← Back
Privacy Policy
Version 1.1 — Effective 29 October 2026
This Privacy Policy explains how Tradax Sdn Bhd (Company No. 202301011247 / 1504135-A) ("we", "us", "our") collects, uses, and protects your personal data when you use the Photo Finder platform ("Service").
This policy is drafted in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA).
1. Data We Collect
| Category |
Data |
Purpose |
| Account Information |
Email address, display name, Google OAuth ID; for event owners also phone number, company and bank details (bank, account number, account holder name) |
Authentication, account management, communication, owner payouts |
| Facial Data |
Numerical embedding vectors derived from uploaded photos |
Photo matching (face recognition search) |
| Transaction Data |
Credit purchases, face unlocks, payment references |
Billing, transaction history, fraud prevention |
| Usage Data |
Search history, download history, consent records (IP, user-agent) |
Service improvement, legal compliance |
| Technical Data |
IP address, browser type, device information |
Security, abuse prevention |
2. How Facial Data Is Processed
- When you upload a selfie, our system locates the faces in it and extracts a numerical vector (facial embedding).
- This vector is a mathematical representation — it is not a photograph.
- The embedding is compared against embeddings extracted from event photos to find visual matches.
- Uploaded selfie images are stored temporarily until your search finishes and deleted automatically.
- Facial embeddings linked to your account, with a small thumbnail of the face, are retained to provide your "My Faces" history feature. You can remove a face from My Faces at any time.
- Each search's results, with its facial embedding and face thumbnail, are kept for 7 days so you can come back to them (My searches), and are deleted afterwards. If you search without logging in, this also lets the face be added to My Faces if you then log in.
- If you unlock a face, a copy of its facial embedding is kept with the purchase record, so the purchase stays valid if you remove the face from My Faces.
3. Legal Basis for Processing
Under the PDPA 2010, we process your personal data based on:
- Consent — You explicitly consent to facial data processing when you accept the Terms & Conditions.
- Contractual necessity — Processing is necessary to provide the photo matching service you requested.
- Legitimate interest — Security monitoring and fraud prevention.
4. Data Sharing
We do not sell your personal data. We share data only with:
- ToyyibPay — Our payment gateway processes credit purchases. They receive your name, email, and phone number as required for payment processing.
- Backblaze and Cloudflare — Store original event photos (Backblaze B2) and watermarked preview images (Cloudflare R2) on our behalf. Our encrypted backups, which include account and facial data, are also stored with Backblaze; only we hold the key to read them.
- Google — If you sign in with Google OAuth, Google provides us your basic profile information (name, email, avatar URL).
- Event organisers — Event owners can see aggregate statistics (number of unlocks, revenue) but do not have access to your personal identity, facial data, or search history.
- Law enforcement — Only if required by Malaysian law or valid court order.
5. Data Retention
| Data Type |
Retention Period |
| Account information |
Until account deletion or 2 years of inactivity |
| Facial embeddings (your uploads) |
Until account deletion |
| Event photos and their facial embeddings |
Until the event is removed. An event with no paid sale for 90 days incurs a storage fee; if it isn't paid, the event's photos and embeddings are deleted after a 7-day notice to the organiser |
| Transaction records |
7 years (Malaysian tax law requirement) |
| Uploaded selfie images |
Automatically deleted within 24 hours of upload |
| Search results (with the search's facial embedding and face thumbnail) |
7 days |
| Consent records |
Duration of account + 2 years |
| Encrypted backups (including account and facial data) |
30 days |
6. Your Rights Under PDPA
Under the Personal Data Protection Act 2010, you have the right to:
- Access — Request a copy of your personal data we hold.
- Correction — Request correction of inaccurate personal data.
- Withdrawal of consent — Withdraw consent for processing (this may affect your ability to use the Service).
- Deletion — Request deletion of your account and associated data.
To exercise these rights, contact us at [email protected].
7. Cookies & Similar Technologies
- Session Cookies — HttpOnly, secure cookies holding a random session token, used to maintain your login session. These are essential for the Service to function.
- Google reCAPTCHA — Used during email OTP login to prevent automated abuse. Google's privacy policy applies to reCAPTCHA data.
- Google Tag Manager — Used for analytics to understand usage patterns. No personally identifiable information is shared with analytics.
8. Data Security
- All data in transit is encrypted using HTTPS/TLS.
- There are no passwords: you sign in with a one-time code sent to your email, or with Google.
- Session tokens and one-time codes are stored only as hashes.
- Database access is restricted and credentials are not stored in code.
- Facial embeddings are stored as numerical vectors; the only face images kept are the small "My Faces" thumbnails.
9. Event-Specific Privacy Terms
Individual events may have additional privacy terms set by the event organiser. These will be displayed in the consent prompt when you first access an event. Event organisers are responsible for their own compliance with applicable data protection laws regarding event photos.
10. Children's Privacy
The Service is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors.
11. International Data Transfers
Your account data, transaction records and facial embeddings are stored and processed on our servers in Malaysia. Original event photos are stored with Backblaze in the United States and preview images with Cloudflare; some data may also be processed by Google and Cloudflare, with servers in other jurisdictions. These providers maintain appropriate data protection standards.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through an updated consent prompt on the platform. The "Effective" date at the top indicates the latest revision.
13. Contact & Complaints
For privacy inquiries or complaints:
Tradax Sdn Bhd
Email: [email protected]