Privacy Policy

1. Introduction

Swift Byte Solutions (Private) Limited (Registration No. PV 00347854) ("Company", "we", "us", or "our"), the operator of FreelioPro, respects your privacy and is committed to protecting your personal data. This Privacy Policy describes how we collect, use, process, store, and disclose information, including personal data, in connection with access to and use of the FreelioPro platform ("Service").

Our registered address is No:22/6A, Sri Sarananda Road, Hingurugamuwa, Badulla, Uva Province, Sri Lanka. We operate the Service globally and it is available only to persons aged 18 or over.

2. Our Two Roles: Controller and Processor

FreelioPro handles two distinct categories of personal data, and our legal responsibility differs for each. Understanding this distinction tells you who to contact about your data.

• Freelancer account data — we are the controller. When a Freelancer registers and uses the Service, we decide how that account data is handled and we are directly responsible for it. Freelancers should contact us about their own data.
• Client and project data — the Freelancer is the controller, and we are the processor. When a Freelancer enters a Client's name and email, uploads deliverables, or exchanges messages in a portal, the Freelancer decides what data is collected and why. We only store and process that data on the Freelancer's behalf, to operate the Service. We do not use it for our own purposes.

If you are a Client: the Freelancer who invited you to a portal is responsible for the data held about you in that portal. Requests to access, correct, or delete that data should go to that Freelancer first. You may also contact us at legal@freeliopro.com and we will assist, but in most cases we will need to refer the request to the Freelancer, as we cannot make decisions about their project data on their behalf.

Our processor obligations to Freelancers are set out in our Data Processing Addendum.

3. Information We Collect About Freelancers

• Account data: your name, email address, and account credentials. Passwords are stored only in hashed form.
• Age confirmation: a mandatory confirmation that you are at least 18 years of age, given when you register.
• Record of acceptance: when you register we record your acceptance of the Terms of Service and this Privacy Policy, together with the date and time, the IP address you registered from, your browser user-agent string, and a cryptographic fingerprint identifying the exact version of each document you were shown. You can view your own record at any time in Account Settings. It is deleted when you delete your account.
• Profile and business data: business name, avatar, portfolio items, and any contact details you choose to display to your Clients.
• Project and Client data you enter: the projects, files, deliverables, invoices, messages, and Client details you create or upload. See Section 4 for what this includes, and Section 2 for who is responsible for it.
• Authentication and security logs: we log successful and failed login attempts to your account, including timestamps and IP address, to detect unauthorized access.
• Subscription status: your plan, its status, an identifier linking your account to your subscription with our payment provider, and your card's brand and last four digits. We never receive or store a full card number (see Section 7).
• Correspondence: messages you send to our support or legal addresses.

4. Information We Collect About Clients

Clients do not register accounts. The following data is held about Clients, in each case as processor on behalf of the Freelancer who operates the portal:

• Identity entered by the Freelancer: the Client's name and email address, recorded on the project so the portal can be issued and access controlled. This data is supplied by the Freelancer, not collected from the Client by us.
• Portal passcode: stored only in hashed form. Passcodes cannot be recovered or disclosed by us once issued, and are never sent by us to Clients.
• Session data: when a Client signs into a portal we create a session record containing a session token, the email address associated with the portal, the IP address used, and the browser user-agent string. Session records are deleted when they expire or are revoked.
• Messages: the content of messages sent in a portal, the display name attached to them, the IP address from which each message was sent, and read receipts.
• Feedback and uploads: revision feedback text, links submitted by the Client, files the Client uploads for review, final project feedback, and any project rating given.
• Portal access records: each successful portal sign-in is recorded in our system logs together with the project identifier, project name, and the email address used.
• Record of acceptance: before a portal opens, the Client must confirm that they are at least 18 years of age and accept our Terms of Service and this Privacy Policy. We record each acceptance together with the date and time, the IP address it came from, the browser user-agent string, the email address associated with the portal, and a cryptographic fingerprint identifying the exact version of each document that was shown. This record exists to evidence that consent was given and to which text; it is retained for as long as the project exists and is deleted with the project.
• Invoice activity: timestamps recording when an invoice was sent, accepted, or marked paid. These are timestamps only and contain no identity or IP data.

Freelancers are instructed not to upload special-category or highly sensitive personal data (such as health, biometric, financial account, or government identification data) about their Clients to the Service. Any such data uploaded contrary to this instruction is uploaded on the Freelancer's own responsibility.

5. Usage Analytics

We operate our own in-app analytics solely to understand how the Service is used and to improve it. We do not use any third-party analytics service, and we do not use analytics for advertising, profiling, or tracking individuals across other websites.

Our analytics are designed to avoid identifying individuals. For each page view we record:

• A pseudonymous visitor identifier, generated as a salted cryptographic hash of the IP address, browser user-agent, and current date. The salt rotates daily, so the identifier cannot be linked across days and cannot be reversed to recover an IP address.
• The page path visited, the general device type, and a two-letter country code derived from network request headers.
• No cookie is set and no raw IP address is stored by the analytics collector.

Analytics coverage includes client portal pages. Where a portal page path contains a project identifier, that identifier is stored as part of the recorded path.

6. Cookies and Local Storage

We use cookies and browser local storage only where necessary for the Service to function — to maintain authenticated Freelancer sessions, to maintain a Client's portal session, and to remember interface preferences such as theme.

We set no third-party cookies and use no advertising, retargeting, or cross-site tracking technologies. Because the cookies we use are strictly necessary for the Service to operate, no consent banner is presented. If you configure your browser to refuse cookies, you will not be able to sign in or use a portal.

7. Payment Information

FreelioPro does not collect, process, or store full card numbers, security codes, or any credential that could be used to make a payment. All subscription transactions are handled by our Merchant of Record, Lemon Squeezy. We receive the identifiers and subscription status needed to provision premium features on your account, together with your card's brand and last four digits so that you can recognise which card is on file. Please review Lemon Squeezy's own privacy policy to understand how they handle payment data.

Regarding your own Clients: FreelioPro provides invoice generation and manual status tracking only. We do not process, hold, or transfer payments between Freelancers and their Clients, and we do not collect payment or banking information about Clients.

8. How and Why We Use Information

We use the data described above for the following purposes, on the following legal bases:

• To provide the Service — creating accounts, operating projects and portals, storing and delivering files, sending and displaying messages and invoices. Basis: performance of our contract with the Freelancer; for Client data, processing on the Freelancer's instructions as processor.
• To authenticate users and secure the Service — verifying credentials and passcodes, maintaining sessions, detecting and investigating unauthorized access, brute-force attempts, and abuse. Basis: legitimate interests in the security and integrity of the Service, and our legal obligation to keep data secure.
• To communicate with you — transactional and functional email only, such as password resets, one-time codes, security alerts, billing and subscription notices, and material changes to our terms. Basis: performance of contract and legitimate interests. We do not send marketing email.
• To provide support — responding to your enquiries. Basis: performance of contract and legitimate interests.
• To maintain and improve the Service — diagnosing errors and understanding aggregate usage through our own privacy-preserving analytics. Basis: legitimate interests.
• To enforce our terms and comply with law — investigating reports of prohibited content, responding to legal requests, and establishing or defending legal claims. Basis: legal obligation and legitimate interests.

We do not sell personal data, share it with data brokers, use it for advertising, or use Client project content to train machine-learning models. The Service includes no artificial intelligence features and no user content is sent to any third-party model provider.

Because portals are private, we do not proactively monitor, scan, or review the content of files or messages. We access such content only where necessary to investigate a report, enforce our Terms, resolve a technical fault, or comply with a legal obligation.

9. Service Providers and Sub-processors

We keep our infrastructure deliberately minimal. The following providers process data on our behalf, under contractual confidentiality and security obligations, and only to perform their function:

We may also disclose personal data where we believe in good faith that it is necessary to comply with a legal obligation or lawful request, to enforce our Terms, to investigate potential wrongdoing in connection with the Service, to protect our rights or property, or to protect the safety of any person. If we are involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, and we will give notice before it becomes subject to a different privacy policy.

We will give Freelancers advance notice of any change to this list of sub-processors, as described in our Data Processing Addendum.

10. International Data Transfers

We are established in Sri Lanka and our infrastructure is located primarily in the United States. Personal data you provide will therefore be transferred to, stored in, and processed in countries other than your own, including Sri Lanka, the United States, and the European Union, where data protection laws may differ from those of your jurisdiction.

Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), which are incorporated into our Data Processing Addendum, together with the technical measures described in Section 12.

11. Data Retention

• Account and project data: retained for as long as the Freelancer's account is active. Projects, portals, and files are deleted when the Freelancer deletes them, or when the account is deleted.
• After a subscription ends: Freelancers have 30 days to sign in and download their files, after which all stored files are permanently deleted. Projects, portals, invoices, and Client details are retained and the account continues on the free plan. Deleting the account itself removes everything - see Section 12 of the Terms.
• Portal sessions: deleted automatically when they expire or are revoked.
• Security, access, and system logs: retained for a maximum of 90 days, then deleted. This includes Freelancer login records and portal access records.
• Billing event records: the subscription notifications we receive from our Merchant of Record are retained for up to 120 days so that we can reconcile billing problems and avoid processing the same event twice, then deleted. These relate to your subscription only and contain no Client data.
• Analytics records: retained in pseudonymous form for a maximum of 90 days for trend analysis, then deleted. The daily-rotating identifier means these records cannot be attributed to an individual.
• Correspondence with support: retained for up to 24 months.
• Backups: our server is snapshotted weekly. Deleted data may persist in the most recent snapshot for up to 7 days after deletion before being overwritten. Snapshots are held by our hosting provider in the same region as the server.

We do not retain invoice or billing records relating to your subscription, as those are held by our Merchant of Record. We may retain limited records longer where necessary to comply with a legal obligation or to establish or defend a legal claim.

12. Data Security

We implement technical and organizational measures appropriate to the nature of the data we hold, including:

• Encryption of data in transit using TLS.
• Storage of account passwords and portal passcodes in hashed form only. Passcodes cannot be recovered by us or by any member of our team once issued.
• Per-project portal isolation, so a portal passcode grants access only to that single project.
• Expiring, revocable portal sessions.
• Rate limiting and lockout on repeated failed access attempts, and logging of access events for security review.
• Restricted administrative access, limited to personnel who require it to operate the Service.

Important limitation on portal security. Portal passcodes are transmitted to Clients by the Freelancer, through a channel of the Freelancer's own choosing and outside our Service. Anyone who obtains a valid portal link and passcode may be able to view the contents of that portal. We cannot protect against a passcode being sent to the wrong recipient, forwarded, shared, or otherwise disclosed outside the Service, and we are not responsible for unauthorized access resulting from this. Freelancers should regenerate a passcode immediately if they suspect it has been compromised.

No method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee absolute security.

13. Data Breach Notification

If we become aware of a personal data breach affecting your data, we will notify affected Freelancers without undue delay, describing the nature of the breach, the data categories involved so far as known, the likely consequences, and the measures we have taken. Where we act as processor, we will notify the relevant Freelancer so that they can meet their own notification obligations as controller. Where we act as controller, we will notify the competent supervisory authority and affected individuals where required by applicable law.

14. Your Rights

Depending on your jurisdiction, you may have the right to access your personal data; to correct inaccurate data; to request erasure; to restrict or object to processing; to data portability; and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your data protection authority.

Freelancers can access, edit, and update most of their data directly in account settings, can delete projects and files at any time, can download their files as ZIP archives, and can export their project records, client contacts, invoices and messages as spreadsheets. You can also delete your entire account from Account Settings, confirmed by a code emailed to you, which removes all associated project and Client data immediately. For any other request, contact support@freeliopro.com.

Clients should direct requests about portal data to the Freelancer who invited them, who is the controller of that data (see Section 2). If you cannot reach them, contact legal@freeliopro.com and we will assist to the extent we are permitted to as processor.

We respond to requests within one month. We may need to verify your identity before acting, and we may decline a request where an exception under applicable law applies — for example where the data is required to comply with a legal obligation, or where erasure would infringe another person's rights. Further detail is set out in our GDPR Notice.

15. Age Restrictions

FreelioPro is intended exclusively for adults. You must be at least 18 years of age (or the age of legal majority in your jurisdiction, whichever is greater) to register an account or to access a client portal. We do not knowingly collect personal data from individuals under 18, and we do not direct the Service to children.

If we become aware that we have inadvertently collected personal data from a person under 18, we will delete it promptly. If you believe a minor has provided us with personal data, please contact support@freeliopro.com.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the revised Policy on this page and update the effective date above. If a change is material, we will notify Freelancers by email at least 30 days before it takes effect. Clients are subject to the version of this Policy in effect at the time they access a portal. Please review this Policy periodically.