Privacy policy

• Your account. Your email address and the name you give us. You sign in with a one-time code we email you, or with Google, Facebook or X.

• Sign-in with Google, Facebook or X. We receive your email address from the provider and use it only when the provider confirms it is verified. We do not store your provider password, access tokens or contacts, and we do not post anything on your behalf.

• Orders and bookings. Your name, email, phone number and delivery address, what you bought or booked, and when.

• Payments. When you pay online, HitPay processes the payment. We receive the payment status and reference, never your card or online-banking details. When you pay by bank transfer, we see the payer name and account shown on the transfer in our bank statement.

• E-invoices. If you ask for an e-invoice, the details Malaysia's MyInvois system requires, such as your tax identification number.

• Messages. What you send us in an enquiry or a submission to show your work.

• Your IP address and browser type. We store them with your session while you use the sites, and delete them soon after the session expires, two hours after your last visit. We also store your IP address with each online order to limit abuse of checkout, and remove it after 30 days.

• Cookies and browser storage. A session cookie that keeps you signed in, a security cookie that protects forms from forgery, and a "remember me" cookie after you sign in. Your cart and saved works stay in your own browser's storage and are not sent to us until you check out. We do not use advertising or analytics cookies.

• To create your account and sign you in.

• To take payment, deliver your order, run your workshop booking and contact you about them.

• To issue e-invoices and keep the records Malaysian tax law requires.

• To answer your messages.

• To keep the sites secure, for example by limiting repeated sign-in attempts.

We do not sell your personal data, and we do not send you marketing email unless you ask for it.

Only the services we need to run the sites, and only what each one needs:

• HitPay, to process payments.

• Couriers, to deliver your order.

• LHDN (Inland Revenue Board of Malaysia), through MyInvois, when we issue an e-invoice.

• Our hosting and email providers, who store and process data for us under our instructions.

• Google, Facebook or X, only if you choose to sign in with them; they see that you signed in to Senso.

We may also disclose data when the law requires it.

We keep your account while you use it. Order, payment and e-invoice records are kept for seven years, as Malaysian tax law requires. Session data, including your IP address and browser type, is deleted soon after the session expires. The IP address stored with an order is removed after 30 days. Sign-in codes expire within minutes and are deleted soon after.

You can ask us to show you the personal data we hold about you, to correct it, or to delete your account. Email [email protected] from the address on your account. We reply within 21 days. Records the law makes us keep are kept until that period ends.

You can change your name yourself on your account page.

If we change this policy, we update this page and the date at the top. For a significant change, we tell account holders by email.