Privacy Policy

Who we are

KK VERSATILE HUB ("we") operates fotto.my, a marketplace where event photographers sell photos to event participants in Malaysia. This notice explains how we handle personal data under the Personal Data Protection Act 2010 (PDPA). Questions or requests: support@fotto.my.

What we collect

• Account data: email address, display name.
• Purchase data: orders, order items, buyer email for receipts and download access. Payments are processed by our payment gateway; we never see or store your card or banking credentials.
• Search selfies and face data: when you search by selfie, we derive a mathematical face signature to find matching photos. The selfie itself is deleted after processing. Face signatures and your match confirmations are deleted after 90 days.
• Photographer content: photos uploaded by photographers, including bib numbers detected in them.
• Photo alerts: if you ask to be notified, we keep your email and bib number for that event only, email you once when matching photos appear, and delete the record within 90 days. Every alert includes an unsubscribe link.
• Support requests: if you contact support, we keep the subject and message text you send, your email address (or your signed-in account, if you're logged in, so we never separately ask you for one), and technical context captured automatically at submission — the page you were on, your browser viewport, your user agent, and an anonymous session identifier from a cookie we set (used for rate-limiting and to link a report to your own browsing session, never to identify you) — to help us diagnose and reply. Deleted twelve months after the thread's last activity.

How we use it

To find your photos when you ask, deliver purchased photos, send purchase receipts, operate photographer accounts, and keep the service safe. We do not sell personal data or use it for advertising.

Who processes it

Data is stored and processed by our infrastructure providers: Supabase (database and authentication), Amazon Web Services in Singapore (photo storage and face/bib detection), Vercel (hosting), our email provider (receipts), and our Malaysian payment gateway (payments). Each acts as a processor on our instructions.

Retention

• Search selfies: deleted after the search completes.
• Face signatures and match feedback: deleted after 90 days.
• Photos you attach to a "find my photos" help request (shared with the event's photographers with your consent): deleted when the request closes, at most 30 days.
• Orders and receipts: kept as long as required for records and download access.
• Photographer photos: kept until the photographer or a takedown removes them.
• Support threads: deleted twelve months after the thread's last activity — the latest reply, or when it was closed — not from when it was first opened.

Your rights

You may request access to, correction of, or deletion of your personal data, or withdraw consent to face search at any time, by emailing support@fotto.my. If you appear in a photo and want it removed, use the same address. We operate a takedown process for photo subjects.