What we collect, and what we don’t.
No legal fog. This is a plain description of what actually happens when you use mycocoon.life and our programmes: what gets collected, why, how long we keep it, and how to have it removed.
Last updated 22 October 2026 · Cocoon, Sri Lanka
The law we follow
This policy was written to meet, and we handle personal data in line with, Sri Lanka’s Personal Data Protection Act, No. 9 of 2022 (the PDPA). Cocoon decides why and how your personal data is used, which makes us responsible for it under the Act. Questions about anything on this page go to [email protected].
The short version
You can use almost everything on this site without telling us who you are. None of our free tools require an account. We do run analytics, we do keep the details you type into a form, and the AI tools send what you write to an AI provider so they can answer you. Every kind of data we hold has a stated reason and a stated time limit, listed below. That’s the whole picture; the rest of this page is the detail.
What you give us on purpose
Enquiry and contact forms
When you fill in a form, booking a call, asking about a programme, downloading something, we keep what you typed: usually your name, email, phone, organisation and message. We use it to reply to you and to keep track of the conversation. It’s stored in our own database on Cloudflare, and a copy is emailed to us.
If the email address you give is a company domain, we look up publicly available information about that company, what it does, roughly how big it is, where it’s based, so we can have a useful first conversation. This is public information about the business, not about you personally.
Registering for a cohort or programme
When you sign up for a cohort, a programme or its waitlist, we keep your name, email, phone number and the programme you chose, and later what we need to run it for you: attendance, submitted work, feedback, certificates and invoices. The sign-up form asks you to confirm that we may use these details to tell you about the cohort and everything that comes with it.
Job and trainer applications
If you apply for a role or to train with us, we keep the details on the form and your CV, stored securely in our own systems and read by a person, not filtered by software. We use them only to consider you for that role, or a similar one that opens soon after.
The AI tools
Our AI tools are powered by a mix of third-party AI providers. What you type is processed by the provider to generate your result. We don’t attach your name to it and we don’t keep a copy for ourselves, though like any AI tool, your input is handled under the provider’s own policies.
So: please don’t paste anything confidential, client data, personal details of other people, anything under NDA, into these tools. Describe the shape of the problem instead. This is the same advice we give in our training.
The camera tools never upload anything
Hand Garden and SignBridge use your webcam. The video is processed entirely inside your browser and never leaves your device: there is no upload endpoint, nothing is recorded, and nothing is stored. Close the tab and it’s gone.
What gets collected automatically
Like most sites, we use analytics to understand what people find useful and what’s broken:
- Google Analytics: pages visited, roughly where in the world from, which link brought you here.
- Microsoft Clarity: anonymised session recordings and heatmaps, so we can see where a page confuses people. Clarity masks text input by default.
- LinkedIn Insight Tag: tells LinkedIn which pages were visited, so we can measure our LinkedIn ads and show them to people who have already found us.
These set cookies. The privacy banner you see on your first visit lets you opt out, which switches them off for that browser. Google’s own opt-out add-on and your browser’s tracking protection work too. We also keep a simple count of page visits and which tools get used. That’s a number, not a profile.
Who else is involved
We’re a small team, so we use other people’s infrastructure rather than building our own. Your data may pass through:
- Cloudflare: hosting, and the database and file storage where form submissions and CVs live.
- Resend: sends our email notifications and confirmations.
- Cal.com: the booking calendar, when you schedule a call.
- AI providers: Cloudflare Workers AI, OpenRouter, DeepSeek, Anthropic and similar services that run the AI tools.
- Search providers: used only for the public company lookup described above.
- Instagram: embedded content on a few pages, which loads from their servers and can see that you visited that page.
Some of these providers process data outside Sri Lanka. We use them only for the purposes on this page. We don’t sell your data, and we don’t share it with anyone outside this list. We don’t send marketing email to people who never asked for it.
How long we keep things, and why
Every kind of personal data we hold has a purpose, a legal reason under the PDPA, and a time limit. When the time is up it is deleted, or stripped of anything that identifies you.
| What | Why we keep it | Legal basis | How long |
|---|---|---|---|
| Enquiries and the notes attached to them | To reply, and to move forward with the cohorts or programmes you asked about, so we recognise you if you come back. | Legitimate interest | While the conversation is live, and up to 2 years after our last contact. |
| Cohort and programme registrations | To run the cohort or programme you signed up for: schedules, attendance, your work, feedback, certificates and invoices, and to tell you about cohort-related details. | Contract (you registered), and consent for cohort updates | For the programme and 2 years after it ends, so we can reissue certificates. Invoices and payment records are kept as long as tax and accounting rules require. |
| Job and trainer applications, if you are not selected | To consider you for the role you applied for, or a similar one that opens soon after. | Consent | 6 months after the decision, then deleted. Email us and we’ll delete your CV and application at any time before that. |
| Job and trainer applications, if you join us | Become part of your working record with us. | Contract | For as long as you work with us, and as employment and tax rules require afterwards. |
| Free tool sign-ups (for example the AI Readiness Score, lab access, downloads) | To send what you asked for, and the follow-up you agreed to. | Consent | Up to 2 years after you last used a tool. Team AI Readiness results are deleted after 7 days, as the tool promises. |
| Cocoon Kids (see the next section) | To run the Kids programme and keep each child’s progress. | Parent or guardian consent | Until consent is withdrawn, or 12 months after the child’s last activity, whichever comes first. |
| Analytics | To see which pages help people and which confuse them. | Consent (you can opt out on the banner) | Each provider’s own retention schedule. |
If you’d rather we didn’t keep any of it, just say so, see below.
Children and Cocoon Kids
Cocoon Kids is our AI learning programme for children aged roughly 8 to 12, so we take children’s data more seriously than anything else on this page.
You must not give us your personal information if you are under 16 without the consent of your parent, or someone with parental authority over you. Outside Cocoon Kids, we do not knowingly collect children’s personal information, and if we learn we have, we delete it.
Parent or guardian consent comes first
We ask a parent or guardian for consent before we collect any child’s data. Signing up for the Hatch List, or unlocking the Kids tools, is done by a grown-up with their own email address and an explicit consent tick. We never ask a child for their email, phone, address, school or photo.
What we collect for Cocoon Kids, and why
| What | Why |
|---|---|
| Parent or guardian’s name, email and WhatsApp number | To record consent, tell you about the programme and sessions, and send the 6-digit code that unlocks the tools. |
| Each child’s first name (or nickname) and age | To greet them by name, pick activities that suit their age, and keep their progress. |
| Progress: levels finished, badges, coins and time spent | So a child can pick up where they left off, and so we can see which lessons work. |
| Approximate location (city or country) and device type | Added automatically by our hosting, to spot problems on particular devices and understand where families use it. |
What we never keep: anything a child types, draws, says or photographs. The AI activities send what a child types to an AI provider to get an answer, with a filter that removes phone numbers and email addresses first, and nothing of it is stored by us. The camera activities run inside the browser and never upload anything.
Parents’ rights
A parent or guardian can, at any time and without giving a reason:
- ask to see the data we hold about their child;
- have it corrected;
- have it deleted;
- withdraw consent, after which we stop using the data and delete it.
Email [email protected] from the address you signed up with and we’ll do it, and confirm once it’s done.
Your rights, and getting your data back or deleted
Under the PDPA you have the right to ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything that’s wrong or out of date;
- delete it;
- withdraw any consent you gave, which stops the use that relied on it;
- stop contacting you, or object to how we use it.
Email [email protected] and ask. You don’t need to give a reason and we won’t ask for one; we may ask you to confirm it’s really you before handing anything over. We’ll confirm once it’s done. If you’re not happy with how we handled it, you can complain to Sri Lanka’s Data Protection Authority.
Security, honestly stated
The site runs on Cloudflare with encrypted connections throughout, access to the database is restricted to the people who need it and logged, and we keep the amount of personal data we hold deliberately small, the least we need to do the job. No system is perfectly secure, and we’d rather say that plainly than claim otherwise. If something ever goes wrong with your data, we’ll tell you and the authorities as the PDPA requires. If you find a security problem here, please tell us at [email protected].
Changes
If we start collecting something new, or change how long we keep something, this page changes and the date at the top changes with it.
Asking us anything
Cocoon is based in Sri Lanka and works across South and Southeast Asia. For anything on this page, or any question about your data, write to [email protected] and a person will answer.