Highkeyflair · Kota Damansara

Privacy Policy

How we collect, use and protect your personal information.

Last updated: 03/09/2026

Highkeyflair ("we", "the studio") is an independent photography studio and equipment-rental space in Kota Damansara, Malaysia. This page explains what personal information we collect through this website and the Highkeyflair Studio app, why we collect it, where it lives, and the choices you have.

What we collect

• Studio bookings, your name, email, phone number, preferred date/time, package and tier, extras/add-ons, and any promo code you apply.
• Equipment hire & waitlist, your name, email, phone, the equipment you want, and your requested date.
• Client proofing gallery, your email (if we invite you to a gallery) and the selections/reviews/comments you make (favourites, alternates, prints, retouch notes).
• Invoicing & payment, your legal/billing name, email, address, tax identifiers (TIN / BRN / MSIC / SST), phone, your payment reference and any proof image you upload.
• Events & potluck signups, your name, email, phone/WhatsApp, Instagram handle (required for the potluck), the dish you commit to bring, about what time you will get there, guest count, any notes/allergies you share, and your conversation with the studio in the event chat (limited to that event’s thread; nobody else can see it).
• Transaction records, invoice numbers, amounts, SST and payment status, kept for accounting and Malaysian e-invoicing obligations.
• Member sign-in (optional), your email, display name if you set one, and your marketing consent choice. Signing in links your bookings and perks to that email so they follow you across devices. Booking never requires an account.
• Your browser, we use your browser's local storage to remember booking choices and (for the operator) to keep integration keys. We do not use tracking cookies, ad cookies or cross-site identifiers.

Why we collect it

• To provide studio booking, equipment hire, proofing, invoicing and payment.
• To confirm availability and fulfil your shoot or order.
• To communicate with you about your booking, proofs or invoice (by email, WhatsApp or phone).
• To run studio events, confirm your seat, send your event pass and reminders, and let you chat with the studio about the event.
• To keep accurate accounting and meet Malaysian tax / e-invoicing requirements.
• Operator-only: to send phone push notifications (ntfy) and to store selected images in Google Drive.

Where your data lives

We use a small number of trusted processors, each behind HTTPS and access controls:

• Firebase (Google), website hosting, sign-in, and the Firestore database that holds bookings, invoices and galleries behind security rules. Payment receipts are stored in Firebase Cloud Storage (original files, kept securely for tax records).
• Google Vertex AI (Gemini), our payment-receipt OCR reads the amount, reference, payer name and date from your uploaded transfer screenshot/PDF so we can verify it faster. Images are processed in Google's asia-southeast1 (Singapore) region and never used for any other purpose. Extraction is a verification aid only. The bank's record is always authoritative.
• Resend/Brevo, our transactional email provider (booking confirmations, invoice emails, payment results, reminders, door codes, event passes and event chat replies) and separate marketing sender (news).
• Google Drive, studio-selected images and folders (via the Google Picker you authorise with drive.file scope).
• ntfy, a free push-notification service (we send a topic/token; message bodies carry no personal data).
• WhatsApp (Meta). The studio may message you about a booking or order.

Marketing

• We only send studio news, rate updates and openings to people who explicitly opted in (a checkbox at booking, never pre-ticked), and we confirm the opt-in by email before the first send.
• Every marketing email has a one-click unsubscribe, honoured within 48 hours. Booking, payment and reminder emails are transactional, you get them because you booked, and they do not depend on marketing consent.
• We don't sell your data, and we don't add third-party trackers to our emails.
• Consent records (what, when, where) are kept so we can prove we had your permission.

How long we keep it

• Booking and invoice records: for as long as our relationship continues and as required by tax and accounting law (in Malaysia, up to 7 years).
• Proofing galleries: until you ask us to remove them, or the selection window closes.
• Event signups and chat: while the event is active and up to 12 months after, so the table’s history stays yours to revisit; you can ask for earlier erasure any time.
• Member accounts: while your account exists; sign-in rate-limit records are overwritten hourly. Deleting your account removes your profile; booking and invoice records stay as tax law requires.
• You can ask us to delete your personal data at any time, subject to our accounting obligations.

Your rights

Under the Personal Data Protection Act 2010 (Malaysia) you can request access to, correction of, and withdrawal of consent to the personal information we hold about you. You can also ask for a copy of your data (portability) and for erasure of marketing contact details, tax records are kept for the 7 years the law requires. Email highkeyflair@gmail.com and we'll respond. We aim to reply within 21 days.

Incidents

If a data incident occurs we contain it, assess the risk, and notify the Personal Data Protection Commissioner and affected individuals within 72 hours where required, then review it in our incident log.

Security

• The whole site is served over HTTPS.
• Firestore security rules restrict who can read or write each record.
• Public availability data is stored without personal details (dates only).
• Invoice and client-access links use high-entropy, one-time tokens rather than guessable IDs.

Children

The studio is not directed at anyone under 16 and we do not knowingly collect personal information from children.

Contact

highkeyflair@gmail.com · Highkeyflair Studio, Kota Damansara, Malaysia.