Who we are
KK VERSATILE HUB ("we") operates fotto.my, a marketplace where event photographers sell photos to event participants in Malaysia. This notice explains how we handle personal data under the Personal Data Protection Act 2010 (PDPA). Questions or requests: support@fotto.my.
What we collect
- Account data: email address, display name.
- Product analytics: a pseudonymous browser identifier and actions such as searches, cart additions and checkout starts help us measure usage. Where promotion tracking is enabled, a seven-day cookie records the event and recognised link source (WhatsApp, Instagram, Facebook or QR), and that source may be stored with an order. Promotion reports do not contain selfies, face signatures, email addresses, raw search text or full referring URLs.
- Purchase data: orders, order items, buyer email for receipts and download access. Payments are processed by our payment gateway; we never see or store your card or banking credentials.
- Search selfies and face data: when you search by selfie, we derive a mathematical face signature to find matching photos. The selfie itself is deleted after processing. Face signatures and your match confirmations are deleted after 90 days.
- Photographer content: photos uploaded by photographers, including bib numbers detected in them.
- Photo alerts: if you ask to be notified, we keep your email and bib number for that event only, email you once when matching photos appear, and delete the record within 90 days. Every alert includes an unsubscribe link.
- Support requests: if you contact support, we keep the subject and message text you send, your email address (or your signed-in account, if you're logged in, so we never separately ask you for one), and technical context captured automatically at submission — the page you were on, your browser viewport, your user agent, and an anonymous session identifier from a cookie we set (used for rate-limiting and to link a report to your own browsing session, never to identify you) — to help us diagnose and reply. Deleted twelve months after the thread's last activity.
Searching from a studio shop
Some photographers run their own shop address. Searching there works the same way, with these differences:
- Searching from a studio shop: the studio and Fotto both use your selfie to find your photos. Your selfie is deleted right after the search.
- The face data used to match you is kept 7 days, then deleted.
- Asking a studio for help: the photo you send is shared with that studio only, and the studio and Fotto use it to match your face against the photos of that studio. The photo is deleted when the request is closed or after 30 days; the face data made from it is kept 7 days.
- You can withdraw your consent by emailing us. Face data from a studio shop search cannot be linked back to you, so it is deleted automatically within 7 days.
How we use it
To find your photos when you ask, deliver purchased photos, send purchase receipts, operate photographer accounts, and keep the service safe. We do not sell personal data or use it for advertising.
Who processes it
Data is stored and processed by our infrastructure providers: Supabase (database and authentication), Amazon Web Services in Singapore (photo storage and face/bib detection), Vercel (hosting), our email provider (receipts), and our Malaysian payment gateway (payments). Each acts as a processor on our instructions.
Retention
- Search selfies: deleted after the search completes.
- Face signatures and match feedback: deleted after 90 days.
- Photos you attach to a "find my photos" help request (shared with the event's photographers with your consent): deleted when the request closes, at most 30 days.
- Orders and receipts: kept as long as required for records and download access.
- Product analytics: retained for 13 months. Browser session cookie: up to 30 days. Promotion-source cookie: up to 7 days; order source is retained with the order.
- Photographer photos: kept until the photographer or a takedown removes them.
- Support threads: deleted twelve months after the thread's last activity — the latest reply, or when it was closed — not from when it was first opened.
Your rights
You may request access to, correction of, or deletion of your personal data, or withdraw consent to face search at any time, by emailing support@fotto.my. If you appear in a photo and want it removed, use the same address. We operate a takedown process for photo subjects.