Privacy Policy

Last Updated: 3 September 2026

Discovered You International (Private) Limited (“Discovered You”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal information entrusted to us.

This Privacy Policy explains how we collect, access, use, process, store, protect, disclose and delete personal information when you use the Discovered You website, client accounts, applications, digital platforms, project management services, service booking and purchasing facilities, authentication services and other services provided by Discovered You.

This Privacy Policy also explains specifically how Discovered You handles information received when you choose to use Sign in with Google.

1. Who We Are

Discovered You International (Private) Limited provides digital, technology, consulting and business-support services through the Discovered You platform.

Our services may include website and application development, digital solutions, business systems, consulting, project-based services, service bookings, quotations, client project management, ongoing services and related digital services.

Organisation: Discovered You International (Private) Limited
Address: Trinco Road, Batticaloa, Sri Lanka
Website: discoveredyou.com
Email: support@discoveredyou.com
Telephone: +94 77 462 8867

Questions or requests concerning this Privacy Policy or your personal information may be directed to our support email.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal information processed through Discovered You services, including our:

• public website;
• Client Access and Client Command Centre;
• account registration and authentication services;
• Google Sign-In;
• phone-number authentication where available;
• Service Studio and quotation processes;
• orders and payment-related services;
• project workspaces;
• client communications;
• document submission facilities;
• approvals and project requirements;
• feature and change requests;
• support services; and
• other Discovered You digital services that link to this Privacy Policy.

This policy does not govern independent websites or services operated by third parties that have their own privacy policies.

3. Information We May Collect

The information we collect depends on the services you use and how you interact with Discovered You.

3.1 Account and Identity Information

When you register or use an account, we may process information such as:

• your name;
• email address;
• telephone or mobile number;
• account identifier;
• company or organisation name;
• billing information;
• account preferences; and
• authentication-related information.

We use this information to create, identify, secure and administer your Discovered You account and provide our services.

3.2 Information Received Through Google Sign-In

Discovered You provides Google Sign-In as an authentication option.

When you choose to sign in using your Google Account, Google may provide Discovered You with basic account information authorised through the authentication process.

Depending on the permissions presented to you and granted by you, this may include:

• your Google Account identifier;
• your name;
• your email address; and
• your Google profile picture, where made available.

We use this information to authenticate you, identify or create your Discovered You account, associate your login with the appropriate account and provide account-related functionality.

Discovered You does not use Google Sign-In to access your Gmail messages, Google Drive files, Google Contacts, Google Calendar content or other Google service content unless a separate feature expressly requests such access and you provide the required consent.

If our Google permissions or use of Google user data materially changes in the future, we will update this Privacy Policy and provide any notices or permissions required before using such information for the new purpose.

4. How We Use Google User Data

Information received from Google through Google authentication is used only for purposes related to providing and securing the Discovered You service, including:

• authenticating your identity;
• allowing you to sign in securely;
• creating or connecting your Discovered You client account;
• identifying your account during future sign-ins;
• displaying appropriate basic account/profile information;
• maintaining account security;
• preventing unauthorised account access; and
• providing the user-facing functionality you requested.

We do not use Google user data for targeted advertising.

We do not sell Google user data.

We do not provide Google user data to data brokers or information resellers.

We do not use Google user data to determine creditworthiness or for lending purposes.

We do not use Google user data for personalised advertising or retargeting.

We do not use Google user data to train general-purpose artificial intelligence or machine-learning models.

Our access and use of Google user data is limited to providing and improving the user-facing functionality associated with the Discovered You service and is intended to comply with applicable Google API Services User Data requirements.

Google specifically prohibits several secondary uses of Google user data, including targeted advertising, selling data, creditworthiness determinations and certain AI/ML training uses. The wording above makes our intended use explicit for the reviewer.

5. Phone Number and Authentication Information

Where phone authentication or one-time passwords (“OTP”) are available, we may process:

• your mobile telephone number;
• authentication requests;
• authentication status;
• security and anti-abuse information; and
• technical information required by the authentication provider.

OTP codes and authentication mechanisms may be generated, transmitted or verified using third-party authentication infrastructure such as Firebase or related Google services.

We use phone authentication information to verify account ownership, facilitate secure sign-in, prevent abuse and protect user accounts.

6. Client and Project Information

When you purchase, request or receive a service from Discovered You, we may process information relating to your project, including:

• project reference;
• requested service;
• project requirements;
• project scope;
• project stage and status;
• project progress;
• milestones;
• start and target dates;
• client actions;
• quotations;
• estimates;
• project values;
• feature or change requests;
• approvals;
• project updates; and
• service history.

This information is used to administer and deliver the services you request.

7. Documents and Files

Some Discovered You services allow clients to submit documents or files required for a project.

These may include, depending on the project:

• logos;
• photographs;
• branding materials;
• business information;
• project content;
• technical documents;
• supporting documents; and
• other files requested for service delivery.

We process these documents only as reasonably necessary to provide, administer, support or secure the relevant service, or to meet applicable legal requirements.

Users should avoid uploading unnecessary sensitive personal information.

8. Communications

When you communicate with Discovered You through the Client Command Centre, project workspace, contact forms, email, telephone, support facilities or other communication channels, we may retain information such as:

• message content;
• sender information;
• project reference;
• message timestamps;
• support requests;
• responses;
• communication status; and
• related project activity.

Project communications may form part of the project’s permanent activity history where appropriate.

We use these records to provide support, maintain project continuity, resolve disputes, maintain accountability and provide the services requested.

9. Orders, Quotations and Payment Information

When you request or purchase a service, we may process:

• order number;
• quotation or estimate information;
• service details;
• billing name and address;
• email address;
• telephone number;
• payment method;
• payment status;
• transaction references;
• amounts paid;
• outstanding balances; and
• related financial records.

Payments may be processed through banks, payment gateways or other payment service providers.

Where payment information is processed directly by a third-party payment provider, that provider may process the information according to its own privacy policy and security requirements.

Discovered You does not intentionally store full payment-card credentials where those credentials are handled directly by an authorised payment processor.

10. Technical, Security and Usage Information

When you access our services, certain technical information may be processed automatically.

This may include:

• IP address;
• browser type;
• device information;
• operating system;
• access time;
• pages or functions accessed;
• login and authentication events;
• session information;
• security events;
• error information; and
• information used to detect abuse or unauthorised activity.

We use this information to operate, maintain, troubleshoot and secure the platform, prevent fraud or misuse, and improve reliability and user experience.

11. How We Use Personal Information

Depending on your relationship with Discovered You, we may use personal information to:

• provide requested services;
• create and administer accounts;
• authenticate users;
• process service requests;
• prepare quotations and estimates;
• manage orders;
• manage projects;
• communicate project progress;
• request documents or approvals;
• process feature and change requests;
• manage payments and outstanding balances;
• provide customer support;
• maintain service and project histories;
• protect accounts and systems;
• prevent fraud, abuse and unauthorised access;
• diagnose technical problems;
• maintain and improve our services;
• comply with legal and regulatory obligations;
• establish or defend legal rights; and
• communicate important administrative, service or security information.

We seek to use personal information only for purposes that are reasonably connected with the circumstances in which it was collected.

12. Legal Grounds and Legitimate Purposes

Where applicable privacy law requires a legal basis for processing, our processing may be based on one or more of the following:

• your consent;
• performance of a contract or steps requested before entering a contract;
• compliance with a legal obligation;
• protection of legitimate interests relating to operation, security and improvement of our services; or
• another lawful basis recognised by applicable law.

Where processing depends specifically on consent, you may withdraw that consent subject to applicable law and any consequences explained when consent was obtained.

13. How We Share Information

We do not sell personal information.

We may disclose limited information where reasonably necessary to organisations that help us operate or provide our services, such as:

• hosting and infrastructure providers;
• authentication providers;
• cloud service providers;
• payment processors;
• banking and financial service providers;
• email or communications providers;
• security and anti-fraud providers;
• technical service providers;
• professional advisers; and
• governmental, regulatory or law-enforcement authorities where disclosure is legally required.

Service providers should receive only information reasonably necessary for the function they perform and are expected to process that information subject to applicable contractual, confidentiality and legal requirements.

Google User Data

Google user data obtained through Google authentication is not sold.

We do not transfer or disclose Google user data to third parties except where necessary to provide or secure the functionality requested by the user, where the user has provided appropriate consent, where required by law, or as otherwise permitted under applicable Google policies.

14. International Processing

Some technology, hosting, authentication, communications, payment or infrastructure providers used by Discovered You may operate systems in countries outside Sri Lanka.

As a result, information may be processed or stored in another jurisdiction.

Where applicable, we take reasonable measures to ensure that such processing is subject to appropriate privacy and security protections.

15. Data Security

We use reasonable administrative, organisational and technical measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• misuse;
• alteration;
• inappropriate disclosure; and
• destruction.

Depending on the service, these measures may include authentication controls, access restrictions, secure communications, encrypted transport such as HTTPS/TLS, security monitoring, account permissions, session controls, backups and other security safeguards.

Access to operational client and project information is restricted according to legitimate business and service requirements.

However, no internet transmission, electronic storage system or security measure can guarantee absolute security.

Users are responsible for maintaining the confidentiality of their account credentials and for notifying us if they believe their account has been compromised.

16. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to:

• maintain an active account;
• provide requested services;
• maintain project and transaction records;
• provide support;
• meet accounting or legal obligations;
• resolve disputes;
• enforce agreements;
• prevent fraud or abuse; and
• maintain appropriate business records.

Different categories of information may therefore have different retention periods.

When information is no longer reasonably required and there is no legal or legitimate reason requiring continued retention, we may delete, anonymise or securely dispose of it.

Certain transactional, contractual, project or financial records may need to be retained for longer periods where required by applicable law or legitimate record-keeping requirements.

17. Account and Data Deletion

You may request deletion of your Discovered You account or personal information by contacting:

support@discoveredyou.com

Please use a subject such as “Data Deletion Request” and identify the account concerned.

We may need to verify your identity before processing a deletion request.

Following a valid request, we will delete or anonymise eligible personal information within a reasonable period, subject to information we are permitted or required to retain for legal, contractual, financial, security, fraud-prevention, dispute-resolution or legitimate record-keeping purposes.

Deleting your Discovered You account does not necessarily delete information held independently by third-party providers under their own legal obligations and privacy policies.

18. Google Account Connection and Revocation

If you use Google Sign-In, you may be able to review or revoke Discovered You’s access through your Google Account’s security and third-party access controls.

Revoking Google access may prevent future Google-based sign-in but does not necessarily delete your Discovered You account or information that was legitimately retained before revocation.

You may separately request deletion of eligible information from Discovered You using the procedure described above.

19. Cookies and Similar Technologies

Discovered You may use cookies and similar technologies where necessary to:

• maintain user sessions;
• support authentication;
• remember preferences;
• protect accounts;
• maintain security;
• operate website functionality;
• prevent abuse; and
• understand or improve service performance.

Where legally required, additional consent may be requested before non-essential cookies or similar technologies are used.

Third-party services integrated into the website may also use their own cookies or technologies according to their respective policies.

20. Children’s Privacy

Discovered You’s general commercial and client platform is not intended to knowingly collect personal information directly from children without appropriate authority or consent where such consent is required by applicable law.

If we learn that personal information relating to a child has been collected in circumstances requiring parental or guardian consent and the appropriate consent was not obtained, we will take reasonable steps to address the situation.

21. Your Privacy Rights

Depending on the laws applicable to you and the circumstances of processing, you may have rights relating to your personal information, which may include the right to:

• request access;
• request correction;
• request deletion;
• request information about processing;
• object to or restrict certain processing;
• withdraw consent where processing relies on consent; and
• raise a privacy concern.

These rights may be subject to legal exceptions and verification requirements.

Requests can be submitted to support@discoveredyou.com.

22. Automated Systems and Artificial Intelligence

Discovered You may develop or use automated technologies to assist with operational activities such as organising information, identifying service requirements, generating summaries, improving workflows or assisting authorised personnel.

We do not use Google user data obtained through Google authentication to train general-purpose artificial intelligence or machine-learning models.

Where automated functionality materially affects the handling of personal information, we will use appropriate safeguards and update our disclosures where required.

23. Third-Party Services

Our platform may integrate with third-party services such as Google, Firebase, payment processors, hosting providers and other technology providers.

Those providers may independently process information according to their own privacy policies and terms.

This Privacy Policy governs Discovered You’s processing of personal information and does not replace the privacy policies of independent third parties.

24. Google API Services User Data

Discovered You’s use and transfer of information received from Google APIs will adhere to applicable Google API Services User Data Policy requirements, including applicable Limited Use requirements.

We request only Google permissions reasonably necessary for the functionality offered to the user.

At present, where Google Sign-In is used for authentication, our intended use is to obtain the basic identity information necessary to authenticate and associate the user with their Discovered You account.

If additional Google API functionality is introduced in the future, we will update our disclosures and obtain any additional permissions or consent required before using Google user data for that functionality.

This section is especially important for verification because Google’s current guidance requires the published policy to disclose how Google data is accessed, used, stored and shared and to keep those disclosures current.

25. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our services;
• new functionality;
• changes in our data practices;
• changes to third-party integrations;
• legal or regulatory requirements; or
• security and operational developments.

The latest version will be published on this page with an updated Last Updated date.

Where a change materially affects how we use personal information or Google user data, we will provide additional notice or obtain consent where required.

26. Contact Us

For questions, concerns, privacy requests or data-deletion requests, contact:

Discovered You International (Private) Limited
Trinco Road
Batticaloa
Sri Lanka

Email: support@discoveredyou.com
Telephone: +94 77 462 8867
Website: discoveredyou.com