Privacy Policy

1. Who we are

Ciptarix ("we", "us") is an AI-powered web studio operating in Malaysia, serving websites on ciptarix.com and its subdomains and taking orders at app.ciptarix.com. For anything in this policy, contact us on WhatsApp 011-5693 6225 or hello@ciptarix.com.

2. What we collect

• Account data — your name, email address, phone number and password (stored as a salted hash; we can never read it) when you create an account.
• Google sign-in — if you choose "Continue with Google", we receive your name, email address and Google account identifier from Google. We use them only to create and sign in to your account; we never receive your Google password and we do not access anything else in your Google account.
• Order & business data — the details you submit for your website: business name, address, operating hours, descriptions, links and any content you provide.
• Payment data — payment amounts and status. Online payments are processed by BillPlz; your card or banking credentials go to them directly and never touch our servers. For bank transfers we see only what appears on the transfer receipt you send us.
• Publicly available business information — for businesses we approach with a preview website, we use listing data that is already public (e.g. Google Maps business profiles).

3. How we use it

• To build, deliver, host and maintain your website.
• To process payments and send you order confirmations, receipts and progress updates (email and/or WhatsApp).
• To respond to support requests and change requests.
• We do not sell your personal data, and we do not use it for third-party advertising.

4. Who we share it with

Only the service providers needed to run the product: Cloudflare (website hosting and delivery), BillPlz (online payment), Google (only if you use Google sign-in) and our email delivery provider (transactional emails such as receipts and password resets). Each receives only what it needs to perform its function.

5. Preview websites & takedown

We sometimes build preview websites for businesses using their publicly listed information, so the owner can see the result before deciding. If a preview site is about your business and you want it removed, tell us on WhatsApp — we take it down promptly on request and record your opt-out so we never approach you again.

6. Retention & security

We keep account and order data for as long as your account or website is active, and financial records as required by Malaysian law. Data is stored on access-controlled systems, transmitted over HTTPS, and backed up securely. Passwords are hashed with bcrypt.

7. Your rights (PDPA)

You may request access to, correction of, or deletion of your personal data, and you may withdraw consent to processing (which may mean we can no longer provide the service). Contact us via WhatsApp or email above — we respond within 14 days.

8. Changes

If this policy changes materially, we will note the new date at the top of this page and inform active customers.