Privacy Notice

01Who we are

BuildMetric Consultancy, Colombo, Sri Lanka ("BuildMetric", "we", "us") provides independent cost, commercial, contracts, claims and project advisory for clients in Sri Lanka and the Middle East. We run this website, including its enquiry form, client accounts and administration area. This notice applies to personal information collected through it.

Questions about this notice or your information: srilanka@buildmetric.com.

02Information we collect

• Account. When you register: your name, email address, an optional phone number and a password. The password is kept only as a one-way hash, never in readable form, and your phone number is stored encrypted. We also record when you confirm your email address.
• Google or Facebook sign-in. If you choose to sign in with Google or Facebook, we receive your name, email address and the account number that provider uses for you, and for Google whether it has verified your email address. We do not receive your Google or Facebook password, and we do not store your profile picture or anything else from those accounts.
• Links we email you. When you register or ask to reset your password, we email you a single-use link. We keep only a scrambled code (a one-way hash) of it, with its expiry time, and delete it once it is used.
• Enquiries. When you use the enquiry form: your name, email address, optional phone number, organisation, project country or location, the service you need, a brief description of your requirements, and the page you sent it from. You do not need an account to send an enquiry. Your phone number and your description are stored encrypted.
• Sign-in sessions. When you sign in we create a session record with its expiry time and a scrambled code (a one-way hash) of your browser and operating system type. We use it to tie a session to the device that started it. The code cannot be turned back into your device details.
• Security records. When you sign in, fail to sign in, send an enquiry, download or delete your account, or when our staff change content in the admin area, we record what happened, when, your IP address and your browser type. Email addresses in these records and in our server logs are kept only as a short hash.
• Abuse-prevention counters. To limit repeated requests we keep short-lived counters linked to your IP address or account. To lock an account after repeated failed sign-ins we keep the email address that was typed and the number of failures, for about a day.
• Browser storage. Your browser keeps your language choice, a cached copy of page content so the site loads faster, and your cookie choice (accepted or declined). These stay on your device (see the Cookie Policy).

We do not take payments on this website and never ask for card numbers. We do not use advertising, analytics or social-media trackers, and we do not run a newsletter.

03How we use information

• To create and manage your account and keep you signed in.
• To read your enquiry, reply to you and agree a suitable scope, deliverables and fee. When you send an enquiry, our team receives it by email and we send you a short receipt.
• To confirm your email address and to let you reset a forgotten password.
• To keep the website, our clients and our staff safe from fraud, abuse and security threats, and to investigate incidents.
• To keep the records we need to meet legal obligations and to deal with disputes.

We rely on the steps you ask us to take (such as answering an enquiry), our legitimate interest in running a secure website, legal obligations and, where needed, your consent. We do not sell your information and do not use it for marketing unless you ask us to.

04Service providers and third parties

These services process information on our behalf or are loaded by your browser while you use the site:

• Vercel: website hosting and standard request logs (IP address, browser, pages requested).
• Google and Facebook: sign-in, only if you choose it. You approve it on their site, and they handle it under their own privacy policies.
• Resend: delivery of the emails we send (enquiry alerts to our team, receipts to you, and email-verification and password-reset links).
• A managed PostgreSQL database provider: account, enquiry and session data.
• Cloudinary: images shown on the site and uploaded by our staff. Your browser loads these images directly from Cloudinary, which can see your IP address and browser.
• Google: fonts used across the site, loaded directly by your browser.
• Google Maps (the map on the Contact page) and YouTube (the video player on some service pages): optional, loaded by your browser only if you accept optional cookies.

Third parties handle what they receive under their own policies. Our providers may process information in countries outside Sri Lanka. We share information with authorities only where the law requires it.

05Cookies and local storage

We use two essential sign-in cookies (bm_token and bm_refresh) that keep you signed in securely. They are HttpOnly, so scripts on the page cannot read them, and they are removed when you log out. We also use your browser's local storage for your language choice, a content cache and your cookie choice. Optional cookies, which let us show a Google Map and a YouTube video, are off until you accept them, and you can change your mind at any time from “Cookie settings” in the footer. None of this is used for advertising or tracking.

The full list, durations and how to manage them is in our Cookie Policy.

06How long we keep it

• Account and enquiries: until you delete your account, or ask us to remove them, unless we must keep a record by law.
• Sign-in sessions: removed automatically about a week after they expire or end.
• Google or Facebook connection: until you disconnect it in My Account or delete your account.
• Email links: password-reset links expire after 1 hour and verification links after 24 hours; their records are deleted when used or within about a day of expiring.
• Security and audit records: up to one year.
• Request counters and failed sign-in counters: about one day.
• Information deleted from our systems may remain in our database provider's backups for a limited time before they are overwritten.

07Your rights

You can download a copy of the information in your account, including your enquiries, or permanently delete your account and its enquiries at any time from My Account (deleting asks for your password). To correct your details, ask us to stop using your information, withdraw consent or raise a concern, email us from the address on your account.

Where the law gives you more rights, for example under Sri Lanka's Personal Data Protection Act, No. 9 of 2022, or the law of the country you live in, we will honour them. You may also complain to the data protection authority in your country.

08Security

• The whole website runs over encrypted HTTPS connections.
• Passwords are stored only as one-way hashes. Phone numbers and enquiry descriptions are stored encrypted (AES-256-GCM).
• Sign-in cookies are HttpOnly. Access tokens last 15 minutes, refresh tokens are rotated each time they are used, and a session can be ended on the server at once. Sessions are tied to the device that started them.
• Sign-in attempts and requests are rate-limited, and accounts are locked for a short time after repeated failures.
• Access to data is restricted by role in the application and in the database, and sensitive actions are recorded in an audit log.

No system is completely secure, so we cannot guarantee absolute security. If a breach affects your information we will tell you and the authorities where required.

09Deleting data from Google or Facebook sign-in

If you signed in with Google or Facebook and want the data we received removed:

• To remove the connection only: sign in, open My Account, and choose Disconnect next to Google or Facebook. We delete the record of that connection straight away.
• To delete everything: open My Account and choose Delete my account. Your account, its sign-in connections and your enquiries are deleted permanently.
• If you can no longer sign in, email srilanka@buildmetric.com from the address on your account and we will delete the data for you.

You can also remove BuildMetric from the apps connected to your Facebook account (Settings → Apps and Websites) or your Google account (Security → Third-party connections). That stops future sign-ins; the steps above remove the data we hold.

10Changes to this notice

We may update this notice from time to time. The date at the top shows the latest version (21 October 2026). For material changes we will give notice on the website.

11Contact

Questions about this notice? Email srilanka@buildmetric.com, or use the enquiry form on our Contact page.