Privacy notice

Who we are

This website, ghosts.lk, is run by Ghost Protocol (Private) Limited, a company registered in Sri Lanka (Company No. PV00305227), based in Colombo, Sri Lanka. We decide how the information described here is used, which makes us its controller under Sri Lanka’s Personal Data Protection Act and under the GDPR.

For anything on this page, email ryan@ghosts.lk or call or message +94 71 055 5055.

The short version

• Cloudflare, which hosts the site, sets one security cookie to tell people from automated programs. We set no cookies of our own, and run no analytics or advertising trackers.
• We collect what you type into our forms and the chat, and what you send us by email.
• We do not sell it, and we do not share it with anyone for their marketing.
• We keep enquiries until you ask us to delete them. We do not store chat conversations or scan results.

What we collect and why

Enquiries through the contact form

What: your name, email address, company (if you give it), your message, and which service the enquiry is about. We also record the country your connection comes from, as Cloudflare reports it. We do not record your IP address with the enquiry.

Where it goes: Formspree, a form service, emails the enquiry to us and keeps a copy in our Formspree account. A second copy is saved in our own database, which runs on Cloudflare. If your browser is not running the page’s scripts, the form goes to Formspree only.

Why, and the legal basis: to answer you and, if you ask, to prepare a quote or an agreement. That is taking the steps you asked for before a contract.

Keeping spam out: the form has a hidden field that only automated programs fill in. Your browser keeps the times of your recent submissions and counts those from the last 15 minutes, so it can slow down repeated sending, and our server counts submissions from each IP address, deleting the count an hour after the last one. We do this because we have a legitimate interest in keeping the form usable.

The penetration test intake

The intake form at /pentest/intake collects your name, email address and company, the hostnames and scope you describe, and, if you ran it, the result of the free scan of your site. It goes to the same two places as an enquiry, for the same reason, and is kept the same way.

Sol, the AI assistant

What: the messages you type. If you ran a free scan in the same browser tab, a summary of it (the site address, grade, score and top fixes) is sent with your messages so Sol can discuss it.

Where it goes: our server sends the latest part of the conversation (up to 12 messages) to an AI model, Meta’s Llama, run by Cloudflare Workers AI, to write the reply. We do not store the conversation, and we do not write its contents to our logs. It exists in your open browser tab and is gone when you close or reload the page.

If you ask us to contact you: when you give Sol your name and email address and agree to be contacted, it saves your name, email address, a short message, what you are interested in and the country your connection comes from to our database, as an enquiry. Sol is set up to do this only after you agree.

Limits: to stop the assistant being used by automated programs, our server counts messages against a one-way scrambled form (a SHA-256 hash) of your IP address, and deletes the count an hour after your last message.

Legal basis: answering questions you ask about our services is our legitimate interest; saving your details to contact you is done with your consent, which you can withdraw.

Sol is an AI. Its answers can be wrong, and nothing it says is a quote or a commitment. We make no decisions about you by automated means alone. AI agents can use the same tools (the free scan, and passing on contact details) through our public connector at ghosts.lk/mcp. What they send is handled in the same way, and their use is counted per IP address for an hour.

The free scan

What: the website address you ask us to check. Our server sends that site at most 42 requests, DNS lookups included: it reads the home page, robots.txt and the sitemap, asks for files that should never be public (such as /.env and /.git/config), and sends a few test requests designed to change nothing. The scan page lists every one. It looks up the site’s public DNS records through Google Public DNS, so Google receives the site’s domain name. The result goes back to your browser. We do not store the address or the result in any database.

Logs: like every request to ghosts.lk, a scan appears in Cloudflare’s request logs for up to 7 days, with your IP address (see server logs below). The address you scan is in those logs too when it is part of the page’s link, as in ghosts.lk/scan?url=example.com. That is what the scan box sends if the page’s scripts are not running, and what a shared scan link looks like. It is also logged, as a security event, when we refuse to scan it, for example because it is a private network address.

In your browser: the scan page keeps a list of your last 20 scans in your browser’s storage, and your latest scan is kept for the session so Sol can refer to it. Both stay on your device; you can clear them in your browser settings.

Limits: to prevent abuse we count scans from each IP address (10 an hour) and, separately, malformed requests. Each count is deleted within an hour. This is our legitimate interest in keeping the scanner from being misused against other people’s sites.

Paying online

When you pay by card, our store at store.ghosts.lk opens a Stripe Checkout page. Stripe collects your card and billing details on its own page under its own privacy policy; we never see your full card number. Stripe passes us the details of the payment: your email address, the name and billing details you entered, the amount, what you bought and whether the payment completed. We use them to deliver what you bought and to keep our accounts. The legal basis is the contract with you, and the law that requires us to keep financial records.

Email, WhatsApp and calls

Email to a ghosts.lk address passes through Cloudflare’s email routing on its way to our inbox. If you message us on WhatsApp, WhatsApp (Meta) carries the message under its own privacy policy. If you book a 15-minute call, Cal.com collects your name, email address and the time you choose under its own privacy policy, and passes them to us. We use what you send to reply, and to do the work you ask for.

Server logs and referral counts

Every visit to ghosts.lk passes through Cloudflare, which hosts the site. Cloudflare keeps a log of each request our server code handles, which can include your IP address, the page or address requested and the time, for up to 7 days, so we can find faults. We do not write the contents of forms or chat messages into these logs.

If your browser blocks a script on one of our pages under our security policy, it sends us a short report: the page’s path (without anything after a “?”), which rule of the policy it broke, where the script came from, and a fingerprint (a hash) and the length of the script’s first characters. We log those details but not your IP address (the report, like every request, is still in Cloudflare’s request logs above), and to limit reports we count them against a hash of your IP address for up to an hour.

If you arrive from a credit link on a website we built for a client, we add one to a daily count for that website and page. Nothing about you is stored with the count, and counts are deleted after 90 days.

Cookies and your browser

ghosts.lk sets no cookies of its own, and the chat and the free scan set none either. One cookie does reach your browser: cf_clearance, set by Cloudflare, which hosts the site. When a page loads, your browser runs a short, invisible check from Cloudflare that tells people from automated programs, and the cookie records the result. It is strictly necessary to protect the site from automated abuse, so it is set without asking for consent. It lasts about a year, and Cloudflare sets and reads it as our processor.

We run no analytics, advertising or tracking scripts, so no analytics or advertising cookies are set.

The site uses your browser’s own storage for three small things: the times of your recent contact form submissions, the list of your last 20 free scans, and your latest scan for the current session. None of it leaves your device, except that the latest scan is sent with your chat messages, as described above. The site also installs a service worker that keeps copies of its pages and files so they load faster and work offline; it stores no form contents or messages.

Stripe’s checkout page and Cal.com’s booking page are on their own websites and set their own cookies.

Who handles it for us

• Cloudflare: hosts the site, our database, the AI model behind Sol, the request logs, the security cookie described above and our email routing (privacy policy).
• Formspree: delivers and stores form submissions (privacy policy).
• Stripe: card payments (privacy policy).
• Cal.com: call booking, if you book one.
• WhatsApp (Meta): messages, if you send us one.
• Google Public DNS (dns.google): receives the domain name of each site you ask the free scan to check, because our server looks up that site’s public DNS records through it (privacy policy).

We do not sell your information, and we do not share it with anyone for their marketing.

Where it is processed

We are in Sri Lanka. The companies above are based outside Sri Lanka, and your information can be processed in other countries, including the United States. Cloudflare answers each visit from a data centre near the visitor. Each provider describes how it protects information it moves between countries in the privacy policy linked above.

How long we keep it

Enquiries, intake forms and details saved by Sol

Until you ask us to delete them. We have no automatic deletion for these yet. Formspree keeps its copy under its own rules.

Chat conversations

Not stored by us.

Free scan addresses and results

Not stored in any database; kept in your browser until you clear it. An address that is part of a page’s link, or that we refuse to scan, stays in the request logs for up to 7 days.

Spam and abuse counts

Deleted an hour after the last request they count, or sooner.

Request logs at Cloudflare

Up to 7 days.

Referral counts (no personal information)

90 days.

Payment records

Kept for our accounts and tax filings.

Email and messages

Kept while the conversation or the work needs them, or until you ask us to delete them.

Everything between your browser and ghosts.lk is encrypted: the site redirects plain HTTP to HTTPS and tells browsers never to connect to it any other way.

Your rights

You can ask us to:

• tell you what we hold about you and give you a copy of it;
• correct it if it is wrong;
• delete it;
• stop using it, or object to how we use it;
• withdraw consent you gave, for example to be contacted.

Email ryan@ghosts.lk from the address you used with us, so we can tell the request is yours. We reply within 24 hours and answer in full within one month.

If you are in the European Union or the United Kingdom, the GDPR or the UK GDPR gives you these rights now, along with the right to receive your information in a portable format and to ask us to limit how we use it.

In Sri Lanka, the Personal Data Protection Act, No. 9 of 2022, is coming into force in parts. Parts I and III commence on 1 January 2027 (Gazette Extraordinary 2498/16 of 22 July 2026). Part II, which sets out the rights of the people the data is about, has no commencement date yet. We answer the requests above from anyone, wherever they live, today.

Complaints

Please tell us first, and we will try to put it right. You can also complain to a data protection authority:

• In Sri Lanka, the Data Protection Authority:
  BMICH Block 5, First Floor
  Bauddhaloka Mawatha, Colombo 07
  info@dpa.gov.lk
• In the European Union, the authority in your country (list of authorities).
• In the United Kingdom, the Information Commissioner’s Office (ico.org.uk).

Changes to this notice

When what the site collects changes, we change this page and the date at the top of it. If you want the version that applied on an earlier date, ask us.