Legal

Privacy policy

What we collect, why we collect it, and what you can tell us to do with it. In plain words, because a policy nobody reads protects nobody.

Last updated: October 2026

Please note. This policy is written to be accurate about how the platform works, but it has not been reviewed by a lawyer and the registered company name and address are still to be confirmed. Have it checked before you rely on it.

Who we are

DigitalProfile.lk (“we”, “us”, “our”) is a digital profile and NFC smart card platform operated from Sri Lanka by NextGen Bzone. We build and host the profiles you create, and we produce the physical cards that open them.

This policy explains what personal information we handle when you use digitalprofile.lk, why we handle it, and what you can ask us to do with it. It applies to the website, the profile builder, your dashboard and the public profile pages we host for you.

If you have a question about anything here, write to hello@digitalprofile.lk or message us on WhatsApp at +94 72 782 7817.

What we collect

We collect four kinds of information, and no more than we need for each.

  • Account information. Your name, your email address, the username you claim for your profile link, and a password that we store only as a cryptographic hash — we cannot read it, and neither can anybody who obtains the database.
  • Profile content. Everything you put into your profile: your photograph, headline, biography, contact details, social links, work experience, education, skills and any images or videos you upload. You choose all of it, and you can change or remove any of it at any time.
  • Payment information. A record that a payment was made, for which plan, and when. Payments are arranged directly with us and handled through the payment channel we agree with you; we do not store full card numbers on our servers.
  • Technical information. Ordinary server logs — IP address, browser type, pages requested, timestamps — and a small number of cookies described under cookies and local storage.

We do not ask for, and would rather you did not send us, national identity card numbers, passport numbers, bank account details or anything else of that kind. None of it is needed to run a profile.

How we use it

We use your information to do the things you asked us to do:

  • Create your account, verify that the email address is yours, and let you sign back in.
  • Build, publish and host your profile at your chosen link.
  • Encode and produce an NFC smart card, where you have ordered one.
  • Take payment, confirm it, and keep your profile online for the term you have paid for.
  • Answer you when you contact support, and tell you about things that affect your profile — a term ending, a problem with your page, a change to this policy.
  • Keep the service working and secure: diagnosing faults, preventing abuse, and detecting attempts to break into accounts.

We do not sell your personal information. We do not rent it, trade it, or hand it to advertisers, and we do not use your profile content to market anything to the people who visit your page.

What your profile makes public

This is the most important paragraph on this page, so it is not buried at the bottom. A published profile is a public web page. Anything you put on it — your photograph, your phone number, your email address, your links — can be seen by anybody with the link, and may be indexed by search engines.

That is the purpose of the product, but it means the decision about what appears there is yours and it is a real one. Put on it only what you are happy for a stranger to read.

You can unpublish a profile from your dashboard at any time, which removes it from the public internet while keeping your work saved, or delete it outright. Search engines may keep a cached copy for a while afterwards; that is outside our control, though we are happy to help you ask them to clear it.

The 3-hour trial and unfinished profiles

A trial profile is a real, live page for three hours. It is published at a real link and is public for that period in exactly the way a paid profile is. When the three hours end it is taken off the public internet automatically.

If you start building a profile and do not finish creating an account, the details you entered are held so that your work is not lost if you come back, and so that we can follow up with you where you gave us a way to do so. An unfinished profile is never attached to anybody else’s account. You can ask us to delete it at any time, and we will.

Cookies and local storage

We use as few as we can get away with:

  • A session cookie, which is what keeps you signed in as you move between pages. Without it there is no way to have an account at all.
  • A security token used to verify that forms were submitted from our own pages and not by somebody else on your behalf.
  • A small amount of local storage in your browser, which remembers whether you chose the light or dark theme, and holds a draft of a profile you are part-way through building.

We do not run third-party advertising cookies and we do not embed trackers from advertising networks on your profile pages.

Who else sees your information

A short list, and it is the whole list:

  • Our hosting provider, which stores the servers your profile and database live on.
  • Our payment channel, to the extent needed to take and confirm a payment.
  • Our card production partner, where you have ordered an NFC card — they receive the delivery details and the link to encode, and nothing else.
  • NextGen Bzone, our parent company, whose staff operate this platform and answer support messages.
  • A lawful authority, where we are required by Sri Lankan law or a valid court order to produce information.

Everyone in that list receives the minimum needed for their part, and is expected to protect it to the standard set out here.

How long we keep it

Your account and profile content are kept for as long as your account is open, and for the paid term of your profile. After a term ends we keep your content for a grace period so that you can renew without rebuilding anything, and we will tell you before that period runs out.

Unfinished and expired trial profiles are kept for a limited period and then removed. Records of payments are kept for as long as Sri Lankan tax and accounting rules require. Server logs are kept for a short period and then rotated out.

When you ask us to delete your account, we delete your profile content and your account record. We may retain the minimum needed for legal and accounting obligations, and anonymised information that can no longer identify you.

How we protect it

Passwords are stored as hashes, never as text. The site is served over an encrypted connection. Access to the database is restricted to the people who operate the platform, forms are protected against cross-site request forgery, and email addresses are verified before an account is fully usable.

No system is perfectly secure, and anybody who tells you otherwise is selling something. If we ever become aware of a breach affecting your personal information, we will tell you and the relevant authority without undue delay, and we will tell you plainly what happened.

Your part of this is a password you have not used anywhere else, and not sharing your sign-in details with anyone.

Your rights over your data

In line with the Personal Data Protection Act No. 9 of 2022 of Sri Lanka, you may ask us to:

  • Show you what personal information we hold about you.
  • Correct anything that is wrong or out of date — though most of it you can simply edit yourself from your dashboard.
  • Delete your profile and your account.
  • Withdraw consent to anything you previously agreed to, including unpublishing your profile.
  • Object to a particular use of your information, or ask us to restrict it while a question is being resolved.

Write to hello@digitalprofile.lk and we will respond within a reasonable period. There is no charge for a reasonable request.

Children

This service is intended for working professionals and is not directed at children under 16. We do not knowingly collect personal information from a child. If you believe a child has created a profile, tell us and we will remove it.

Changes to this policy

We may update this policy as the service changes or as the law does. The date at the top of this page always shows when it was last revised, and where a change materially affects you we will tell you by email rather than quietly editing the page.

Contact us

For anything about this policy, or to exercise any of the rights above:

You may also use the contact form.

Last updated: October 2026. Previous versions are available on request. See also our terms and conditions.