PRIVACY POLICY

This Privacy Policy explains how Levelstair (Pvt) Ltd ("Levelstair", "we", "us"), the registered entity behind the Levelstair Community platform at portal.levelstair.com and its companion mobile app (Levelstair Community, for Android and iOS), collects, uses, discloses, and safeguards information when you create an account or otherwise use the platform or the app. The app is covered in Mobile App below.

Levelstair (Pvt) Ltd is the controller of the personal data described in this Policy, for the purposes of the Personal Data Protection Act, No. 9 of 2022 (as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025). You can reach us at privacy@levelstair.com.

By creating an account, you confirm that you have read and understood this Policy. If you do not agree with it, please do not register or use the platform.

We do not ask for, and ask that you do not submit, special categories of personal data as defined in section 56 of the Act: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, genetic or biometric data, data concerning health, sex life or sexual orientation, or data relating to offences, criminal proceedings and convictions. The platform has no field that asks for any of it. Where such information appears in free text you write yourself (a bio, a character description, a report), it is processed only incidentally, and you can remove it at any time.

We process personal data only where the Act permits it. The table below sets out the basis we rely on for each category, as required by items (c) and (d) of Schedule V.

Where we rely on your consent you may withdraw it at any time, and withdrawal does not affect the lawfulness of processing carried out before you withdrew it. Google linking is the only feature that relies on consent. Unlinking it from your account settings withdraws that consent, and your account continues to work with your password.

• Create and manage your account, and authenticate your sessions.
• Operate core features: profiles, the member directory, events, game jams, Amberfrost, badges, and the community canvas.
• Communicate with you about events, account activity, security, or policy updates.
• Moderate the platform, investigate reports, and enforce the Code of Conduct.
• Maintain the security, integrity, and reliability of our systems.

We do not sell your personal data, and we do not use it to serve third-party advertising.

We share information only where necessary to operate the platform, and never for marketing resale:

Sri Lanka has not, to date, issued an adequacy decision under section 26(2) of the Act in respect of any country. Your personal data is processed outside Sri Lanka, specifically:

Our lawful basis

For the transfers that are unavoidable in order to give you an account (database hosting, application hosting, and account email), we rely on section 26(5)(b): the transfer is necessary for the performance of our contract with you. There is no Sri Lanka-hosted alternative in our stack, so an account cannot exist without them. For optional Google account linking we rely on section 26(5)(a): your explicit consent, which you withdraw by unlinking.

The risk you should know about

When you create an account we ask you to acknowledge this specifically, separately from accepting our Terms.

We use strictly necessary cookies to keep you signed in and to keep signing in secure: a short-lived cookie while you finish a Google sign-in or a two-factor check, and, only if you tick "Trust this device", a cookie that skips the two-factor check on that browser for 30 days. We do not use advertising or cross-site tracking cookies, and for that reason we do not show a cookie banner: there is nothing optional to consent to. The one exception is the Luma calendar, which you choose to load yourself (see section 5). You can control cookies through your browser settings, though disabling them will prevent you from staying signed in.

Alongside the cookie itself we store a session record against your account containing your IP address and browser user-agent. This lets you see and revoke your active sessions, and lets us detect suspicious sign-ins. Retention for these records is set out in section 8.

We keep personal data only for as long as is necessary for the purpose it was collected for, as section 9 of the Act requires.

If you close your account we remove or anonymise your personal data on the schedule above, except where retention is required for legal, security, or dispute-resolution purposes, for example, records tied to an open moderation report.

How to make a request, and what happens next

Email privacy@levelstair.com with your request. We may need to verify your identity first, and may ask you for additional information in order to do so (section 17(4)).

We will respond in writing without undue delay and within one month of receiving your request. If we need longer we may extend that by up to two further months (a maximum of three months in total), and we will tell you about the extension, with our reasons, before the first month is up (sections 17(1), 17(1A) and 17(1B)).

Requests are free of charge (section 17(6)).

We may refuse a request on the grounds listed in section 17(2), for example where acting on it would harm the rights and freedoms of another person, or where we cannot establish your identity. If we refuse, we will tell you why, and we record our reasons as section 17(3) requires.

If you live outside Sri Lanka

Levelstair is run from Sri Lanka and this Policy is written to Sri Lanka's Act, but we give every member the rights above wherever they live. If a law where you live gives you stronger rights, for example the EU or UK GDPR, or the Nigeria Data Protection Act 2023, we will honour them, and you may also complain to the data protection authority in your own country. Where such a law requires it, we will notify that authority of a personal data breach within 72 hours of becoming aware of it.

You must be 16 or older to hold an account on this platform. Under section 56 of the Act a "child" is anyone under 16, and personal data relating to a child is a special category of personal data. We have set our minimum age to match that threshold rather than process children's data on this platform at all.

We ask for your date of birth when you register and verify it server-side. We do not knowingly collect personal data from anyone under 16 here. If you believe someone under 16 has created an account, contact us and we will review and remove it.

Some Levelstair chapters and campus programs run supervised, in-person sessions that include students under 16. Those programs do not use this platform and do not create accounts here. They run under a separate parental and guardian consent process, and any personal data collected in them is handled outside this platform. Contact us for details of how a specific program handles data.

Passwords are stored using industry-standard hashing and are never visible to our staff in plain text. We apply reasonable technical and organisational safeguards to protect your data, but no online system can be guaranteed 100% secure. Please use a unique, strong password for your account, and turn on two-factor authentication from your account settings. Two-factor authentication is required for every admin account.

Found a security problem? Please tell us privately; see our security page.

If something goes wrong. We maintain a process for identifying, escalating and responding to personal data breaches. If a breach occurs we will notify the Data Protection Authority, and affected members, in the form, manner and time the Authority requires by rules made under section 23 of the Act, and within 72 hours wherever another law that applies to you requires it (see section 9). Where a breach is likely to affect you, we will tell you what happened, what data was involved, and what we are doing about it.

We do not make automated decisions about you. Jam and Amberfrost scores are arithmetic totals of votes and points cast by people. Badges are awarded automatically only after an administrator approves a submission. Moderation outcomes, suspensions, badge revocations and dispute rulings are all made by a person.

We do use automated checks to protect the platform (a bot check and rate limiting at sign-in, sign-up and password reset), but these only slow down or block a request. They make no lasting decision about you, and no record that affects your standing.

Because we make no decision "based solely on automated processing" with an irreversible and continuous impact on your rights, section 18 of the Act does not currently apply to us. If that changes, we will describe the logic involved, its significance, and its envisaged consequences here first.

Levelstair operates official bots in our Discord server. Our moderation bot reads message content and attachments to enforce our Code of Conduct, and keeps logs of warnings, mutes, and bans against a member's Discord user ID. We process this under legitimate interest (Schedule I(f)), to keep the server and its members safe. Our event and game jam bots post announcements and reflect submission, RSVP, and score information already held on the Platform into the server. We process this under contract (Schedule I(b)), to run the programs you signed up for.

Discord itself processes data you send in our server (including messages, reactions, and your Discord account details) under its own Privacy Policy, as the platform we don't control. This section covers only what our own bots do with that data.

Other bots may be present in the server that Levelstair did not build and does not operate. We have no visibility into, or control over, what those bots collect or do with it. That is governed entirely by their own developers' privacy policies, and any question about them should go to that bot's operator rather than to us.

We may update this Policy as the platform evolves. Material changes will be reflected by updating the "Last Updated" date above, and, where appropriate, communicated to members directly. Continued use of the platform after changes take effect constitutes acceptance of the revised Policy.