Privacy Notice

Last updated 9 October 2026

Citrus Send is operated by Citrus Arc Studio (202503267271 (003780123-A)), a business registered in Malaysia.

This Privacy Notice explains what personal data we collect, why we collect it, who processes it for us, how long we keep it, and the choices and rights available to you.

Who is responsible for your data?

Citrus Arc Studio is responsible for the personal data processed through Citrus Send.

If you have a question about your personal data, want to make an access or correction request, or want to make a complaint, contact:

Citrus Arc Studio (hello@citrusarc.studio)

What personal data do we collect?

Depending on how you use Citrus Send, we may collect:

Account information

If you create an account, we collect your email address.

We use it to sign you in and to show you your own sending and signing history.

Recipient information

When you send a file, create a signing request, or invite somebody to a live note, we collect the email addresses you provide for the recipients, signers or invitees.

We use these addresses to deliver download links, signing requests, invitations and related messages.

If you receive a signing request or an invitation to a live note, your email address was generally provided to us by the person who created it rather than collected directly from you.

Live notes

If you create a live note, we collect the text written in it and any files attached to it, together with information such as their names and sizes.

We keep a record of activity in the note so that its owner can see what happened to it: who joined, who edited it, and who added or removed a file.

Where the owner has shared a note by link, anybody holding that link can open it and, if the owner allows it, write in it. We do not know who those people are. Their changes are recorded against a one-way code derived from their network address, which we cannot reverse into an address or use to identify them.

Files and documents

We collect the files you upload, together with information such as their names and sizes.

We use these files to provide the file-sharing and signing services you requested.

Where a document is signed through Citrus Send, the resulting signed copy and the information associated with the signing are retained as part of the signing record.

We do not read, scan or index the contents of files you upload.

Signature information

When someone signs a document, we may keep the signature as an image and the text used to create it.

We use this information to place the signature in the document and to maintain evidence of the signing event.

Signing and audit information

For a signing request, we keep information such as who was invited to sign; when the request was sent; when the request was opened; when the document was signed or rejected; when the signing request was cancelled or expired; confirmation that the signer agreed to sign electronically; and a one-way hash derived from the IP address associated with the sending or signing activity.

The IP address itself is not stored as part of this record.

This information forms the audit trail associated with a signing request.

Cookies

Citrus Send uses a small number of cookies required for the service to work.

One keeps you signed in. Another remembers your language choice.

These cookies are used only for the service and are not used to identify you across other websites.

Google Analytics

If you allow analytics cookies, we use Google Analytics to understand how people use the site and to count visits.

Google Analytics may recognise your browser across visits and is processed by Google in the United States.

Analytics is optional. If you do not allow it, the rest of the site continues to work.

Why do we collect your data?

We use personal data to:

provide file sharing, document-signing and live note services;
deliver files, download links, signing requests, live note invitations and reminders;
create and maintain your account;
maintain your sending and signing history;
create and preserve signing records and audit trails;
protect the service against abuse and excessive automated use;
enforce the rules that apply to the service;
respond to support requests and complaints;
understand how the site is used when analytics has been allowed; and
comply with legal obligations.

We do not sell personal data and do not use your personal data for third-party advertising.

Do I have to provide my personal data?

It depends on how you use Citrus Send.

You do not need an account or an email address to create an ordinary share link.

An email address is required when you want Citrus Send to deliver a file to a specific recipient by email or when you create a signing request, because we need an address to deliver the request.

If you choose not to provide information that is necessary for a particular feature, we may not be able to provide that feature.

Who processes your data?

We use service providers to operate Citrus Send. They process data on our behalf and are subject to the arrangements we put in place with them.

Neon

Neon provides the database used for accounts, recipients, signing records and audit information.

Relevant data is stored in Singapore (ap-southeast-1).

Cloudflare

Cloudflare provides hosting and object storage used for uploaded files.

Requests are handled at the Cloudflare location nearest the visitor, and uploaded files are stored in Cloudflare's Asia-Pacific region. Cloudflare is a company operating internationally, including from the United States.

Mailjet

Mailjet sends emails such as share links, signing requests and reminders.

Mailjet operates in the European Union.

Google Analytics

Google Analytics provides website traffic measurement when analytics has been allowed.

It is processed by Google in the United States.

We may also disclose personal data where required or permitted by law, including where necessary to respond to a lawful request, protect the service or protect the rights and safety of users or others.

Transfers outside Malaysia

Some of the service providers we use process or store personal data outside Malaysia.

Where personal data is transferred outside Malaysia, we take the steps required by applicable Malaysian data-protection law and consider the protections applicable to the destination and the transfer.

The processors and locations currently relevant to Citrus Send are listed above.

How long do we keep your data?

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, unless a longer period is required or permitted by law.

Shared files

Shared files are deleted when the associated share expires. A one-time share is also deleted when its one-time availability ends. Once an expired share and its files have been deleted, we cannot recover them.

Live notes

A live note stays available until it is closed by its owner or until its expiry passes, and its expiry moves forward each time somebody edits it. Once a note has closed, its text and any files attached to it are deleted about two days later. After that we cannot recover them.

Live note activity records

We keep a record of activity in a live note — who joined, edited, added or removed a file, and when — for as long as the note's contents are kept, and delete it with them. Where a change was made by somebody who was not signed in, that record identifies them only by a one-way code derived from their network address, which we cannot reverse into an address.

Unsent signing requests

Signing requests that have been started but not sent are deleted after they have remained unsent for one day.

Signed agreements

Signed agreements are retained for seven years from completion, unless a longer period is required by law or reasonably necessary to establish, exercise or defend legal rights.

Signing audit trails

The audit information associated with a signed agreement is retained for the same period as the signed agreement because it forms part of the evidence of the signing event.

Account information

Account information is retained while your account is active and for as long afterwards as reasonably necessary for legitimate business, legal, security or dispute-resolution purposes.

Support and other records

Support correspondence and related records may be retained for as long as reasonably necessary to handle the request, resolve disputes, prevent abuse and meet legal obligations.

How do we protect your data?

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.

Uploaded files are held in private storage and are accessible through Citrus Send according to the rules governing the relevant share or signing request.

Account passwords are stored only as a salted one-way hash, never as the password itself. The 6-digit codes we email to confirm an address or reset a password are also stored only as one-way hashes, and expire after 15 minutes.

Signing links are generated as random values, and we store only a one-way hash of each signing link rather than the working link itself.

For sending and signing activity, IP addresses used for rate-limiting and audit purposes are converted to one-way hashes. The underlying IP address is not stored as part of that record.

No internet service can guarantee absolute security. If we become aware of a personal data breach that requires notification under applicable law, we will investigate, contain and respond to it and make the notifications required by law.

What happens if there is a data breach?

We maintain procedures for identifying, containing, investigating and responding to personal data breaches.

Where a breach meets the applicable notification requirements, we will notify the Personal Data Protection Commissioner as soon as practicable and within the timeframe required by law, including the applicable 72-hour timeframe.

Where the breach causes or is likely to cause significant harm to affected individuals, we will also notify affected individuals as required by law and without unnecessary delay.

We will take reasonable steps to contain the incident, reduce further risk and prevent a recurrence.

What are my rights?

Subject to applicable law, you may ask us to:

provide access to personal data we hold about you;
correct inaccurate or incomplete personal data;
limit or stop certain processing where the law gives you that right; and
address a complaint about how your personal data is handled.

Requests can be made to:

Citrus Arc Studio (hello@citrusarc.studio)

We may need to verify your request before providing access to personal data or making changes.

Some information may not be capable of deletion where we are required or permitted to retain it, including a signed agreement and its audit trail where those records are needed as evidence of a transaction or to establish, exercise or defend legal rights.

If we cannot comply with a request in full, we will explain why and tell you what we can do instead.

You may also make a complaint to the Personal Data Protection Commissioner.

Changes to this Privacy Notice

We may update this Privacy Notice when our service, processing activities or legal obligations change.

When we make a material change, we will update the date at the top of this notice and, where appropriate, provide additional notice through the service.

Contact

If you have questions about this Privacy Notice or how Citrus Send handles personal data, contact:

Citrus Arc Studio (hello@citrusarc.studio)