Privacy Policy

ADE is currently operated by Academy of Design Excellence (Pvt) Ltd., Sri Lanka. Registered address: 166/A, FIELD VIEW, BANGALAWATTA, HAPUGALA, WAKWELLA, Sri Lanka.

For personal data where ADE determines the purposes and means of processing, ADE generally acts as the data controller. An employer, training provider, organization or other third party using ADE may also act as an independent controller for information it collects or uploads for its own purposes.

We may collect information you provide directly, including your name, email address, telephone number where required, account details, profile information, skills, projects, learning activity, assessment submissions and results, credentials, opportunity applications, organization information, support messages, referral activity and other information you choose to submit.

We also process technical and security information needed to operate ADE, such as IP address, browser and device information, session identifiers, security events, route or feature usage, provider event identifiers and diagnostic data.

When you purchase an ADE subscription, course or other paid digital service, Stripe may receive information needed to complete and secure the transaction, such as your name, email, order description, amount, currency and payment identifiers.

Full payment-card details are handled by Stripe and are not intended to be stored in ADE databases. ADE may retain payment status, provider references, subscription information, ADE invoice numbers, credit-note and refund records, and other information required for access control, accounting, support, fraud prevention and reconciliation.

If you respond to an ADE Meta advertisement or contact a WhatsApp number connected to an ADE campaign, ADE may receive limited lead metadata such as your telephone number, display name where supplied by the provider, message identifier and type, contact time, campaign/ad attribution identifiers, referral source information and follow-up status.

ADE's lead ingestion is designed to retain campaign-attributed lead metadata rather than WhatsApp message bodies. Message text or message previews are not retained in the ADE lead tracker, and brand-new chats that cannot be attributed to an ADE Meta campaign are not added as new ADE CRM leads.

We process personal data to create and secure accounts, provide learning and professional features, calculate progress and results, issue and verify credentials, manage applications and business workspaces, administer subscriptions and billing, attribute referrals, manage campaign inquiries, provide support, prevent fraud and abuse, maintain service reliability and comply with legal obligations.

Depending on the activity and applicable law, the legal basis may include performance of a contract or steps requested before entering one, compliance with legal obligations, ADE's legitimate interests in operating and securing the platform, or your consent where consent is required. Optional analytics are based on your explicit browser choice and remain off until allowed.

ADE professional profiles are private unless you choose to publish them. When published, profile fields you intentionally make public, public projects, skills and eligible verification or credential evidence may be visible to employers, businesses and other visitors.

Private application contact details, private assessment submissions, billing information and private learning resources are not automatically published as professional evidence.

ADE uses service providers that support the platform, including Supabase for application data and authentication, Vercel for hosting and web analytics, Google Analytics 4 when you allow optional analytics on Production, Stripe for payment processing, email delivery providers, and Meta/WhatsApp and WAIA Connect where those channels are used for campaign lead delivery.

We share only information reasonably necessary for those providers to perform their functions. We may also disclose information where required by law, to respond to valid legal process, protect ADE or users, investigate fraud or abuse, or complete a legitimate business reorganization subject to applicable safeguards. ADE does not sell personal data to advertisers.

ADE uses essential browser technologies for authentication, security and platform operation. Some tools also use browser local storage for functional purposes such as remembering your analytics choice, keeping a local draft or applying a browser-based usage limit.

When you arrive through an ADE referral link, ADE may store a referral identifier for up to 30 days for individual referrals and up to 90 days for eligible business referrals so qualifying activity can be attributed while applying self-referral and fraud controls.

Optional analytics remain off until you explicitly allow them in this browser. When allowed, ADE may use Vercel Web Analytics and, on the Production site, Google Analytics 4. ADE removes sensitive query parameters before first-party analytics events are sent and does not enable advertising personalization through this analytics choice.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, and for legal, accounting, security, fraud-prevention, credential-verification or dispute-resolution needs. Retention therefore varies by category.

Referral attribution is normally limited to the configured 30-day or 90-day window. ADE operational monitoring is configured to prune lower-risk resolved or informational events after 90 days, with a 180-day maximum operational-event history and up to 365 days for webhook/email operational histories. Account, learning, credential, billing and tax records may need to be kept longer where service integrity or law requires it.

Sri Lanka's Personal Data Protection Act No. 9 of 2022, as amended by Act No. 22 of 2025, is being brought into operation in stages. As of this policy date, key processing and controller/processor provisions are scheduled to come into operation on 1 January 2027, while the statutory data-subject-rights provisions are subject to separate commencement. ADE is using this transition period to align its privacy processes with that framework.

Regardless of staged commencement, ADE will accept reasonable requests to access personal data, withdraw consent where processing is based on consent, correct or complete inaccurate information, request deletion where appropriate, request that certain processing stop, or ask for review of a decision based solely on automated processing. Applicable law may provide additional or different rights.

Send a request to support@thisisade.com from an address we can reasonably verify. We may request limited information needed to confirm identity and locate relevant records. Some records may be retained where ADE has a lawful reason or obligation to keep them.

ADE is designed for users in more than one country. Our infrastructure and service providers may process information outside Sri Lanka or outside the country where you live. Where applicable law requires safeguards for international processing or transfers, ADE will use appropriate contractual, technical or organizational measures and limit access to what is necessary.

ADE uses access controls, authentication safeguards, row-level database security, role checks, signed provider events, private storage controls, audit logging and other technical and organizational measures intended to reduce unauthorized access, disclosure, alteration or loss. No internet service can guarantee absolute security.

ADE is not intended to be used in violation of local age or parental-consent requirements. Where a user is below the age at which they can independently consent to an online service or relevant processing in their jurisdiction, the required parent or guardian authorization must be obtained.

We may update this Privacy Policy when ADE, our providers, our legal entity or applicable requirements change. Material changes will be reflected on this page with an updated revision date.

For privacy requests or account questions, contact support@thisisade.com. For billing questions, contact payments@thisisade.com.

If you believe ADE has not handled a privacy matter appropriately, you may contact the Data Protection Authority of Sri Lanka or another competent privacy regulator where the applicable law and commencement framework gives that authority jurisdiction over the matter.