Privacy Policy

Last updated on 5 Aug 2026

This Privacy Policy explains how CROFT TECH LTD collects, uses, shares and protects personal information when you use Citruss.

Citruss is a booking and payments product. One link to get booked and paid. It lets a professional publish a booking page, share availability, take bookings and receive payment. This policy covers the Citruss website at usecitruss.com, booking pages hosted at citruss.app, and any Citruss apps or services that link to this policy (together, the "Services").

1. Who we are

Citruss is operated by CROFT TECH LTD ("Citruss", "we", "us", "our"), a company registered in [JURISDICTION OF INCORPORATION] under company number [COMPANY NUMBER], with its registered office at [REGISTERED OFFICE ADDRESS].

For questions about this policy or about how we handle your information, contact us at usecitruss@gmail.com.

[IF REQUIRED: EU representative under Article 27 GDPR / UK representative details go here.]

2. Who this policy applies to, and the two roles we play

Citruss has two kinds of users, and our responsibilities differ depending on which one you are. This section matters more than any other in this policy, so it comes first.

Professionals. People and businesses who create a Citruss account to take bookings. Coaches, creators, freelancers, consultants, agencies, service businesses and their team members. For information about Professionals, we are the data controller. We decide why and how that information is used, and this policy governs it.

Clients. People who book or pay a Professional through a Citruss booking page. For information a Client submits when booking, the Professional is the data controller and we act as a processor on their behalf. We handle that information under our agreement with the Professional and under their instructions.

What this means in practice for Clients:

• The Professional you booked with decides what they collect from you, how long they keep it and what they do with it. Their own privacy notice applies to that.
• If you want your booking information corrected or deleted, contact the Professional first. If you contact us instead, we will pass the request on to them and support them in responding.
• We do use limited information about bookings for our own purposes as a controller, specifically to operate and secure the Services, prevent fraud and abuse, meet legal obligations, and produce aggregated statistics. Those uses are described in this policy.

Visitors. Anyone who browses usecitruss.com, joins the waitlist or contacts us without creating an account. We are the controller for that information.

Not covered. This policy does not apply to job applicants or to people we work with as employees or contractors. Separate notices cover those.

3. Information we collect

3.1 Information you give us

Waitlist and marketing signup. Email address, and any other detail you choose to give us such as your name, what you do, or which platform you came from.

Account and profile. Name, email address, password or third party login identifier, your Citruss handle, account type (solo or team), profile photo, business or service description, links you add to your page, and time zone.

Booking setup. Your services, session lengths, prices and currency, recurring weekly availability, and any cancellation or rescheduling rules you configure.

Team accounts. If you set up a team, we collect the names, email addresses and availability of team members you invite.

Payment and payout information. Handled primarily by our payment processor rather than by us. See section 6. We hold the identifiers and records needed to operate the Services, such as your payout account status, transaction records, currency, payout history and invoice records.

Support and communications. Messages you send us, the contents of those messages, contact preferences, and our responses.

Surveys, feedback, events and promotions. Anything you submit if you take part.

3.2 Information Clients submit through booking pages

When a Client books a Professional, we process on the Professional's behalf the information the booking form collects. Typically this is name, email address, phone number if requested, the service booked, the date and time, any notes or intake answers the Professional asks for, and the payment outcome.

Professionals control what their booking forms ask for. Professionals must not use Citruss booking forms to collect special category data such as health information, or any sensitive category data, unless they have their own lawful basis for doing so and have configured their page appropriately. Citruss is not designed as a platform for handling health records or other special category data.

3.3 Information we collect automatically

Device and connection data. IP address, browser type and version, operating system, device type, device identifiers, language setting, and referring and exit URLs.

Usage data. Pages viewed, links clicked, features used, time spent, booking page views, session timestamps, and error and diagnostic logs.

Approximate location. Derived from IP address, used for currency defaults, time zone handling, fraud prevention and analytics. We do not collect precise device location unless you separately grant permission through your device.

Cookies and similar technologies. See section 7.

3.4 Information from third parties

Social and third party login. If you sign in using a third party account such as Google, we receive the identifiers and profile fields that provider shares with us based on your permissions. That provider's own privacy policy governs what they share.

Payment processor. Verification status, payout status, transaction outcomes, chargeback and dispute records, and limited identity confirmation signals.

Service providers. Analytics, email delivery, hosting, error monitoring and anti fraud vendors provide us with technical and activity information about how the Services are being used.

Publicly available and business sources. Limited information about prospective business users, used for outreach where permitted by law.

We do not buy consumer personal information from data brokers.

4. How we use information, and our legal bases

Where GDPR or UK GDPR applies, we rely on the legal bases noted below.

5. Marketing

We may send you product updates, tips and promotional emails. Every marketing email includes an unsubscribe link, and you can also email usecitruss@gmail.com to opt out. Please allow up to ten business days for the request to take effect.

Opting out of marketing does not stop transactional and service messages such as booking confirmations, receipts, password resets and security notices. Those are part of the Services.

We do not send marketing to a Professional's Clients on our own behalf. Client contact details collected through a booking page belong to the Professional and are not added to Citruss marketing lists.

6. Payments

Payments on Citruss are processed by [PAYMENT PROCESSOR NAME]. When you pay or get paid through Citruss, your card and bank details are collected and processed directly by that provider under their own privacy policy and security standards.

We do not store full card numbers or bank credentials on Citruss systems. We receive and store limited payment records such as amount, currency, date, last four digits of the payment method, status, and any dispute or refund outcome.

Professionals receiving payouts may need to provide identity and business verification information to our payment processor in order to meet know your customer and anti money laundering requirements. That information goes to the processor, not to us, although we receive the verification status.

[CONFIRM: name the processor and link their privacy policy here. If more than one processor is used by region, list each.]

7. Cookies and similar technologies

We use cookies, pixels, local storage and similar technologies to run the Services, remember your session, understand usage, and where you consent, to measure and deliver advertising.

We use the following categories:

• Strictly necessary. Required for the Services to work, including login sessions, security and load balancing. These cannot be switched off.
• Functional. Remember preferences such as language, currency and time zone.
• Analytics. Help us understand how people use the Services so we can improve them.
• Advertising. Used to measure and deliver ads about Citruss on other platforms.

Where required by law, we ask for your consent before setting non essential cookies, and you can change your choices at any time through the cookie settings link on our site. You can also block or delete cookies through your browser, although some features may stop working if you do.

We honour Global Privacy Control and similar opt out preference signals where they apply.

Full details of the individual cookies we set are in our Cookie Policy. [PENDING: Cookie Policy needs to be published and linked here.]

8. When we share information

We do not sell personal information, and we do not share it for cross context behavioural advertising in the sense those terms are used under California law.

We share information in these situations:

Service providers. Hosting, payment processing, email delivery, SMS delivery, analytics, error monitoring, customer support tooling and security vendors. They act on our instructions under written terms and may only use the information to provide their service to us.

Between Professionals and Clients. When a booking is made, the Professional receives the Client's booking details, and the Client receives the Professional's business contact details and booking confirmation. This is the core function of the Services.

Team members. If a Professional operates a team account, information about bookings may be visible to other members of that team according to the permissions the account owner sets.

Where you direct us. Integrations you connect, such as a calendar or a video conferencing tool, receive the information needed for that integration to work.

Legal and safety. Regulators, law enforcement, courts and professional advisers, where we are legally required to disclose, or where we reasonably believe disclosure is necessary to investigate fraud or abuse, enforce our Terms, or protect the rights, property or safety of any person.

Business transactions. In connection with a merger, acquisition, financing, insolvency or sale of assets, subject to appropriate confidentiality protections. If Citruss changes hands, we will tell users before their information becomes subject to a different privacy policy.

Aggregated and de identified data. We may publish or share statistics that cannot reasonably be used to identify anyone. Where we de identify data, we keep it de identified and do not attempt to re identify it.

9. International transfers

Citruss serves users internationally, and our service providers operate in a number of countries. Your information may be transferred to and processed in countries other than where you live, including countries whose data protection laws differ from your own.

Where we transfer personal information out of the EEA or the UK, we rely on one of the following:

• an adequacy decision by the European Commission or the UK government covering the destination country;
• the European Commission's Standard Contractual Clauses, and for UK transfers the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses; or
• another lawful transfer mechanism recognised under applicable law.

You can request a copy of the safeguards we use by emailing usecitruss@gmail.com.

10. How long we keep information

We keep personal information only as long as we need it for the purposes described in this policy.

We may keep information for longer where we need it to comply with a legal obligation, resolve a dispute, or establish or defend a legal claim.

[ACTION: fill these periods in with the real numbers before publishing. Empty brackets in a live policy are a compliance problem in themselves.]

11. Security

We use technical and organisational measures designed to protect personal information, including encryption in transit, access controls, restricted administrative access, logging and monitoring, and vendor security review.

No system is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential, using a strong and unique password, and signing out of shared devices.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals, within the timeframes set by applicable law.

12. Your rights if you are in the EEA, the UK or Switzerland

You have the right to:

• Be informed about how we use your information, which is what this policy is for.
• Access a copy of the personal information we hold about you.
• Rectify information that is inaccurate or incomplete.
• Erase your information in certain circumstances, sometimes called the right to be forgotten.
• Restrict how we process your information in certain circumstances.
• Data portability, meaning you can receive information you provided to us in a structured, commonly used, machine readable format, and ask us to transmit it to another provider where technically feasible.
• Object to processing based on our legitimate interests, and to object at any time to processing for direct marketing.
• Withdraw consent at any time where we rely on consent.
• Not be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects.

To exercise any of these rights, email usecitruss@gmail.com. We will respond within one month, and we may extend that by a further two months for complex requests, in which case we will tell you.

We may need to verify your identity before acting on a request. We will not charge a fee unless the request is manifestly unfounded or excessive.

If you are a Client and your request concerns a booking you made with a Professional, that Professional is the controller. Contact them directly, or contact us and we will forward your request.

Complaints. You have the right to complain to a supervisory authority, in particular in the country where you live or work. In the UK this is the Information Commissioner's Office at ico.org.uk. In the EU you can find your national authority through the European Data Protection Board. We would appreciate the chance to address your concern first.

13. Your rights if you are in the United States

Residents of California and of other states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana, have rights that may include:

• Right to know or access what personal information we collect, use and disclose about you, and to receive a copy in a portable format.
• Right to delete personal information we collected from you, subject to exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the sale of personal information, of sharing for cross context behavioural advertising, and of targeted advertising. We do not sell or share personal information in that sense, and we honour Global Privacy Control signals.
• Right to limit the use and disclosure of sensitive personal information. We do not use sensitive personal information for purposes beyond those permitted without a limitation right.
• Right to opt out of profiling that produces legal or similarly significant effects. We do not carry out such profiling.
• Right to non discrimination for exercising any of these rights. We will not deny you the Services, charge you a different price or give you a lower quality of service because you exercised a privacy right.
• Right to appeal. If we deny your request, you may appeal by emailing usecitruss@gmail.com with the word Appeal in the subject line. If we deny the appeal, you may contact your state attorney general.

To make a request, email usecitruss@gmail.com. We will verify your identity by matching the information in your request against our records. An authorised agent must provide proof of authorisation, and we may ask you to confirm the agent's authority directly.

[CONFIRM: whether Citruss currently meets the applicability thresholds of these laws. If it does not yet, this section is offered voluntarily and should say so. If it does, a "Your Privacy Choices" link is required on the homepage.]

14. Other jurisdictions

If you are elsewhere, you may have rights under your local data protection law. Email usecitruss@gmail.com and we will handle your request in line with the law that applies to you.

15. Children

Citruss is a product for people running a business or professional practice. The Services are not directed at children, and we do not knowingly collect personal information from anyone under 16, or under 13 where local law sets that lower age.

You must be at least 18 to create a Citruss account and take payments.

If you believe a child has given us personal information, email usecitruss@gmail.com and we will delete it promptly.

16. Automated decision making

We use automated checks to detect fraud, spam and abuse, for example flagging unusual booking or payment activity. These checks can result in an account being limited or suspended.

Where a decision produces legal effects or similarly significant effects for you and is based solely on automated processing, you can ask for human review, express your point of view, and contest the decision. Email usecitruss@gmail.com.

17. Links to other sites

Booking pages and the Citruss site may link to third party websites and services, including social platforms and payment pages. We do not control those sites, and this policy does not cover them. Check their privacy policies before sharing information with them.

18. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top and post the new version here.

If the changes are material, we will give you reasonable advance notice by email or through the Services before they take effect, and where the law requires it we will ask for your consent.

19. Contact us

Questions, requests or complaints about privacy:

CROFT TECH LTD [REGISTERED OFFICE ADDRESS] [JURISDICTION], company number [COMPANY NUMBER]

Email usecitruss@gmail.com

[IF APPOINTED: Data Protection Officer contact details.] [IF REQUIRED: EU or UK Article 27 representative contact details.]