Privacy
Policy.

This website, www.suboth.com (the “Site”), is the personal portfolio of Suboth Ragunathan, a Full-Stack Cross-Platform Software & AI Engineer based in Sri Lanka. For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and Sri Lanka’s Personal Data Protection Act No. 9 of 2022 (PDPA), Suboth Ragunathan is the data controller of any personal data processed through the Site.

Contact: [email protected]

This policy explains what data is collected when you visit the Site, why it is collected, how long it is kept, who it is shared with, and the rights you have over it. It applies to the Site only — external websites linked from the Site (including client projects, GitHub, LinkedIn, and YouTube) have their own privacy policies.

The Site is a static portfolio. It has no user accounts, requires no registration, and collects no data beyond the following:

• Usage & analytics data — pages visited, approximate location (country/city level), device and browser type, referral source, and interaction events, including clicks, scrolling, and session recordings with consent. Collected via the analytics services described below.
• Preferences— your cookie consent choice (accepted or declined), stored locally in your browser’s localStorage. Your consent status is also passed to Microsoft Clarity when it is loaded.
• Data you send directly — if you contact me by email, I receive your email address and whatever you choose to include. It is used solely to respond to you.
• Technical log data— the Site’s DNS is resolved and its traffic proxied through Cloudflare before reaching Vercel’s hosting and Cloudinary’s image CDN. Each of these providers processes IP addresses transiently to route and deliver the Site securely, as is standard for any website.

Cookies are only set after you accept the consent popup. If you decline — or simply ignore it — no analytics cookies are placed.

You can withdraw consent at any time by clearing this Site’s cookies and site data in your browser settings — the consent popup will appear again on your next visit, and analytics cookies will not be set unless you accept again.

• Google Analytics 4 — loads only after you accept the consent popup. GA4 does not log or store individual IP addresses. Data is aggregated to understand which pages and projects visitors find useful.
• Microsoft Clarity — loads only after you accept the consent popup. Heatmaps and session recordings help me understand clicks, scrolling, and navigation so I can improve the Site. Analytics storage is enabled with consent; advertising storage is disabled.
• Vercel Analytics & Speed Insights — cookieless, privacy-friendly aggregate metrics (page views and real-world performance). No cross-site tracking, no persistent identifiers.
• Cloudflare Web Analytics— cookieless, aggregate traffic metrics collected at the network edge. Because the Site’s DNS and traffic are proxied through Cloudflare, its analytics beacon is injected automatically by Cloudflare’s edge on every page — it is not added by this Site’s own code, sets no cookies, and performs no fingerprinting or persistent identifiers.

None of these services are used for advertising, profiling, or automated decision-making. I do not sell, rent, or share personal data with anyone for marketing purposes.

The footer of this Site contains “Ask me on” buttons for ChatGPT, Claude, Gemini, and Perplexity. These are ordinary outbound links. Nothing happens until you click one — no request is made to any AI provider while you simply browse the Site.

When you do click, a new tab opens on that provider’s website with a prefilled prompt asking it to research my professional background. The link carries only that prompt text — no personal data about you, no identifiers, and no analytics parameters are added by this Site.

From that point on you are on a third-party service, governed by its own privacy policy and terms — not this one. Anything you type there, and any account you are signed into, is handled by that provider. These companies are not processors acting on my behalf and I receive no data back from them: OpenAI, Anthropic, Google, and Perplexity.

This Site publishes a machine-readable summary at /llms.txt and explicitly permits AI crawlers in robots.txt, so assistants can describe my work accurately. Those files contain only my own professional information, which I have chosen to publish. No visitor data is included in them, and no visitor data is ever made available to AI crawlers or used for model training.

• Consent (Art. 6(1)(a)) — for cookie-based analytics (Google Analytics and Microsoft Clarity). You may withdraw consent at any time as described above.
• Legitimate interests (Art. 6(1)(f)) — for cookieless aggregate analytics, security, and fraud prevention, balanced against your rights through data minimisation and aggregation.
• Steps prior to a contract (Art. 6(1)(b)) — when you contact me about hiring or freelance work.

The Site relies on the following providers, which process data under their own published terms:

The providers above operate global infrastructure, so data may be processed outside your country, including in the United States. Where GDPR applies, transfers rely on recognised safeguards such as the EU–US Data Privacy Framework and/or Standard Contractual Clauses, as documented in each provider’s privacy policy.

• Google Analytics — event-level data is retained for 14 months, then automatically deleted. Aggregated reports contain no personal data.
• Microsoft Clarity — recordings are retained for 30 days; favorites and a random sample may be retained for up to 9 months, as described in Microsoft’s retention documentation.
• Cookieless analytics — Vercel and Cloudflare store only aggregate metrics, not personal records.
• Email correspondence — kept only as long as needed to handle your enquiry and any resulting work, then deleted.

Depending on where you live, you have some or all of the following rights:

• GDPR / UK GDPR — access, rectification, erasure, restriction of processing, data portability, objection, withdrawal of consent, and the right to lodge a complaint with your local supervisory authority.
• California (CCPA / CPRA) — the right to know, correct, and delete personal information, and to opt out of its sale or sharing. This Site does not sell or share personal information. You will never be discriminated against for exercising these rights.
• Sri Lanka (PDPA) — access, rectification, erasure, and withdrawal of consent under the Personal Data Protection Act No. 9 of 2022.

To exercise any of these rights, email [email protected]. I will respond within 30 days. Note that because the Site stores almost nothing, most requests can be fully satisfied by clearing your browser’s site data.

The Site is a professional portfolio and is not directed at children under 16. It does not knowingly collect personal data from children. If you believe a child has provided personal data through the Site, contact me and it will be deleted.

The Site is served exclusively over HTTPS with a strict Content Security Policy, frame-embedding protection, and hardened response headers. It is a statically generated site with no database of user records — the safest data is data that is never collected.

Cookie-based analytics on this Site is opt-in by design, which is stricter than honouring Do Not Track or Global Privacy Control signals alone: no analytics cookies are set unless you explicitly accept them.

This policy may be updated when the Site’s functionality or legal requirements change. The “last updated” date at the top of this page always reflects the current version. Material changes will be visible on this page — the Site has no mailing list to notify.

Questions, concerns, or rights requests: [email protected] — Suboth Ragunathan, Sri Lanka.