Privacy policy

Last updated: 7 October 2026

This policy explains what personal data Yellow House Productions collects through yellowhouse.art, why we collect it, and the choices you have. We wrote it to meet Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA), and the EU and UK General Data Protection Regulation (GDPR) for visitors in Europe.

Who we are

Yellow House Productions (Pvt) Ltd, company number PV00308408, 708/D, Mahakumburawaththa, Heiyanthuduwa, Sri Lanka. We are the controller of the personal data described here. For any privacy question or request, write to admin@yellowhouse.art.

What we collect and why

When you contact us or request a paper

When you send the contact form or the paper request form, we receive your name, email address, organisation or institution if you add it, and whatever you write. For a paper request this also includes how you plan to use the paper. The form passes your message through our website host to our email delivery provider, Resend, which delivers it to our inbox at admin@yellowhouse.art. The website itself does not keep a copy or a database of messages.

We use these details only to reply to you, send you what you asked for, and follow up on it, such as a demo, a project, a partnership or a paper. We do not add you to a mailing list.

Legal basis: under the GDPR, our legitimate interest in answering enquiries, or taking steps at your request before entering into a contract. Under the PDPA, processing that is necessary for the purpose you contacted us for, or your consent.

Google Analytics, only with your consent

We use Google Analytics 4 to understand which pages people visit, how they arrive and roughly where they are in the world, so we can improve the site. It does not run unless you click "Allow analytics" on the banner. If you choose "No thanks", or never choose, no analytics script is loaded and no analytics cookies are set.

If you allow it, Google Analytics sets first-party cookies (named _ga and _ga_ followed by an ID) that last up to two years, and collects information such as pages viewed, time on page, device and browser type, and an approximate location derived from your IP address. Google Analytics 4 does not log or store full IP addresses. We do not use Google Analytics for advertising, and we have turned off Google signals and data sharing for ads. We keep analytics data for 14 months.

Legal basis: your consent. You can change your mind at any time with the "Cookie settings" link at the bottom of every page. Withdrawing consent stops analytics from then on and removes the analytics cookies from your browser.

Hosting and security logs

The site is hosted on Vercel. Like any web host, Vercel processes technical data such as your IP address, browser type and the pages requested, so the site can be delivered and protected against abuse. Legal basis: our legitimate interest in running a secure website.

Fonts

Our typefaces load from Google Fonts. When your browser fetches them, Google receives your IP address and browser details. No cookies are set for this.

Things we store in your browser

We save your analytics choice in your browser's local storage so we do not ask again on every visit. It never leaves your device.

We do not sell personal data. We share it only with the service providers that run the site for us: Vercel (hosting and the form handler), Resend (delivering form messages to our inbox), Google (analytics, only with your consent, and fonts) and our email provider. They process data on our instructions and under their own data protection terms.

International transfers

Our providers may process data outside Sri Lanka and outside the European Economic Area, including in the United States. Where the GDPR applies, these transfers rely on safeguards such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework. Where the PDPA applies, we make sure transfers meet its requirements for cross-border processing.

How long we keep data

We keep emails for as long as we need them to deal with your enquiry and any work that follows, and then delete them, unless the law requires us to keep them longer. Resend keeps a short delivery log of each message under its own policy. Analytics data is kept for 14 months. Hosting logs are kept by Vercel for a short period under its own policy.

Your rights

Under the PDPA you can ask to access your personal data, withdraw your consent, have inaccurate data corrected or completed, have data erased, and ask for a review of any decision made about you only by automated means. We do not make automated decisions about you through this site.

Under the GDPR you can also ask us to restrict or stop processing, object to processing based on our legitimate interests, and receive your data in a portable format.

To use any of these rights, email admin@yellowhouse.art. We will answer within the time the law allows, normally within one month. If you are unhappy with our answer, you can complain to the Data Protection Authority of Sri Lanka or, if you are in Europe, to the data protection authority where you live or work.

How we protect data

The site is served only over HTTPS and uses strict browser security headers. It has no user accounts and no database of visitors, so there is very little personal data to protect in the first place. The forms are protected against spam and misuse, and only accept messages sent from this website. Emails are handled in accounts protected by strong passwords and two-step verification.

Children

This site is meant for institutions, partners and the general public. It is not aimed at children under 16, and we do not knowingly collect their personal data. If you think a child has sent us personal data, contact us and we will delete it.

Other websites

We link to our games and to articles about our work on other websites, such as helixra.art, whosegame.art, thearchivistgame.art and news sites. Their own privacy policies apply when you visit them.

Changes to this policy

If we change how we use personal data, we will update this page and the date at the top.