Privacy Notice

What we collect

• Hosts: email address, name (if you sign in with Google), and the event details you enter — names, date, venue.
• Guests: the photos and videos they upload, a name they may choose to add (optional), and reactions to photos. Guests need no account, email or phone number.
• Payments: payment status and amount. Card, FPX and GrabPay details are handled by Stripe directly — we never see or store them.
• Technical: IP address (for security and rate limits), and the cookies the service needs to work — one keeps a host signed in, one recognises a guest's browser so "My photos" and deleting your own photo work. No advertising or third-party tracking cookies.

Information inside photos

Photos from phones usually carry metadata (EXIF), sometimes including GPS location. The copies shown in the gallery and on the TV have all of that removed. Originals are stored privately, and only the host can download them (for example in the zip).

Why we use it

• To run your event's gallery, slideshow and invitation.
• To send sign-in links and important emails — for example a warning before storage ends.
• To process payments and keep transaction records.
• For security: to stop spam, abuse and repeated sign-in attempts.

We do not sell data, do not use event photos for advertising, and do not share them with anyone beyond the providers listed below.

Who can see what

• Anyone with the event link can view the gallery. The link is not listed on Google or other search engines — but anyone who has it can open it, so share it with people you trust.
• Photos the host hides, or that are awaiting approval, are moved out of public access. Old links to them stop working.
• Hosts (and co-hosts) see every photo of their event, including the name of the guest who uploaded it.
• Providers that help us run Indahnya: Cloudflare (photo storage), our server host, Stripe (payments), our email provider, and Google (if you choose Google sign-in). Some of them store data outside Malaysia.

How long we keep it

• Photos and videos are kept according to the plan: Free for 30 days after the event, Indahnya for 1 year, Indahnya Lengkap for 2 years. We email the host before it ends.
• After storage ends there are 30 more days to download or extend. After that every photo and video is permanently deleted and cannot be recovered.
• If the host deletes the event, all photos and videos are deleted at once.
• Guests can delete their own photo within the window the host allows (24 hours by default).
• Sign-in links expire after 15 minutes. Sign-in sessions end after 90 days.
• Payment records are kept as long as tax and accounting law requires.

Your rights

You may ask for access to your personal data, ask for it to be corrected, withdraw consent, or ask for it to be deleted. A guest who wants a photo taken down can ask the host, or contact us directly with the event link and the photo in question. We reply within 21 days.

Security

Every connection uses HTTPS. Originals and hidden photos live in private storage, not public. Hosts sign in with one-time links, not passwords that can be stolen. No system is 100% secure, but we take reasonable steps to protect your data.

Children

Events often have children in the photos. The host decides who gets the gallery link, and can hide or delete any photo at any time.

Changes

If we change this notice materially, we update the date above and let hosts know by email.

Contact us

Email hello@indahnya.my or WhatsApp +60 13‑907 8719. If the BM and English versions differ, the BM version prevails.