At Drift Codes, transparency, security, and engineering integrity go hand in hand. This policy outlines how we handle personal data, maintain strict confidentiality over client proprietary code, and protect the privacy of users interacting with our studio and digital products.
Operated By: Drift Codes (Private) Limited
Last Updated: October 12, 2026
Registered In: Sri Lanka (Global Operations)
Version: 2.1
Key Commitments at a Glance
Zero Data Selling
We never monetize or sell your personal details or telemetry to advertisers or data brokers.
Client IP Governance
Ownership of deliverables is governed by the applicable client agreement, statement of work, or software development contract.
Ethical AI Handling
Where supported by third-party AI providers, training exclusions and data retention controls are enabled to reduce exposure of customer information.
Full Rights Control
Subject to applicable laws and contractual obligations, individuals may request access, correction, export, or deletion of their personal information.
Section 01
Overview & Legal Entity
This Privacy Policy describes the practices of Drift Codes (“Drift Codes”, “we”, “us”, or “our”). Drift Codes is operated by Drift Codes (Private) Limited, a company registered in Sri Lanka.
Operating Legal Entity
Drift Codes is operated by Drift Codes (Private) Limited, a company registered under the laws of Sri Lanka, providing software engineering, mobile app development, artificial intelligence systems, and cloud solutions to clients worldwide.
This policy applies to information collected when you:
Visit or interact with our primary website located at driftcodes.com and any associated subdomains.
Engage us for bespoke software engineering, mobile app development (iOS, Android, cross-platform), AI/ML integration, cloud consulting, or UI/UX design.
Use proprietary digital products, mobile applications (such as Pulse), or web apps designed, published, or hosted by Drift Codes (Private) Limited.
Communicate with us via electronic mail, web contact forms, scheduling services, or telephone.
Section 02
Core Privacy Principles
We approach data privacy with the same rigor we apply to software architecture. Our practices rest on four pillars:
Data Minimization
We collect only the minimum data elements necessary to execute contracts, provide technical services, respond to briefs, and deliver reliable software.
Zero Commercial Exploitation
We are an engineering studio, not a data broker. We never sell, license, or barter contact details or user metrics to advertising networks.
Ironclad Client Confidentiality
Client codebases, schema designs, secret keys, and business logic are safeguarded under strict contractual non-disclosure agreements.
Transparent AI Operations
Where supported by third-party AI providers, training exclusions and data retention controls are enabled to reduce exposure of customer information.
Section 03
Information We Collect
The types of information we process depend on your interaction with Drift Codes:
A. Information You Provide Voluntarily
Inquiry & Contact Details: Full name, corporate email address, telephone number, company affiliation, and project description submitted via our contact forms.
Product Account Information: Where you register for our products (such as Pulse), your chosen display name, authentication credentials (via secure third-party OAuth providers), and optional profile preferences.
B. Information Collected Automatically
Device & Network Metadata: Truncated IP addresses, operating system version, browser user-agent, device hardware attributes, and language settings.
Usage & Diagnostic Metrics: Page response times, routing transitions, HTTP status codes, and crash reporting stack traces used to diagnose bugs and maintain uptime.
C. Information Not Collected
We do not collect sensitive government identifiers (e.g. social security numbers), political affiliations, biometrics for identification, or intrusive financial data. All client payments are settled via authorized banking transfers or PCI-DSS certified payment processors.
Section 04
How We Use Information & Legal Bases
We only process personal data when we possess a valid lawful basis under applicable privacy legislation (including Sri Lanka PDPA and GDPR Article 6):
Purpose of Processing
Categories of Data
Lawful Basis
Delivering client software engineering, mobile development & AI deployments
Contact info, project briefs, technical specs
Contractual Necessity (to fulfill service agreements)
Responding to prospective client inquiries and project proposals
Name, email, company, project notes
Legitimate Interests / Consent
Operating digital products (e.g. Pulse) & sync features
Account credentials, app telemetry
Contractual Necessity & Consent
System defense, error logging, and prevention of malicious abuse
Server logs, anonymized IP addresses, error telemetry
Legitimate Interests (security & reliability)
Compliance with corporate taxation, financial audits & legal demands
Invoicing records, contracts, payment histories
Legal Obligation
Section 05
Client Code, Deliverables, IP & Open-Source Components
As a specialized engineering studio, we recognize that our clients entrust us with mission-critical intellectual property. We enforce strict contractual, licensing, and technical boundaries:
Non-Disclosure Agreements (NDA)
All client engagements are governed by comprehensive non-disclosure agreements before project code is authored, inspected, or deployed.
Client Deliverables & IP Ownership
Ownership of deliverables is governed by the applicable client agreement, statement of work, or software development contract.
Open-Source Components
Many solutions delivered by Drift Codes may incorporate open-source components subject to their respective licenses. Such components remain governed by their original licensing terms.
Isolated Environments & Least Privilege
Client repositories and production cloud environments are isolated. Drift Codes engineers operate on role-based, least-privilege credentials requiring multi-factor authentication (MFA) and hardware keys.
Section 06
AI & Machine Learning Ethics and Model Governance
Drift Codes builds modern AI products, retrieval-augmented generation (RAG) pipelines, and intelligent agents. We hold ourselves to uncompromising standards of AI safety and data hygiene:
No Public Training on Client Assets: Client proprietary data, private documents, prompt history, and source code are never allowed to train public foundation models without explicit contractual consent.
AI Provider Controls: Where supported by third-party AI providers, training exclusions and data retention controls are enabled to reduce exposure of customer information.
Vector Data Isolation: Client embeddings and vector indices reside in isolated, dedicated namespaces with role-based cryptographic access control.
Human-in-the-Loop Safeguards: Autonomous agents built for clients include sensible guardrails, audit logging, and human override capability.
Section 07
Third Parties & Trusted Subprocessors
We do not sell personal data. We only share data with vetted third-party infrastructure providers (“Subprocessors”) essential to delivering our services:
Cloud Hosting & Edge Network
Vercel, Cloudflare, AWS
Hosting website bundles, edge caching, SSL termination, and DDoS mitigation.
Developer Tools & Version Control
GitHub, GitLab
Secure Git hosting, continuous integration, and version tracking under private enterprise repositories.
Communication & Scheduling
Google Workspace, Cal.com
Email correspondence, project briefings, and scheduling discovery calls.
Telemetry & Performance Monitoring
Vercel Analytics, Sentry (Self-hosted/Cloud)
Anonymous runtime performance tracking and debugging software crashes.
All subprocessors are bound by data processing agreements (DPAs) requiring adherence to strict confidentiality, encryption, and data protection benchmarks.
Section 08
Third-Party Links
Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of external websites not operated by Drift Codes.
External Privacy Policies
We encourage you to review the privacy policies and terms of any external websites or third-party platforms that you visit through links provided on our site or applications.
Section 09
International Data Transfers
Drift Codes is based in Sri Lanka and serves clients across the United States, Europe, Australia, and Asia. When data crosses national borders:
We utilize Standard Contractual Clauses (SCCs) approved by the European Commission for transfers outside the European Economic Area.
We comply with Section 26 of Sri Lanka’s Personal Data Protection Act No. 9 of 2022 governing cross-border transfers.
Data stored in cloud environments is pinned to regional data centers (e.g. EU, US, or AP-Southeast) according to our clients’ regulatory and contractual demands.
Section 10
Security & Technical Safeguards
We implement industry-standard physical, technical, and organizational measures designed to protect information from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction:
TLS 1.3
End-to-end transport layer encryption for all web and API traffic.
Encryption at Rest & In Transit
Industry-standard encryption is used to protect data in transit and at rest where supported by our hosting and infrastructure providers.
2FA / MFA
Compulsory multi-factor authentication for all engineering accounts.
Section 11
Data Retention & Deletion
We store personal and project data only as long as necessary to satisfy the purposes for which it was gathered:
Inquiries & Briefs: Non-converting prospect inquiries are retained for up to 12 months, after which they are purged.
Client Contracts & Invoices: Retained for statutory accounting and tax retention periods in Sri Lanka and relevant international client jurisdictions.
Working Repositories: Staged client build repositories are archived or transferred to client-owned organizations in accordance with the applicable statement of work.
Product Accounts: Deletion of a user account triggers irreversible data expungement within 30 days.
Section 12
Your Privacy Rights (GDPR, CCPA, SL PDPA)
Regardless of your geographic location, Drift Codes respects your rights over your personal data:
Right of Access & Portability
Request an export of personal data held concerning you.
Right to Rectification
Correct inaccurate, incomplete, or out-of-date personal information.
Right to Erasure (“Forgotten”)
Request deletion of your records when processing is no longer required.
Right to Restriction & Objection
Limit or halt processing based on legitimate interests or direct communication.
How to exercise your rights: Subject to applicable laws and contractual obligations, individuals may request access, correction, export, or deletion of their personal information by contacting our privacy team at [email protected] with the subject line “Privacy Rights Request”.
Section 13
Cookies & Tracking Technologies
Our approach to cookies is minimal and privacy-preserving:
Strictly Necessary Cookies: Required to maintain security, session integrity, and user authentication.
No Invasive Advertising Cookies: We do not deploy third-party advertising pixels, Facebook beacons, or cross-site tracking cookies.
Browser Controls: You may configure your browser to block or alert you about cookies; however, some site functionalities may become degraded.
Section 14
Children’s Privacy
Our services and commercial software offerings are intended for businesses and individuals aged 16 and older. We do not knowingly solicit or collect personal information from children under the age of 16. If we become aware that an underage individual has submitted data without verified parental consent, we take prompt steps to delete the records.
Section 15
Changes to This Privacy Policy
We may modify this Privacy Policy periodically to reflect engineering advancements, new product launches (such as updates to Pulse), or evolving international privacy laws. When updates are published, the “Last Updated” timestamp at the top of this document will be updated. For material alterations impacting client commitments, we will provide appropriate notice to registered clients.
Section 16
Contact & Legal Entity Information
If you have questions, feedback, or requests regarding this Privacy Policy or our engineering privacy safeguards, please reach out to us:
