitimate interests |
| Providing software, projects, support and invoices | Performance of a contract |
| Running the partner programme and paying commission | Performance of a contract |
| Service emails (sign-in links, project and billing updates) | Performance of a contract |
| Security, fraud prevention and audit logs | Legitimate interests; legal obligation |
| Accounting and tax records | Legal obligation |
| Website analytics | Consent (withdraw any time via “Cookie settings”) |
We do not use your data for automated decision-making that has legal or similarly significant effects, and we don’t send marketing emails without consent.
4. Portals & passwordless sign-in
The client and referral portals use one-time “magic links” sent to your email. Links expire after 20 minutes and work once. We store only a cryptographic hash of each link. When our team views your portal to help you (“view as”), this is read-only and recorded in our audit log.
5. Exceat AI assistant
Exceat AI answers questions using information published on this website. When you send a message, the text of your current conversation is sent to Google Gemini (Google LLC) to generate a reply. We do not store your conversations on our servers; your chat history stays in your browser tab and is cleared when you close it. Don’t share sensitive personal information with the assistant. AI answers may be inaccurate — please confirm important details with our team. Legal basis: legitimate interests in providing instant support, which you can avoid simply by not using the assistant.
6. Cookies & analytics
| Name | Purpose | Type | Duration |
|---|---|---|---|
| __Host-exl.sid | Keeps forms secure (CSRF protection) and keeps you signed in | Essential | Up to 7 days |
| exl-consent-v1 | Remembers your cookie choice (local storage) | Essential | Until cleared |
| googtrans | Remembers the language you selected | Functional, set only when you choose a language | Session |
| _ga, _ga_* | Google Analytics 4 usage statistics | Analytics — only with consent | Up to 13 months |
Google Translate is loaded only when you pick a language other than English; the page text is then sent to Google to be translated. Fonts are self-hosted, so viewing the site does not contact Google Fonts.
7. Who we share data with
We share data only with service providers who process it on our instructions under written agreements:
- Hosting & database provider — runs this website and stores data.
- Email delivery provider (SMTP) — sends sign-in links and service emails.
- Google LLC — Gemini (Exceat AI replies), Analytics (with consent) and Translate (when you choose a language).
- Cal.com — meeting scheduling, if you book through our meeting page.
- Stripe — payments and the billing account portal, if you pay online.
We may also disclose data where required by law. Partners receive no personal data about the clients they refer beyond what is needed to confirm commission. We never sell personal data.
8. International transfers
We operate from Sri Lanka with team members in the UK, Europe, North America and East Asia, and some providers are based in the United States. Where data leaves the UK/EEA or Sri Lanka, we rely on adequacy decisions, the EU Standard Contractual Clauses / UK IDTA, or other safeguards permitted by GDPR Chapter V and PDPA §26.
9. How long we keep data
- Contact messages: up to 24 months after our last exchange.
- Requests that don’t become customers: up to 24 months.
- Customer and partner accounts: for the relationship, then up to 6 years for legal, tax and dispute purposes (invoices and commission records), after which they are deleted.
- Sign-in links: deleted once used or expired. Session data: up to 7 days.
- Security and audit logs: up to 24 months (with hashed IP addresses).
10. Security
We protect data with TLS encryption in transit, strict security headers and content security policy, CSRF protection, rate limiting, hashed one-time sign-in tokens, bcrypt-hashed staff passwords with optional two-factor authentication, private file storage outside the public web root, least-privilege access and full audit logging of administrative actions. If a personal data breach is likely to put you at risk, we will notify you and the relevant authority as required by law (within 72 hours under GDPR).
11. Your rights
Under GDPR and the PDPA you can: access your data; get a portable copy; correct inaccurate data; ask us to erase data; restrict or object to processing; withdraw consent at any time; and not be subject to solely automated decisions. Portal users can download their data and submit requests directly from their profile page. Everyone else can use the form below or email hello@exceatlab.com. We respond within 30 days and may need to verify your identity.
12. Children
Our services are intended for businesses and adults aged 18 or over. We do not knowingly collect data from children.
13. Changes
We’ll update this policy when our practices change and show the new version date above. Significant changes will be communicated to portal users by email.
14. Contact & complaints
Questions or concerns: hello@exceatlab.com. You also have the right to complain to a supervisory authority — in Sri Lanka, the Data Protection Authority; in the UK, the Information Commissioner’s Office (ICO); in the EU, your local data protection authority. We’d appreciate the chance to address your concern first.