PRIVACY POLICY

1. Who we are

Citrus Arc Studio (SSM 202503267271 (003780123-A)) is a design and development studio based in Selangor, Malaysia, and is responsible for the personal data described here. You can reach us at hello@citrusarc.studio.

2. What we collect

When you send the enquiry form on our Get In Touch page, we collect:

• your full name
• your email address
• your phone number and country code
• your budget range
• your project description
• a PDF file, if you choose to attach one

When you visit the site, some information is also collected automatically:

• usage data from Google Analytics, such as the pages you visit, your device and browser type, and your approximate location, collected with cookies if you allow them
• page view and loading speed statistics from Cloudflare Web Analytics, collected without cookies
• your IP address, which the form server holds briefly to block spam and repeated submissions

3. Why we collect it

• to reply to your enquiry and discuss or quote for your project
• to send you an email confirming we received your message
• to protect the enquiry form from spam and abuse
• to understand how visitors use the site so we can improve it

4. Do you have to give it to us?

We need your name, email, phone number, budget range, and project description to reply to your enquiry, so the form can't be sent without them. Attaching a file is optional. If you'd rather not use the form, you can email us or message us on WhatsApp instead.

5. Who we share it with

We don't sell your personal data. We share it only with the service providers that help us run the site and reply to you:

• Mailjet, which delivers your enquiry to us and sends your confirmation email
• Google, which hosts the inbox where enquiries arrive (Gmail) and provides Google Analytics
• Namecheap, which hosts our contact inbox, hello@citrusarc.studio (Private Email)
• Cloudflare, which hosts this website and the enquiry form, and provides Cloudflare Web Analytics

These providers may store or process data outside Malaysia. We may also disclose personal data where the law requires us to.

6. How long we keep it

Enquiries aren't stored in a database. They arrive in our email inbox, where we keep them for as long as we need to handle your enquiry and any project that follows, and for our business records. After that, we delete them unless the law requires us to keep them longer.

The IP addresses used to block spam are held only in the form server's memory and cleared within an hour.

7. How we protect it

The site and the enquiry form use encrypted HTTPS connections, and access to our inbox is limited to the Citrus Arc Studio team.

8. Cookies and analytics

We use Google Analytics to see how visitors use the site. Its cookies are only set if you choose Allow in the cookie notice. Until then, Google Analytics sets no cookies and receives only basic signals without identifiers, such as that a page was viewed.

To change your choice, clear this site's data in your browser settings and the cookie notice will appear again. You can also block or delete cookies in your browser settings, or install Google's Analytics opt-out add-on. The site works fine either way.

We also use Cloudflare Web Analytics, which counts page views and loading speed without cookies and without tracking you across other websites.

9. Your rights

Under the PDPA, you can:

• ask for a copy of the personal data we hold about you
• ask us to correct data that is inaccurate, incomplete, or out of date
• withdraw your consent, or ask us to limit how we use your data
• ask us to delete your data once we no longer need it

To make a request, email hello@citrusarc.studio. We'll respond within 21 days.

10. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it last changed.