Privacy Policy

1. Introduction

Swift Byte Solutions (Private) Limited (Registration No. PV 00347854) ("Company", "we", "us", or "our"), the operator of FreelioPro, respects your privacy and is committed to protecting your personal data. This Privacy Policy describes how we collect, use, process, store, and disclose information, including personal data, in connection with access to and use of the FreelioPro platform ("Service").

Our registered address is No:22/6A, Sri Sarananda Road, Hingurugamuwa, Badulla, Uva Province, Sri Lanka. We operate the Service globally and it is available only to persons aged 18 or over.

2. Our Two Roles: Controller and Processor

FreelioPro handles two distinct categories of personal data, and our legal responsibility differs for each. Understanding this distinction tells you who to contact about your data.

• Freelancer account data — we are the controller. When a Freelancer registers and uses the Service, we decide how that account data is handled and we are directly responsible for it. Freelancers should contact us about their own data.
• Client and project data — the Freelancer is the controller, and we are the processor. When a Freelancer enters a Client's name and email, uploads deliverables, or exchanges messages in a portal, the Freelancer decides what data is collected and why. We only store and process that data on the Freelancer's behalf, to operate the Service. We do not use it for our own purposes.

If you are a Client: the Freelancer who invited you to a portal is responsible for the data held about you in that portal. Requests to access, correct, or delete that data should go to that Freelancer first. You may also contact us at legal@freeliopro.com and we will assist, but in most cases we will need to refer the request to the Freelancer, as we cannot make decisions about their project data on their behalf.

Our processor obligations to Freelancers are set out in our Data Processing Addendum.

3. Information We Collect About Freelancers

• Account data: your name, email address, and account credentials. Passwords are stored only in hashed form.
• Age confirmation: a mandatory confirmation that you are at least 18 years of age, given when you register.
• Record of acceptance: when you register we record your acceptance of the Terms of Service and this Privacy Policy, together with the date and time, the IP address you registered from, your browser user-agent string, and a cryptographic fingerprint identifying the exact version of each document you were shown. You can view your own record at any time in Account Settings. It is deleted when you delete your account.
• Profile and business data: business name, avatar, portfolio items, and any contact details you choose to show to your Clients or on your public portfolio page, which anyone can visit.
• Project and Client data you enter: the projects, files, deliverables, invoices, messages, and Client details you create or upload. See Section 4 for what this includes, and Section 2 for who is responsible for it.
• Authentication and security logs: we log successful and failed login attempts to your account, including timestamps and IP address, to detect unauthorized access.
• Time zone: the time zone your browser reports (for example, Asia/Colombo), recorded when you use your dashboard and updated if it changes. We use it only to put dates on the right day for you: deadlines in our emails and notifications, when an invoice counts as overdue and when we remind you about it, and which day and month your earnings fall in. It is a time zone setting, not your location, and it is deleted with your account.
• Subscription status: your plan, its status, an identifier linking your account to your subscription with our payment provider, and your card's brand and last four digits. We never receive or store a full card number (see Section 7).
• Support requests: messages you send to our support or legal addresses, and tickets and replies you send through the Help Centre. When you open a Help Centre ticket we also record the IP address it was sent from; basic browser details (user-agent string, screen size, time zone, language, and the page you came from); the troubleshooting answers you chose; and a snapshot of your account at that moment, namely your plan and subscription status, your storage and file use against your plan's limits, your project count, and whether your email address is verified. This lets us diagnose a problem without asking you for details we already hold. You can delete any of your tickets at any time; see Section 11 for how long they are otherwise kept.

4. Information We Collect About Clients

Clients do not register accounts. The following data is held about Clients, in each case as processor on behalf of the Freelancer who operates the portal:

• Identity entered by the Freelancer: the Client's name and email address, recorded on the project so the portal can be issued and access controlled. This data is supplied by the Freelancer, not collected from the Client by us.
• Portal passcode: stored only in hashed form. Passcodes cannot be recovered or disclosed by us once issued, and are never sent by us to Clients.
• Session data: when a Client signs into a portal we create a session record containing a session token, the email address associated with the portal, the IP address used, and the browser user-agent string. Session records are deleted when they expire or are revoked.
• Messages: the content of messages sent in a portal, the display name attached to them, the IP address from which each message was sent, and read receipts.
• Feedback and uploads: the notes and links a Client sends when approving a deliverable or requesting changes to it, screenshots the Client attaches to a change request (PNG, JPG, or WebP images, up to three per request, where the Freelancer allows them), final project feedback, and any project rating given.
• Portal access records: each successful portal sign-in is recorded in our system logs together with the project identifier, project name, and the email address used.
• Portal activity: which areas of the portal the Client opens (the home page, the timeline, an individual deliverable, the invoice list, or an individual invoice), when they last visited, and how many separate visits they have made. Activity within 15 minutes of the previous visit counts as the same visit. These records contain no IP address. They are shown to the Freelancer who operates the portal, so that the Freelancer can tell whether their Client has seen the work and invoices shared with them.
• Record of acceptance: before a portal opens, the Client must confirm that they are at least 18 years of age and accept our Terms of Service and this Privacy Policy. We record each acceptance together with the date and time, the IP address it came from, the browser user-agent string, the email address associated with the portal, and a cryptographic fingerprint identifying the exact version of each document that was shown. This record exists to evidence that consent was given and to which text; it is retained for as long as the project exists and is deleted with the project.
• Invoice activity: timestamps recording when an invoice was sent, accepted, or marked paid, when the Client first viewed it, and how many times the Client has viewed it. These records contain no identity or IP data, and are shown to the Freelancer who issued the invoice.

Freelancers are instructed not to upload special-category or highly sensitive personal data (such as health, biometric, financial account, or government identification data) about their Clients to the Service. Any such data uploaded contrary to this instruction is uploaded on the Freelancer's own responsibility.

5. Usage Analytics

We operate our own in-app analytics to understand how the Service is used and to improve it, and to show Freelancers how much traffic their public pages receive. We do not use any third-party analytics service, and we do not use analytics for advertising, profiling, or tracking individuals across other websites.

Our analytics are designed to avoid identifying individuals. For each page view we record:

• A pseudonymous visitor identifier, generated as a salted cryptographic hash of the IP address, browser user-agent, and current date. The salt rotates daily, so the identifier cannot be linked across days and cannot be reversed to recover an IP address.
• The page path visited, the general device type, and a two-letter country code derived from network request headers.
• No cookie is set and no raw IP address is stored by the analytics collector.

Analytics coverage includes client portal pages. Where a portal page path contains a project identifier, that identifier is stored as part of the recorded path.

Portfolio traffic. A Freelancer can see totals for their own portfolio page and public project pages over the last 30 days: the number of page views, and the number of visitor-days (a visitor who returns on three different days counts three times, because the daily identifier described above cannot link visits across days). The Freelancer sees totals only, never individual visits, visitor identifiers, locations, or devices.

6. Cookies and Local Storage

We use cookies and browser local storage only where necessary for the Service to function — to maintain authenticated Freelancer sessions, to maintain a Client's portal session, and to remember interface preferences such as theme.

We set no third-party cookies and use no advertising, retargeting, or cross-site tracking technologies. Because the cookies we use are strictly necessary for the Service to operate, no consent banner is presented. If you configure your browser to refuse cookies, you will not be able to sign in or use a portal.

7. Payment Information

FreelioPro does not collect, process, or store full card numbers, security codes, or any credential that could be used to make a payment. All subscription transactions are handled by our Merchant of Record, Lemon Squeezy. We receive the identifiers and subscription status needed to provision premium features on your account, together with your card's brand and last four digits so that you can recognise which card is on file. Please review Lemon Squeezy's own privacy policy to understand how they handle payment data.

Regarding your own Clients: FreelioPro provides invoice generation and manual status tracking only. We do not process, hold, or transfer payments between Freelancers and their Clients, and we do not collect payment or banking information about Clients.

8. How and Why We Use Information

We use the data described above for the following purposes, on the following legal bases:

• To provide the Service — creating accounts, operating projects and portals, storing and delivering files, sending and displaying messages and invoices. Basis: performance of our contract with the Freelancer; for Client data, processing on the Freelancer's instructions as processor.
• To authenticate users and secure the Service — verifying credentials and passcodes, maintaining sessions, detecting and investigating unauthorized access, brute-force attempts, and abuse. Basis: legitimate interests in the security and integrity of the Service, and our legal obligation to keep data secure.
• To communicate with you — transactional and functional email only, such as password resets, one-time codes, security alerts, billing and subscription notices, and material changes to our terms. Basis: performance of contract and legitimate interests. We do not send marketing email.
• To provide support — responding to your enquiries. Basis: performance of contract and legitimate interests.
• To maintain and improve the Service — diagnosing errors and understanding aggregate usage through our own privacy-preserving analytics. Basis: legitimate interests.
• To keep prohibited content off the Service — the automated checks on uploaded images and videos and on submitted text described below. Basis: legitimate interests in enforcing our Acceptable Use Policy and protecting Users, and, for Client data, processing on the Freelancer's instructions as processor.
• To enforce our terms and comply with law — investigating reports of prohibited content, responding to legal requests, and establishing or defending legal claims. Basis: legal obligation and legitimate interests.

We do not sell personal data, share it with data brokers, use it for advertising, or use any user content to train machine-learning models. No user content is sent to any third-party AI or model provider.

Automated content checks. Before a Freelancer uploads an image or video, or a Client attaches one in a portal, an image-classification model running in the uploader's own browser checks it for sexually explicit content; the file is not sent to us or to anyone else to be checked, and a file that fails the check is not uploaded. Text submitted to the Service, including messages, feedback, names, descriptions, and support tickets, is checked on our server against lists of prohibited words and phrases, and rejected if it matches. Rejected text and blocked files are not stored, and no person reviews them. These checks only allow or refuse a submission; they make no decision about you and are not used to build any profile. Details are in Section 10 of our Terms of Service.

Because portals are private, we do not review the content of files or messages, and apart from the automated checks above we do not monitor or scan it. We access such content only where necessary to investigate a report, enforce our Terms, resolve a technical fault, or comply with a legal obligation.

9. Service Providers and Sub-processors

We keep our infrastructure deliberately minimal. The following providers process data on our behalf, under contractual confidentiality and security obligations, and only to perform their function:

We may also disclose personal data where we believe in good faith that it is necessary to comply with a legal obligation or lawful request, to enforce our Terms, to investigate potential wrongdoing in connection with the Service, to protect our rights or property, or to protect the safety of any person. If we are involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, and we will give notice before it becomes subject to a different privacy policy.

We will give Freelancers advance notice of any change to this list of sub-processors, as described in our Data Processing Addendum.

10. International Data Transfers

We are established in Sri Lanka and our infrastructure is located primarily in the United States. Personal data you provide will therefore be transferred to, stored in, and processed in countries other than your own, including Sri Lanka, the United States, and the European Union, where data protection laws may differ from those of your jurisdiction.

Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), which are incorporated into our Data Processing Addendum, together with the technical measures described in Section 12.

11. Data Retention

• Account and project data: retained for as long as the Freelancer's account is active. Projects, portals, and files are deleted when the Freelancer deletes them, or when the account is deleted.
• After a subscription ends: Freelancers have 30 days to sign in and download their files, after which all stored files are permanently deleted. Projects, portals, invoices, and Client details are retained and the account continues on the free plan. Deleting the account itself removes everything - see Section 12 of the Terms.
• While a subscription is active: we do not delete stored files, including when an account holds more than its plan's storage allocation. In that situation uploads are paused and nothing is removed. See Section 9 of the Terms.
• Earlier versions and Client screenshots: when a Freelancer uploads a new version of a deliverable, the previous file and any screenshots the Client attached to that change request are deleted, unless the Freelancer has chosen to keep earlier versions for that project. Kept files are deleted when the Freelancer removes them, or with the project. A withdrawn change request, or a screenshot the Client removes from it, is deleted straight away. The text of each change request is kept with the deliverable until the project is deleted.
• Portal sessions: deleted automatically when they expire or are revoked.
• Security, access, and system logs: retained for a maximum of 90 days, then deleted. This includes Freelancer login records, portal access records, and the record of which portal areas a Client opened.
• Portal and invoice activity summaries: a Client's last-visit time and visit count are kept with the project, and invoice view details with the invoice. They are deleted when the project or invoice is deleted.
• Billing event records: the subscription notifications we receive from our Merchant of Record are retained for up to 120 days so that we can reconcile billing problems and avoid processing the same event twice, then deleted. These relate to your subscription only and contain no Client data.
• Analytics records: retained in pseudonymous form for a maximum of 90 days for trend analysis, then deleted. The daily-rotating identifier means these records cannot be attributed to an individual.
• Support tickets: each Help Centre ticket, with every message in it, is deleted automatically 12 months after it was last updated. You can delete any of your tickets sooner from the Help Centre, including one that is still open, and deleting your account deletes all of them. When a ticket is deleted we keep only a record that it existed - its reference number, category, type, status, when it was opened, and how many messages it had, never its subject or text - and that record is deleted with our other system logs after 90 days.
• Support emails: messages sent to our support or legal addresses are kept for up to 12 months.
• In-app notifications: the alerts shown in your notification bell are pruned automatically: 30 days after being read, and 90 days if they remain unread, after which they are deleted. Each notification only restates something already recorded in your account — a message, an invoice, a subscription change — so removing it does not affect your projects, files, invoices or messages. Announcements sent to all users expire on their own published date instead.
• Backups: our server is snapshotted weekly. Deleted data may persist in the most recent snapshot for up to 7 days after deletion before being overwritten. Snapshots are held by our hosting provider in the same region as the server.

We do not retain invoice or billing records relating to your subscription, as those are held by our Merchant of Record. We may retain limited records longer where necessary to comply with a legal obligation or to establish or defend a legal claim.

12. Data Security

We implement technical and organizational measures appropriate to the nature of the data we hold, including:

• Encryption of data in transit using TLS.
• Storage of account passwords and portal passcodes in hashed form only. Passcodes cannot be recovered by us or by any member of our team once issued.
• Per-project portal isolation, so a portal passcode grants access only to that single project.
• Expiring, revocable portal sessions.
• Rate limiting and lockout on repeated failed access attempts, and logging of access events for security review.
• Restricted administrative access, limited to personnel who require it to operate the Service.

Important limitation on portal security. Portal passcodes are transmitted to Clients by the Freelancer, through a channel of the Freelancer's own choosing and outside our Service. Anyone who obtains a valid portal link and passcode may be able to view the contents of that portal. We cannot protect against a passcode being sent to the wrong recipient, forwarded, shared, or otherwise disclosed outside the Service, and we are not responsible for unauthorized access resulting from this. Freelancers should regenerate a passcode immediately if they suspect it has been compromised.

No method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee absolute security.

13. Data Breach Notification

If we become aware of a personal data breach affecting your data, we will notify affected Freelancers without undue delay, describing the nature of the breach, the data categories involved so far as known, the likely consequences, and the measures we have taken. Where we act as processor, we will notify the relevant Freelancer so that they can meet their own notification obligations as controller. Where we act as controller, we will notify the competent supervisory authority and affected individuals where required by applicable law.

14. Your Rights

Depending on your jurisdiction, you may have the right to access your personal data; to correct inaccurate data; to request erasure; to restrict or object to processing; to data portability; and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your data protection authority.

Freelancers can access, edit, and update most of their data directly in account settings, can delete projects and files at any time, can download their files as ZIP archives, and can export their account details (including their time zone), project records, client contacts, invoices, messages, support tickets, and record of the legal documents they accepted as spreadsheets. That export does not include in-app notifications or system logs: notifications restate records the export already contains, and system logs are security records about account access rather than content you created. Both are deleted on the schedules in Section 11, and both are removed entirely when you delete your account. If you need either of them, ask us and we will provide what we hold. You can also delete your entire account from Account Settings, confirmed by a code emailed to you, which removes all associated project and Client data and all of your support tickets immediately. You can also delete individual support tickets yourself from the Help Centre. For any other request, contact support@freeliopro.com.

Clients should direct requests about portal data to the Freelancer who invited them, who is the controller of that data (see Section 2). If you cannot reach them, contact legal@freeliopro.com and we will assist to the extent we are permitted to as processor.

We respond to requests within one month. We may need to verify your identity before acting, and we may decline a request where an exception under applicable law applies — for example where the data is required to comply with a legal obligation, or where erasure would infringe another person's rights. Further detail is set out in our GDPR Notice.

15. Age Restrictions

FreelioPro is intended exclusively for adults. You must be at least 18 years of age (or the age of legal majority in your jurisdiction, whichever is greater) to register an account or to access a client portal. We do not knowingly collect personal data from individuals under 18, and we do not direct the Service to children.

If we become aware that we have inadvertently collected personal data from a person under 18, we will delete it promptly. If you believe a minor has provided us with personal data, please contact support@freeliopro.com.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the revised Policy on this page and update the effective date above. If a change is material, we will notify Freelancers by email at least 30 days before it takes effect. Clients are subject to the version of this Policy in effect at the time they access a portal. Please review this Policy periodically.