Privacy
Policy.

This website, www.suboth.com (the “Site”), is the personal portfolio of Suboth Ragunathan, a Full-Stack Cross-Platform Software & AI Engineer based in Sri Lanka. For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and Sri Lanka’s Personal Data Protection Act No. 9 of 2022 (PDPA), Suboth Ragunathan is the data controller of any personal data processed through the Site.

Contact: [email protected]

This policy explains what data is collected when you visit the Site, why it is collected, how long it is kept, who it is shared with, and the rights you have over it. It applies to the Site only — external websites linked from the Site (including client projects, GitHub, LinkedIn, and YouTube) have their own privacy policies.

The Site is a static portfolio. It has no user accounts, requires no registration, and collects no data beyond the following:

• Usage & analytics data — pages visited, approximate location (country/city level), device and browser type, referral source, and interaction events. Collected via the analytics services described below.
• Preferences— your cookie consent choice (accepted or declined) and your accessibility preference for reduced animations, both stored locally in your browser’s localStorage. They never leave your device.
• Data you send directly — if you contact me by email, I receive your email address and whatever you choose to include. It is used solely to respond to you.
• Technical log data — the hosting and CDN infrastructure (Vercel, Cloudflare, Cloudinary) processes IP addresses transiently to deliver the Site securely, as is standard for any website.

Cookies are only set after you accept the consent popup. If you decline — or simply ignore it — no analytics cookies are placed.

You can withdraw consent at any time by clearing this Site’s cookies and site data in your browser settings — the consent popup will appear again on your next visit, and analytics cookies will not be set unless you accept again.

• Google Analytics 4 — loads only after you accept the consent popup. GA4 does not log or store individual IP addresses. Data is aggregated to understand which pages and projects visitors find useful.
• Vercel Analytics & Speed Insights — cookieless, privacy-friendly aggregate metrics (page views and real-world performance). No cross-site tracking, no persistent identifiers.
• Cloudflare Web Analytics — cookieless, aggregate traffic metrics collected at the network edge. No fingerprinting, no persistent identifiers.

None of these services are used for advertising, profiling, or automated decision-making. I do not sell, rent, or share personal data with anyone for marketing purposes.

• Consent (Art. 6(1)(a)) — for cookie-based analytics (Google Analytics). You may withdraw consent at any time as described above.
• Legitimate interests (Art. 6(1)(f)) — for cookieless aggregate analytics, security, and fraud prevention, balanced against your rights through data minimisation and aggregation.
• Steps prior to a contract (Art. 6(1)(b)) — when you contact me about hiring or freelance work.

The Site relies on the following infrastructure providers, each acting as a processor under their own published terms:

The providers above operate global infrastructure, so data may be processed outside your country, including in the United States. Where GDPR applies, transfers rely on recognised safeguards such as the EU–US Data Privacy Framework and/or Standard Contractual Clauses, as documented in each provider’s privacy policy.

• Google Analytics — event-level data is retained for 14 months, then automatically deleted. Aggregated reports contain no personal data.
• Cookieless analytics — Vercel and Cloudflare store only aggregate metrics, not personal records.
• Email correspondence — kept only as long as needed to handle your enquiry and any resulting work, then deleted.

Depending on where you live, you have some or all of the following rights:

• GDPR / UK GDPR — access, rectification, erasure, restriction of processing, data portability, objection, withdrawal of consent, and the right to lodge a complaint with your local supervisory authority.
• California (CCPA / CPRA) — the right to know, correct, and delete personal information, and to opt out of its sale or sharing. This Site does not sell or share personal information. You will never be discriminated against for exercising these rights.
• Sri Lanka (PDPA) — access, rectification, erasure, and withdrawal of consent under the Personal Data Protection Act No. 9 of 2022.

To exercise any of these rights, email [email protected]. I will respond within 30 days. Note that because the Site stores almost nothing, most requests can be fully satisfied by clearing your browser’s site data.

The Site is a professional portfolio and is not directed at children under 16. It does not knowingly collect personal data from children. If you believe a child has provided personal data through the Site, contact me and it will be deleted.

The Site is served exclusively over HTTPS with a strict Content Security Policy, frame-embedding protection, and hardened response headers. It is a statically generated site with no database of user records — the safest data is data that is never collected.

Cookie-based analytics on this Site is opt-in by design, which is stricter than honouring Do Not Track or Global Privacy Control signals alone: no analytics cookies are set unless you explicitly accept them.

This policy may be updated when the Site’s functionality or legal requirements change. The “last updated” date at the top of this page always reflects the current version. Material changes will be visible on this page — the Site has no mailing list to notify.

Questions, concerns, or rights requests: [email protected] — Suboth Ragunathan, Sri Lanka.