Privacy Policy

Who we are

Fotto ("we") operates fotto.my, a marketplace where event photographers sell photos to event participants in Malaysia. This notice explains how we handle personal data under the Personal Data Protection Act 2010 (PDPA). Questions or requests: support@fotto.my.

What we collect

• Account data — email address, display name.
• Purchase data — orders, order items, buyer email for receipts and download access. Payments are processed by our payment gateway; we never see or store your card or banking credentials.
• Search selfies and face data — when you search by selfie, we derive a mathematical face signature to find matching photos. The selfie itself is deleted after processing. Face signatures and your match confirmations are deleted after 90 days.
• Photographer content — photos uploaded by photographers, including bib numbers detected in them.
• Photo alerts — if you ask to be notified, we keep your email and bib number for that event only, email you once when matching photos appear, and delete the record within 90 days. Every alert includes an unsubscribe link.

How we use it

To find your photos when you ask, deliver purchased photos, send purchase receipts, operate photographer accounts, and keep the service safe. We do not sell personal data or use it for advertising.

Who processes it

Data is stored and processed by our infrastructure providers: Supabase (database and authentication), Amazon Web Services in Singapore (photo storage and face/bib detection), Vercel (hosting), our email provider (receipts), and our Malaysian payment gateway (payments). Each acts as a processor on our instructions.

Retention

• Search selfies: deleted after the search completes.
• Face signatures and match feedback: deleted after 90 days.
• Orders and receipts: kept as long as required for records and download access.
• Photographer photos: kept until the photographer or a takedown removes them.

Your rights

You may request access to, correction of, or deletion of your personal data, or withdraw consent to face search at any time, by emailing support@fotto.my. If you appear in a photo and want it removed, use the same address — we operate a takedown process for photo subjects.