Privacy Policy

Last updated: 15 September 2026

Who this notice covers

Mistravora is a digital solutions business based in Sri Lanka, founded in May 2025 by Husni and co-founded by Shakeel. Contact: info@mistravora.com; telephone / WhatsApp: +94 77 330 6063. Available 24/7 for enquiries, with responses within 24 hours; this is not a promise of continuous live support. This notice explains information handled through our website. A client project may require a separate agreement describing its own data processing.

Information you choose to provide

Contact requests use your name, email address and message so we can answer you. Phone, company, service, budget and deadline context are optional. Booking requests use your name, email, selected appointment and optional message. Newsletter sign-up asks for your email and a separate affirmative choice. Sending an enquiry does not subscribe you to email marketing. Please do not include passwords, payment-card details, health records or other sensitive information.

Website audit tool

The audit tool asks for a public URL, not your email. With your explicit request, it sends the URL to Google PageSpeed to perform the check. Query strings and fragments are removed before forwarding. Do not submit private URLs or paths containing secrets. The tool does not create a sales lead. Google’s own service terms and data handling also apply.

Website operation

Our hosting and security systems process connection information such as IP addresses, timestamps and requested pages to deliver and protect the site. Admin sign-in uses authentication cookies. Your browser may store theme preferences, cookie choices, a newsletter confirmation flag and offline website assets. Public pages do not need an admin login.

Purposes and legal grounds

We use enquiry and booking information to respond to the request and, where relevant, take steps toward a requested contract. Optional marketing uses your separate choice, which you may withdraw. Essential hosting, security and administrative records support operating and protecting the service; the applicable lawful basis and any local statutory obligations must be assessed for the particular processing. A form acknowledgement is not permission for unrelated uses.

Providers and international processing

The website is hosted on Vercel, uses Supabase for database and authentication, and Cloudflare R2 for uploaded media. These providers may process information outside your country. With your optional analytics consent, we use Google Analytics 4 (Google) to understand page visits, interactions and website performance. Google processes identifiers and technical information such as browser/device details and network connection information; processing may take place outside your country. Our custom analytics events exclude form contents and remove query strings from page locations. Google signals and advertising personalization are disabled in our tag configuration. Advertising tags and session recording are not enabled. You may withdraw analytics consent using Cookie preferences in the footer. See our Cookie Policy and Google’s privacy policy at https://policies.google.com/privacy for further information. We do not automatically embed Google Maps; an external Maps link opens Google’s service only when you choose it. WhatsApp, social links and other external destinations have their own privacy practices.

Assistant

The website assistant processes the messages you submit to answer your request. Do not enter confidential or sensitive data. The automated assistant can be wrong and cannot agree binding prices or contracts. External AI processing is disabled during the provider review; general replies use the website’s own service information.

Access and disclosure

Authorised staff use submitted details to handle requests. Service providers process data needed for their functions. Information may also need to be preserved or disclosed to meet an applicable legal obligation. We do not use enquiry details as a marketing subscription.

Retention

Keep only information needed to handle a request, provide an agreed service, secure the site or meet applicable record-keeping duties. Retention should be reviewed when a request closes; information no longer needed should be deleted or anonymised, subject to justified legal holds and backup cycles. Exact operational retention periods and provider backup expiry are under review; contact us for the status of your records. This notice does not claim that automated deletion is already implemented.

Your choices and requests

Contact info@mistravora.com to ask about access, correction, deletion, objection, restriction, a copy of your information or withdrawal of consent where the relevant right applies. We may need proportionate verification of your identity before disclosing records. Do not send an identity document unless we explain why it is necessary. Withdrawing consent does not undo processing already lawfully performed. You can change optional cookie choices through Cookie preferences in the footer and unsubscribe using the email unsubscribe link.

Questions and complaints

Contact us first if you have a concern. You may also contact a competent data-protection or consumer authority where applicable. We are reviewing jurisdiction-specific obligations and provider arrangements; this notice does not claim certification or universal compliance.