Privacy Policy

Last updated: 9 July 2026

FotoKaki is operated by Techlaju Sdn Bhd (“we”, “us”, “our”).

1. Introduction

Techlaju Sdn Bhd (“we”, “us”) operates FotoKaki, a photobooth software platform. This Privacy Policy explains how we collect, use, store, and share personal information when you use our website, dashboard, kiosk experiences, and related services.

By using the Service, you acknowledge this Policy. If you do not agree, please do not use the Service.

2. Roles: platform operator vs. event operator

Workspace owners and their teams (our customers) use FotoKaki to run photobooths at events. In that relationship, we act as a data processor for guest photos and event data processed on behalf of the workspace owner.

For account registration, billing, support, and platform security, we act as a data controller.

Event guests should contact the event operator (workspace owner) for questions about how their photos are used at a specific event. Guests may also contact us using the details at the end of this Policy.

3. Information we collect

3.1 Account & billing information

  • Name, email address, business / workspace name
  • Password (stored in hashed form)
  • Subscription and payment references processed via CHIP (we do not store full card numbers)
  • Communications with support

3.2 Kiosk & photo data

  • Photos captured at kiosks operated by our customers
  • Download tokens, QR links, download counts, and timestamps
  • Frame / template selections and basic usage analytics

3.3 Technical & usage data

  • IP address, browser type, device information
  • Log files, session identifiers, and security events
  • Pages visited and feature usage within the dashboard

3.4 Content you upload

  • Logos, frame images, kiosk branding, and workspace settings

4. How we use information

We use personal information to:

  • Provide, maintain, and secure the Service
  • Process subscriptions, one-time purchases, and usage overages
  • Send transactional emails (welcome, password reset, receipts) via EngineMailer
  • Store and deliver photos via our storage infrastructure (local or cloud)
  • Monitor performance, prevent fraud, and enforce our Terms
  • Comply with legal obligations and respond to lawful requests
  • Improve the platform with aggregated or de-identified analytics

We do not sell your personal information.

5. Legal bases (where applicable)

Depending on context, we rely on:

  • Contract — to deliver the Service you signed up for
  • Legitimate interests — security, analytics, and service improvement
  • Consent — where required for marketing or optional features
  • Legal obligation — tax, accounting, or regulatory requirements

6. Sharing & subprocessors

We share information only as needed to operate the Service, including with:

  • CHIP — payment processing
  • EngineMailer — transactional email delivery
  • Wasabi / cloud storage providers — photo and asset storage when enabled
  • Infrastructure providers — hosting, backups, and monitoring
  • Professional advisers or authorities — when required by law or to protect rights

Workspace owners may make guest photos available via QR codes and public download links configured for their events. They are responsible for appropriate notices and consents at the event.

7. Retention

Account data is retained while your workspace is active and for a reasonable period afterward for legal, billing, and dispute-resolution purposes.

Photos and kiosk data are retained according to your plan settings and configured retention periods. Data may be deleted automatically after the retention window expires.

Backups may persist for a limited time after deletion from active systems.

8. Security

We implement reasonable technical and organisational measures including access controls, encrypted transport (HTTPS), hashed passwords, and secure payment handoff to CHIP. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

9. International transfers

Our subprocessors may process data in Malaysia and other countries. Where data is transferred internationally, we take steps reasonably necessary to protect it consistent with this Policy and applicable law.

10. Your rights

Subject to applicable law (including Malaysia’s Personal Data Protection Act 2010), you may have the right to:

  • Access and obtain a copy of your personal data
  • Correct inaccurate information
  • Request deletion, subject to legal and contractual limits
  • Withdraw consent where processing is consent-based
  • Lodge a complaint with a relevant data protection authority

To exercise these rights, email techlajuswk@gmail.com. We may need to verify your identity before responding.

11. Cookies & similar technologies

We use cookies and session storage to keep you logged in, protect against CSRF attacks, and remember kiosk preferences. You can control cookies through your browser settings; disabling them may limit functionality.

12. Children

The Service is not directed at children under 13. Photobooth photos may include minors at events; workspace owners must ensure appropriate parental or guardian consent is obtained where required.

13. Changes to this Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may also be communicated via email or dashboard notice.

14. Contact

Data protection enquiries: