Privacy Policy

1. Who we are

This website and the class are run by Citrus Arc Studio (“we”, “us”). We decide how your data is used. You can reach us at:

• Citrus Arc Studio (202503267271 (003780123-A))
• Selangor, Malaysia
• Email: hello@citrusarc.studio
• WhatsApp: +601159956435

2. What we collect

• Details you give us: your name, email, phone number, and anything you write in the optional notes box.
• Booking details: your topic, date and time, the amount paid, and the payment reference.
• Payment: you pay on CHIP's secure page. We never see or store your card or online banking details.
• Technical data: your IP address, kept for a few minutes to stop abuse of the booking form, and, only if you accept cookies, how you use this page (see section 6).

Your name, email and phone number are required to book. Without them we can't confirm your seat or contact you about the class.

3. Why we use it

• To take your booking and payment, and to give refunds.
• To send your confirmation, calendar invite and class reminders.
• To contact you about your class, by email or WhatsApp.
• To prepare the class around what you want to learn.
• To keep accounting and tax records required by law.
• To keep the website secure and working.

We don't send marketing messages unless you ask us to, and we never sell your data.

4. Who we share it with

Only with the services that help us run the class, and only what they need:

• CHIP (payments): your name, email, phone and the amount.
• Mailjet (emails): your name and email, to send your confirmation and reminders.
• Google: your name and email on the class calendar invite, and Google Analytics if you accept cookies.
• Upstash (database) and Cloudflare (hosting): where your booking is stored and this site runs.

Some of these services store data outside Malaysia. We choose providers that protect data to a standard similar to the PDPA. We may also share data when the law requires it.

5. How long we keep it

We keep booking records for as long as we need them for your class, and then for up to 7 years for accounting and tax purposes, as Malaysian law requires. After that we delete them.

6. Cookies and similar storage

• Needed for the site to work: we remember your cookie choice, and, while you pay, which booking is yours so the Back button can restore your form. These stay in your browser and aren't used for tracking.
• Analytics (optional): Google Analytics cookies show us how many people visit and which parts of the page help. They are only set if you press “Accept” on the cookie banner.

You can change your choice at any time with “Cookie settings” at the bottom of every page.

7. How we protect it

Your data travels over encrypted connections (HTTPS), is stored with access limited to us, and payments are handled entirely by CHIP.

8. Your rights

Under the PDPA, you can ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is wrong or out of date;
• stop using your data, or delete it, where we're not required to keep it.

Email hello@citrusarc.studio and we'll reply within 21 days. You can also send questions or complaints about how we handle your data to the same address.

9. Changes to this notice

If we change this notice, we'll update the date at the top of this page. See also our Terms.