Legal

Privacy Policy

Last updated: 21 September 2026

This Privacy Policy explains how Javith Hansana, who operates VidStrata (“VidStrata”, “we” or “us”), collects, uses, shares and protects personal data. It applies to our website, to the customers who hold a VidStrata account, and to the viewers who watch video delivered through our service on our customers’ websites and applications. It should be read together with our Terms & Conditions.

We handle personal data in line with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka and, where it applies to you, other data-protection laws such as the EU and UK General Data Protection Regulation.

1. Our two roles

• As a controller, we decide why and how we handle personal data about visitors to our website, people who contact us, and the staff of our customers who use the dashboard, API and billing. This Policy is our notice to those people.
• As a processor, we handle personal data about the viewers of our customers’ video (“End Viewers”) on the customer’s behalf and on its instructions. The customer is the controller of that data and is responsible for telling its viewers about it. If you are an End Viewer and want to exercise a privacy right, please contact the website or service that showed you the video first; we will support them in responding to you.

2. What we collect

Website visitors and enquiries

• Contact form: full name, company, email address, telephone number (optional), estimated monthly volume, and the message you write, together with the date and time and the IP address the submission came from (used for spam protection).
• Technical data: like any website, our hosting infrastructure processes your IP address, browser type and pages requested in server logs for security and reliability. Our pages load fonts from Google Fonts, which means your browser contacts Google’s servers and Google receives your IP address.
• We do not use advertising or analytics cookies or trackers on our marketing website.

Customers and their staff

• Names, work email addresses, roles and login information of people who use the dashboard; account, site and billing details; API and credential metadata (secrets are stored in protected form); usage and invoice records; and the correspondence we exchange with you.

End Viewers (processed for our customers)

• Viewer identifier supplied by the customer (for example a user ID or pseudonym) and the content being watched.
• Connection and device data: IP address, browser and device information, and time zone signals needed to deliver video securely.
• Playback and security events: session start, segments requested, watch time, errors, concurrency and other events used for billing, analytics, abuse prevention and blocking of suspicious sessions.
• Forensic watermark data: a unique code assigned to a viewer for each piece of watermarked content, which determines which visually identical variants of the video that viewer receives, and which links that viewer identifier to the content. If a copy of the video leaks, the marks in it can be analysed to identify the session it came from.
• Visible on-screen identifier: where the customer enables it, the player can overlay the viewer identifier on the picture as a deterrent.
• Evidence material: when a customer or we investigate a suspected leak, the suspect recording that is uploaded for analysis and the analysis results.

3. Why we use personal data and our legal bases

• To provide, operate and secure the service and to bill for it — performance of our contract with the customer, and our legitimate interest in running a reliable and secure service.
• To detect, prevent and investigate piracy, fraud, credential sharing and other abuse, including through forensic watermarking — our legitimate interests and those of our customers in protecting their content, and for End Viewers the customer’s lawful basis for delivering protected content.
• To respond to enquiries and to provide sales and support information — your request and our legitimate interest in running our business. You can ask us to stop contacting you at any time.
• To comply with legal obligations, enforce our agreements and defend legal claims.
• To maintain and improve the service using aggregated or de-identified statistics.

We do not sell personal data, we do not use it for advertising, and we do not use End Viewer data to profile viewers for any purpose other than delivering, securing and tracing the customer’s content.

4. Forensic watermarking and privacy

Forensic watermarking is a security control. The marks embedded in the video and audio are not visible to viewers, and they are used only to trace the source of unauthorised copies. Because the codes are tied to a viewer identifier, customers who enable the feature must have a lawful basis to do so and must inform their viewers appropriately. Watermark codes are kept for as long as the content exists so that a leak from an earlier viewing can still be traced. Any action against an individual is decided by the customer, not by VidStrata.

5. Who we share personal data with

• The relevant customer — for End Viewer data, and for reports and evidence about their own content.
• Service providers (sub-processors) that host our systems, store and deliver content, provide text-recognition used in evidence review, deliver email, and supply DRM licensing. They may only use the data to provide their service to us and are bound by confidentiality and data-protection obligations. A current list of provider categories and details is available on request.
• Professional advisers, authorities and courts where we are required by law or to protect rights, safety and security.
• A successor in a merger, acquisition or sale of our business, who must continue to protect the data as described here.

6. International transfers

Our providers operate data centres in several countries, so personal data may be processed outside Sri Lanka and outside your own country. Where we transfer personal data internationally we rely on safeguards recognised by applicable law, such as contractual protections and our providers’ certified security and privacy commitments.

7. How long we keep personal data

• Contact-form enquiries are kept for as long as needed to respond and to manage the resulting business relationship, and then deleted or anonymised.
• Account, billing and contract records are kept for the life of the account and afterwards for the period needed for tax, accounting and legal-claims purposes.
• End Viewer playback and security logs are kept for a limited period needed for billing, security and abuse investigations, as set by the customer’s configuration and our retention practices, and then deleted or aggregated.
• Watermark codes and related evidence are kept while the content exists and as needed for open investigations. They are deleted when the content is deleted or the account is closed, in line with our Terms.
• Backups are overwritten in the normal backup cycle.

8. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, encrypted content delivery, access controls with multi-factor authentication for staff, segregation of customer data, rate limiting, and activity logging and monitoring. If a personal data breach affects you, we will notify affected customers and the relevant authority as the law requires.

9. Your rights

Depending on where you live, you may have the right to: be informed about how your data is used; access your data; correct it; delete it; restrict or object to certain processing; receive it in a portable format; withdraw consent where we rely on it; and not be subject to decisions based solely on automated processing that significantly affect you. To exercise these rights about data we control, email sales@javithhansana.lk. We may need to verify your identity, and we will respond within the time the law allows. For End Viewer data, please contact the customer whose video you watched. You also have the right to complain to the Data Protection Authority of Sri Lanka or to the supervisory authority where you live.

10. Children

Our website and dashboard are for business users and are not directed at children. Our customers may deliver video to audiences that include minors (for example, educational platforms). Those customers are responsible for having the lawful basis, parental consent and notices that the law requires for their viewers, and we process that data only for them.

11. Cookies and similar technologies

Our marketing website does not set advertising or analytics cookies. The video player and service may use short-lived tokens and browser storage that are strictly necessary to authorise playback and keep a session secure. These are not used for advertising.

12. Changes to this Policy

We may update this Policy to reflect changes in our practices or the law. The date at the top shows when it was last updated. If a change is material we will notify customers by email or through the dashboard.

13. Contact us

VidStrata, operated by Javith Hansana, Sri Lanka
Email: sales@javithhansana.lk