Privacy Policy

C8tive Links is operated by VICTOREN STUDIOS. This policy explains how we collect, use, disclose, retain, and protect personal data when people use our page builder, public creator pages, rewards, bookings, RSVP, guestbook, checkout, analytics, support, and admin services.

This policy is intended to support compliance with the Malaysian Personal Data Protection Act 2010 (PDPA).

Account and profile data: email address, username, display name, avatar, bio, phone number, public profile settings, login/session information, and subscription status.

Creator content: pages, links, media, products, custom domains, templates, rewards campaigns, and page settings you create or upload.

Visitor and customer data: booking names, email addresses, phone numbers, notes, orders, RSVP responses, guestbook messages, rewards membership details, stamp/redemption activity, and feedback submissions.

Payment and billing data: subscription plan, Stripe customer/session identifiers, payment status, billing events, and related transaction metadata. Card details are processed by Stripe.

Analytics and technical data: page views, link clicks, referrer, browser/device data, and Google Analytics data only when analytics consent is accepted.

We use personal data to provide accounts, publish creator pages, process bookings/orders/subscriptions, operate rewards programs, display RSVP and guestbook features, provide analytics after consent, secure the service, respond to support or privacy requests, and meet legal obligations.

Page owners may receive visitor/customer details submitted through their page so they can fulfil the relevant booking, order, RSVP, rewards, or message request.

Essential processing such as authentication, security, rate limiting, checkout, and requested form submissions is necessary to provide the service.

Google Analytics and detailed first-party audience analytics are optional. We load them only after visitors choose "Accept analytics" in the privacy banner. Visitors can reject or update preferences at any time.

You may withdraw consent for consent-based processing by updating your privacy preferences or contacting privacy@c8tive.com.

We do not sell personal data. We disclose personal data only where needed to operate the service, comply with law, protect the service, or fulfil user requests.

Processors and infrastructure may include Supabase for database/auth/storage, Vercel for hosting and domain routing, Stripe for payments, Google Analytics for opted-in analytics, email providers for account messages, and domain/DNS providers for custom domain setup.

Public creator pages may intentionally display public profile data, page content, links, media, guestbook messages, contact details, or business information configured by the page owner.

We use access controls, authentication, row-level security, transport encryption, security headers, rate limiting, least-privilege admin access, and sanitized user content to protect personal data.

No internet service can guarantee absolute security. If we identify a personal data incident, we will investigate, contain, document, and notify affected parties or regulators where required.

We keep personal data only as long as needed for the stated purposes, legal obligations, security, dispute handling, and account administration.

Analytics and click/view events are deleted or aggregated after 24 months. RSVP and guestbook data are removed after the configured event retention period. Soft-deleted media is periodically purged. Bookings, orders, and rewards data are retained while the related account/page is active and then deleted or anonymized after the applicable closure period.

Our service providers may process data outside Malaysia. Where data is transferred internationally, we use appropriate service providers and safeguards designed to protect the data according to applicable law.

Subject to applicable law, you may request access, correction, deletion/anonymisation, export, restriction, or withdrawal of consent for your personal data.

Submit requests at privacy@c8tive.com. We may need to verify your identity before acting on a request, especially where the request relates to account, payment, rewards, booking, RSVP, or order data.

The service is not intended for children under 13. Users under 18 should use the service only with parent or guardian consent.

We may update this policy from time to time. Material changes will be posted on this page and, where appropriate, notified through the service or by email.