Highkeyflair · Kota Damansara

Privacy Policy

How we collect, use and protect your personal information.

Last updated: 3 September 2026

Highkeyflair ("we", "the studio") is an independent photography studio and gear-rental space in Kota Damansara, Malaysia. This page explains what personal information we collect through this website and the Highkeyflair Studio app, why we collect it, where it lives, and the choices you have.

What we collect

• Studio bookings — your name, email, phone number, preferred date/time, package and tier, extras/add-ons, and any promo code you apply.
• Gear hire & waitlist — your name, email, phone, the gear you want, and your requested date.
• Client proofing gallery — your email (if we invite you to a gallery) and the selections/reviews/comments you make (favourites, alternates, prints, retouch notes).
• Invoicing & payment — your legal/billing name, email, address, tax identifiers (TIN / BRN / MSIC / SST), phone, your payment reference and any proof image you upload.
• Transaction records — invoice numbers, amounts, SST and payment status, kept for accounting and Malaysian e-invoicing obligations.
• Your browser — we use your browser's local storage to remember booking choices and (for the operator) to keep integration keys. We do not use tracking cookies, ad cookies or cross-site identifiers.

Why we collect it

• To provide studio booking, gear hire, proofing, invoicing and payment.
• To confirm availability and fulfil your shoot or order.
• To communicate with you about your booking, proofs or invoice (by email, WhatsApp or phone).
• To keep accurate accounting and meet Malaysian tax / e-invoicing requirements.
• Operator-only: to send phone push notifications (ntfy) and to store selected images in Google Drive.

Where your data lives

We use a small number of trusted processors, each behind HTTPS and access controls:

• Firebase (Google) — website hosting, sign-in, and the Firestore database that holds bookings, invoices and galleries behind security rules. Payment receipts are stored in Firebase Cloud Storage (original files, retained 7 years for tax).
• Google Vertex AI (Gemini) — our payment-receipt OCR reads the amount, reference, payer name and date from your uploaded transfer screenshot/PDF so we can verify it faster. Images are processed in Google's asia-southeast1 (Singapore) region and never used for any other purpose. Extraction is a verification aid only — the bank's record is always authoritative.
• Resend — our transactional email provider (booking confirmations, invoice emails, payment results, reminders, door codes) and separate marketing sender (news).
• Google Drive — studio-selected images and folders (via the Google Picker you authorise with drive.file scope).
• ntfy — a free push-notification service (we send a topic/token; message bodies carry no personal data).
• WhatsApp (Meta) — the studio may message you about a booking or order.

Marketing

• We only send studio news, rate updates and openings to people who explicitly opted in (a checkbox at booking — never pre-ticked), and we confirm the opt-in by email before the first send.
• Every marketing email has a one-click unsubscribe, honoured within 48 hours. Booking, payment and reminder emails are transactional — you get them because you booked, and they do not depend on marketing consent.
• We don't sell your data, and we don't add third-party trackers to our emails.
• Consent records (what, when, where) are kept so we can prove we had your permission.

How long we keep it

• Booking and invoice records: for as long as our relationship continues and as required by tax and accounting law (in Malaysia, up to 7 years).
• Proofing galleries: until you ask us to remove them, or the selection window closes.
• You can ask us to delete your personal data at any time, subject to our accounting obligations.

Your rights

Under the Personal Data Protection Act 2010 (Malaysia) you can request access to, correction of, and withdrawal of consent to the personal information we hold about you. You can also ask for a copy of your data (portability) and for erasure of marketing contact details — tax records are kept for the 7 years the law requires. Email studio@highkeyflair.com and we'll respond — we aim to reply within 21 days.

Incidents

If a data incident occurs we contain it, assess the risk, and notify the Personal Data Protection Commissioner and affected individuals within 72 hours where required, then review it in our incident log.

Security

• The whole site is served over HTTPS.
• Firestore security rules restrict who can read or write each record.
• Public availability data is stored without personal details (dates only).
• Invoice and client-access links use high-entropy, one-time tokens rather than guessable IDs.

Children

The studio is not directed at anyone under 16 and we do not knowingly collect personal information from children.

Contact

studio@highkeyflair.com · Highkeyflair Studio, Kota Damansara, Malaysia.