Privacy Policy

Who is responsible

The controller of your data is Jiigetsu (sole proprietor), Philippines. Contact: hello@jiigetsu.com. Purchases are processed by Polar, which acts as merchant of record and is the seller of record for your order; Polar is an independent controller for payment and tax data under its own privacy policy.

What I collect

• Email address and first name (name optional) when you request the free brush or take the assessment.
• Instagram handle, if you message me on Instagram or give it to me.
• Approximate location (country, region, city) derived from your IP address, plus the IP address itself at sign-up as a consent record and for abuse prevention.
• Assessment answers, including optional age range and gender if you choose to answer them.
• Usage events: pages viewed, forms submitted, checkout started, the campaign link you arrived from (UTM tags), and which page variant you saw.
• Images you upload to Art Shield (beta), plus your IP address for rate limiting. Both are deleted automatically after 7 days. The palette extractor and colour wheel run in your browser and upload nothing.
• Purchase data from Polar: what you bought, amount, date and order status. I never see your full card details.
• Cookies, described below.

Why, and on what legal basis (GDPR)

• Sending the free brush you asked for: performance of a contract / your request (Art. 6(1)(b)).
• Selling and delivering products, handling refunds and support: contract (Art. 6(1)(b)) and legal obligations such as tax records (Art. 6(1)(c)).
• Newsletter and marketing emails: your consent (Art. 6(1)(a)), given when you request the free brush or finish the assessment (this is stated right under the button). If you tell the assessment you are under 18, you get the brush but are not added to the newsletter. You can withdraw any time via the unsubscribe link in every email.
• Follow-up emails about the offer you signed up for: legitimate interest (Art. 6(1)(f)), with an unsubscribe link in every email.
• First-party funnel stats, A/B tests, fraud and spam prevention: legitimate interest (Art. 6(1)(f)) in running and improving a small business.
• Optional age and gender in the assessment: your consent, by choosing to answer.
• Advertising cookies (Google Ads, Meta Pixel; none in use): consent only, asked before any are set.

How long I keep it

• Lead data (email, name, answers): until you unsubscribe or ask for deletion, and in any case deleted after 3 years without any interaction.
• Purchase records: as long as tax and accounting law requires (typically up to 10 years; held mostly by Polar).
• Usage events: deleted automatically after 24 months.
• Anonymous visitor records (never linked to an email): deleted automatically after 13 months.
• Art Shield uploads and results: deleted automatically after 7 days.
• Privacy requests and consent records: as long as needed to prove compliance.

Who processes it for me

I use these service providers. Each only gets what it needs to do its job, under a data processing agreement.

International transfers

I am based in the Philippines and my providers are mostly in the United States, so your data is transferred outside your country. Where you are in the EU/EEA, UK or Switzerland, these transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses (and the UK addendum), together with the providers' security measures.

Cookies

Essential cookies keep the site working: your free brush, your personal offer timer, and first-party visit counts, including which website referred you (no third-party trackers, nothing sold or shared). If your browser sends a Global Privacy Control signal, the referring website is not stored. No ad cookies or pixels are in use. If that ever changes, they will load only after you opt in, and you will be asked again.

Your rights

Everyone

Wherever you live, you can ask for a copy of your data, ask me to correct or delete it, and unsubscribe from emails at any time. I answer within 30 days.

EU / EEA / UK (GDPR)

• Access, rectification, erasure, restriction and data portability.
• Object to processing based on legitimate interest, including direct marketing (always honoured).
• Withdraw consent at any time, without affecting earlier processing.
• Complain to your local data protection authority.

California and other US states (CCPA/CPRA and similar)

• Know what personal information is collected, used and disclosed, and get a copy.
• Delete and correct your personal information.
• Opt out of the "sale" or "sharing" of personal information. I do not sell or share your personal information for cross-context behavioural advertising, and I don't use sensitive personal information beyond what's needed to provide the service.
• Non-discrimination for exercising your rights. You can use an authorised agent.

Philippines (Data Privacy Act of 2012)

You have the rights to be informed, access, object, erasure, rectification, data portability and to lodge a complaint with the National Privacy Commission.

Use the form below or email hello@jiigetsu.com. Because anyone can type any address into a form, I confirm every request by email with the owner of the address before acting on it.

Security and children

Data is sent over HTTPS, stored with access controls, and only I can access it. This site is not directed at children under 16, and I don't knowingly collect their data. If you believe a child has signed up, email me and I'll delete it.

Changes

If this policy changes in a meaningful way, I'll update the date above and, where appropriate, tell subscribers by email.