PolaroidKu← Back to Home

Privacy Policy

Last updated: 4 October 2026

PolaroidKu ("we", "us", or "our") is committed to safeguarding your personal data and respecting your privacy in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. This Privacy Policy explains our practices regarding the collection, processing, storage, and protection of personal data when you use the PolaroidKu website, digital photo guestbook, or event upgrade services.

Key Principles: We do not sell your personal data or uploaded photographs to third parties. We do not use user photographs or audio recordings to train artificial intelligence models. Event media is stored in encrypted cloud storage and automatically deleted following your plan's retention schedule.

1. Roles & Data Controller Designation

When you use PolaroidKu for a wedding, party, or corporate event:

  • The Event Host: Acts as the primary Data Controller who decides which guests are invited, which features (e.g. voice notes, live slideshow) are enabled, and which guest photos are moderated or published.
  • PolaroidKu: Acts as a Data Processor providing the software infrastructure, cloud rendering engine, and secure storage to process and deliver the digital guestbook on the Host's behalf.

2. Personal Data We Collect

We collect only the minimum personal information required to deliver our digital guestbook services effectively:

  • Host Account Information: Full name, email address, password hash, and profile preferences collected upon account creation.
  • Event & Guest Submissions: Event name, event date, guest names or nicknames, guest photos, captions, written wishes, and recorded voice notes.
  • Payment Records (CHIP Gateway): Selected event plan tier, amount paid in MYR, payment reference ID, transaction timestamp, and completion status. PolaroidKu does not store credit card numbers, CVVs, or bank login credentials.
  • Technical Telemetry & Logs: IP address, browser type and version, device type, and operational error logs necessary for fraud prevention, server security, and high-concurrency performance optimization.

3. How We Use Personal Data

We process personal data strictly for legitimate operational purposes:

  • Generating unique event QR codes and web guestbook submission portals;
  • Compositing guest photos with chosen Polaroid frames, dates, and typography via our rendering engine;
  • Broadcasting approved photos to the real-time live ballroom slideshow projector;
  • Packaging high-resolution ZIP archives for hosts to download and cherish;
  • Facilitating secure online payments via the CHIP gateway and sending automated digital receipts;
  • Maintaining server stability, blocking spam or malicious bots, and performing automated media lifecycle purges.

4. Cloud Infrastructure & Trusted Sub-Processors

We partner exclusively with industry-leading cloud providers who maintain rigorous security certifications (SOC 2, ISO 27001):

  • Cloudflare R2: High-availability, multi-region distributed object storage for encrypted hosting of guest photos, thumbnails, and audio files.
  • Neon (Serverless PostgreSQL): Fully managed, encrypted database engine for storing event settings, user accounts, and moderation status.
  • CHIP (Chip In Asia): Licensed Malaysian payment service provider processing FPX online banking, cards, and e-wallets under Bank Negara Malaysia regulatory standards.
  • Vercel Edge Network: Global serverless edge compute for low-latency web serving and SSL/TLS certificate termination.

5. Data Retention & Automated Purge Schedules

PolaroidKu implements strict, automated data retention lifecycles to protect your privacy and prevent unnecessary indefinite storage:

  • Free Plan: Event gallery and media files are stored for 7 days after the event date.
  • Premium Plan: Event gallery and media files are stored for 14 days after the event date.
  • Pro Plan: Event gallery and media files are stored for 30 days after the event date.
  • Automated Permanent Deletion: When the plan's retention window lapses, automated maintenance tasks permanently delete all event photos, thumbnails, and audio recordings from Cloudflare R2 object storage. Hosts are urged to download their complete ZIP archive prior to expiration.

6. Information Sharing & Visibility

Because PolaroidKu is an event photo sharing platform:

  • Within the Event: Photos and messages submitted by guests may be viewed by other guests with access to the event gallery and displayed on the event's live projector slideshow, subject to the host's moderation settings.
  • No Commercial Disclosure: We never disclose, sell, or rent your personal information or media to advertisers, marketing partners, or data aggregators.
  • Legal Obligations: We will only disclose personal data if required to do so by a binding court order, lawful subpoena, or government authority in accordance with Malaysian law.

7. Security Safeguards

We employ technical and organizational measures to safeguard your personal data:

  • Encryption in Transit: All network communication is enforced with HTTPS using modern TLS 1.3 encryption.
  • Encryption at Rest: Database volumes and Cloudflare R2 storage buckets are encrypted using industry-standard AES-256.
  • Access Control: Strict administrative authentication, signed URLs for temporary storage operations, and rate-limited endpoints.

8. Your Rights Under the Malaysian PDPA 2010

Under the Personal Data Protection Act 2010 of Malaysia, you enjoy specific rights regarding your personal data:

  • Right of Access: You may request confirmation of whether we process your personal data and obtain a copy of that data.
  • Right of Correction: You may request the correction of inaccurate or incomplete personal information.
  • Right to Withdraw Consent: You may withdraw consent for data processing by deleting your account or requesting removal of your event.
  • Right to Erasure: Hosts can delete individual photos or entire events at any time directly through the dashboard.

9. Contact & Data Protection Officer

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Data Protection desk: