Catalpas Atelier News — Privacy Notice

This Privacy Notice covers personal information that we, Heliopolis Creative and Culture Limited (“Catalpas Atelier”, “we”, “us”), process when you visit blog.catalpasatelier.com (“this blog”). This blog is a read-only news and content site. It does not host accounts, registration, payment, or our desktop software; those activities are covered by the separate Privacy Policy on our main site, which remains the authoritative privacy policy for our overall services.

In short: we read your browser request to deliver pages, set a few essential cookies so the site works, and — only with your consent — load Google Analytics and Meta (Facebook) Pixel for aggregate audience measurement and ad attribution.

1. Who we are

Catalpas Atelier is operated by Heliopolis Creative and Culture Limited, a company registered in Hong Kong, with registered address Unit B, 12/F, No. 28 Yee Wo Street, Causeway Bay, Hong Kong. For privacy matters specific to this blog, contact privacy@catalpasatelier.com.

We are not currently required to appoint a Data Protection Officer or an EU/UK representative, because our processing of personal data of individuals in the European Economic Area and the United Kingdom is occasional and unlikely to result in a risk to the rights and freedoms of natural persons. We will appoint a representative and update this notice before that ceases to be the case.

2. Scope

This Privacy Notice applies only to your visits to blog.catalpasatelier.com. It does not cover:

the main website catalpasatelier.com (separate Privacy Policy);
the Catalpas Atelier account, subscription, billing, and customer support;
the Scribe desktop application and any future Catalpas Atelier desktop software;
the documentation site docs.catalpasatelier.com (if separately hosted).

Where this blog and the main site share the same legal entity, you can rely on the main-site Privacy Policy for company-wide commitments (no sale of personal information, no use of your local writing content for advertising or AI training, etc.). This notice focuses on what is different about the blog: it is informational, read-only, and uses third-party analytics and an advertising pixel where you consent.

3. Information we collect

Server access logs. When you visit this blog, our servers, CDN, or reverse proxy may automatically record your IP address, user-agent string, request time, requested URL, HTTP method and status, referrer, basic device and browser type, and request characteristics that help detect abuse (e.g. unusual request rates or patterns).

Essential cookies and local storage. We use a small number of strictly necessary cookies and similar browser storage to remember your interface language, record your cookie-consent decision, and support basic security and anti-abuse features. See the Cookie Policy for further detail.

Analytics (with your consent). Where you opt in to “analytics cookies”, Google Analytics processes your IP address (truncated by Google), pages viewed, time on page, scroll and click events, browser and device type, and approximate geographic region. Data is used in aggregate to understand traffic and improve content.

Advertising / marketing (with your consent). Where you opt in to “marketing cookies”, the Meta Pixel shares with Meta your IP address, page URL, referrer, and event identifiers so we can measure ad campaigns and reach related audiences on Meta platforms.

Contact you initiate. If you write to us using an email address displayed on this blog, we receive whatever you choose to send. We use that information only to respond.

We do not ask for, collect, or store an account, password, payment, name, or any other profile information on this blog.

4. How we use information

We use the information described above to:

deliver pages, images, and feeds, and keep the site fast and available;
secure the site, prevent abuse, and respond to security incidents;
count and analyse aggregate traffic, sources, and engagement (analytics consent only);
measure advertising effectiveness on Meta platforms and present relevant audience groups (marketing consent only);
respond to enquiries you send us;
meet legal obligations such as accounting, tax, and lawful requests from authorities.

Under GDPR, UK GDPR, and similar laws, our legal bases are: legitimate interests to operate, secure, and audit the site (server logs, essential cookies); consent for analytics and marketing cookies and the related third-party processing; and legal obligation where applicable.

You can withdraw consent at any time through the Cookie preferences link in the footer, without affecting processing that has already taken place.

5. Cookies and similar technologies

We classify cookies into three categories: essential (no consent required), analytics (Google Analytics, consent required), and marketing (Meta Pixel, consent required). The full list, scope, retention, and provider information is in the Cookie Policy. You can change your decision at any time, or block cookies in your browser; blocking essential cookies may prevent some pages or preferences from working.

6. Third parties

We rely on a small set of service providers to run this blog. They process information only for purposes we authorise and only after we have obtained any required consent from you.

Google LLC / Google Ireland Limited — Google Analytics 4. Provides aggregate website analytics. Activated only after analytics consent. See Google’s Privacy & Terms.
Meta Platforms, Inc. / Meta Platforms Ireland Limited — Meta (Facebook) Pixel. Provides ad measurement and audience tools. Activated only after marketing consent. See Meta’s Privacy Policy.
Hosting, CDN, and TLS providers — deliver the static site, terminate TLS, run a web application firewall, and store operational logs. Current providers are listed at the foot of the Cookie Policy.

We do not sell your personal information. We do not use information collected on this blog to train AI models. We do not share information for cross-context behavioural advertising outside the Meta Pixel scope described above, and only when you have given marketing consent.

7. International transfers

Because we operate from Hong Kong and use providers in other locations (notably the United States and the European Economic Area for Google and Meta), your information may be processed outside your country of residence. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses, the EU-US Data Privacy Framework, the UK International Data Transfer Addendum, or equivalent contractual protections offered by our providers.

8. Data retention

Server access logs: kept for a limited period needed to operate the site and detect abuse, typically up to 90 days, unless required longer to investigate a security incident or comply with law.
Essential cookies and consent record: stored for up to 12 months, or until you clear them or change your decision.
Analytics data: retained by Google Analytics according to the property’s configured retention (currently up to 14 months for event-level data); aggregate reports may persist longer.
Marketing pixel data: retained by Meta in accordance with its own policies.
Email correspondence you initiate: kept long enough to manage the related conversation, then archived or deleted.

We may retain aggregated or anonymised data that no longer identifies you.

9. Your rights

Depending on where you live, you may have the right to:

access, correct, delete, restrict, or object to processing of your personal information;
receive a portable copy of it;
withdraw consent (use the Cookie preferences link or clear cookies);
opt out of analytics or marketing cookies, or of the “sale” or “sharing” of personal information where applicable;
lodge a complaint with a data protection authority — for example, the UK Information Commissioner’s Office, or your national EEA authority.

California residents have additional rights under the CCPA/CPRA: to know, delete, correct, and limit the use of sensitive personal information, and to opt out of the sale or sharing of personal information. We do not sell personal information. We do share limited identifiers with Meta for advertising measurement when you have consented to marketing cookies; you can opt out at any time through the Cookie preferences link.

To exercise these rights, email privacy@catalpasatelier.com. We may need to verify your identity before responding. We will not discriminate against you for exercising a privacy right.

10. Children

This blog is not directed to children under 13, and you must be at least 16 in jurisdictions where that higher age applies to online services, unless a parent or guardian provides valid consent. If we learn that we have collected personal information from a child without the required consent, we will delete it.

11. Changes and contact

We may update this notice from time to time. If a change is material, we will give reasonable notice by posting the updated notice on this blog or by adding an in-blog announcement. The updated notice applies from its stated effective date.

For privacy questions, requests, or complaints relating to this blog, contact us at:

Heliopolis Creative and Culture Limited Email: privacy@catalpasatelier.com Address: Unit B, 12/F, No. 28 Yee Wo Street, Causeway Bay, Hong Kong

If you are not satisfied with our response and the law gives you that right, you may also contact your local data protection authority.

For matters not specific to this blog (accounts, subscriptions, billing, desktop software, and overall company commitments), please refer to the main-site Privacy Policy.