This Privacy Policy explains how we collect, use, disclose, protect, and handle your personal data when you use: (i) our website storyphotobook.online, and (ii) our photo upload form at /form/ (the “Upload Form System”).

We process personal data in accordance with Malaysia’s Personal Data Protection Act 2010 (“PDPA”, Act 709).

We provide an online channel to help customers submit photos for printing services after placing an order through: Shopee, Lazada, or via WhatsApp/Telegram direct order.

Our Upload Form System typically works in three steps:

• Step 1: you provide order-related information (e.g., platform, username, contact number, order ID if applicable, and optional cloud drive link).
• Step 2: you select print sizes and upload photos (if you provided a cloud drive link, photo uploads may be skipped).
• Step 3: you review a summary and submit.

After we receive the photos/drive link, we proceed with printing and fulfill delivery based on the logistics process of Shopee/Lazada or the arrangement agreed in direct orders.

Depending on how you order and how you use the Upload Form System, we may collect the following categories:

Note: We do not collect your delivery address through our website form. Delivery address for Shopee/Lazada orders is handled within the Shopee/Lazada platform.

We collect and use personal data for these purposes:

• Order fulfillment: to identify your order, confirm printing requirements, receive photos/drive link, and complete printing.
• Customer support: to communicate with you about your submission, clarify issues, and resolve disputes.
• System operation & security: to maintain the Upload Form System, prevent abuse, and keep the website secure.
• Legal compliance: to comply with applicable laws, lawful requests, and to protect our rights.

We do not use your personal data for targeted advertising, tracking, analytics, or building marketing audiences. We currently do not run advertising campaigns using your personal data.

If we introduce direct marketing in the future, we will update this policy and provide a clear opt-out mechanism.

We respect the privacy of your photos. Our standard practice:

• Use limitation: uploaded photos and/or cloud drive links are used only for printing fulfillment.
• Deletion timeline: we delete uploaded photos from our server within 48 hours after printing is completed.
• No backups: we do not keep photo backups and do not store photos on offline hard drives for long-term retention.
• Cloud drive links: if you provide a drive link, we access it only for fulfillment and do not archive your drive content.

We do not sell your personal data. We may disclose limited data only when necessary for:

• Order handling on platforms: If you order via Shopee/Lazada, payment and delivery address are governed by Shopee/Lazada systems and policies.
• Customer support channels: We respond via WhatsApp Business and Telegram using +60 14-980 8825.
• Website security & delivery: Our website uses Cloudflare (DNS/security layer). Cloudflare may process technical data (e.g., IP address and traffic information) to protect and deliver the site.
• Legal obligations: If required by law, court order, or lawful authority requests.

Our website is hosted on a Malaysia-based server.

Shopee/Lazada cross-border transfers (if any) are handled under those platforms’ own policies and controls.

We do not intentionally use marketing cookies or analytics cookies. Our site may use essential cookies or similar technologies required for security and basic functionality. For example, security services (such as Cloudflare) may set cookies that help manage traffic and protect the website from malicious activity.

We currently do not use a cookie banner because we do not run analytics/advertising trackers; if our cookie usage changes materially, we will update this policy accordingly.

We take reasonable security measures to protect personal data, including SSL encryption for data transmission and security controls to prevent unauthorized access. However, no method of transmission over the Internet is 100% secure.

Subject to PDPA and applicable exceptions, you may have the right to:

• Request access to your personal data;
• Request correction of inaccurate personal data;
• Withdraw consent for certain processing (where consent is the basis);
• Object to processing for direct marketing purposes (if applicable).

We will respond to requests within a reasonable time, generally within 21 days, subject to PDPA and verification requirements.

If you placed your order via Shopee or Lazada, those platforms handle payment and delivery address information in their own systems. Our Upload Form System is primarily for receiving photos/printing instructions to fulfill your order.

Official store links:

• Shopee: shopee.com.my/storyphotobook
• Lazada: lazada.com.my/shop/story-photobook-enterprise

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any updates will be posted on this page with a revised “Last updated” date.