Privacy policy

1. Who we are

Playing With Photo is a photobooth business in Singapore, run by Playing With Pencil. We run AI and vintage-style photobooths at events, and we also provide our photobooth software to other photobooth businesses ("vendors").

The organisation responsible for your personal data is Playing With Pencil Pte. Ltd., UEN 202620687M, Singapore. In this policy, "we", "us" and "our" mean that organisation.

This policy covers three groups of people:

• Event guests who use a photobooth run by us, or run by a vendor using our software.
• Photobooth vendors and their team members who sign in to use our booth software and web app.
• Visitors to playingwithphoto.com.

2. Event guests

What we collect at the booth

• Photos and short clips taken by the booth camera, and the prints, strips and GIFs made from them.
• AI-styled versions of your photo, if you or the event choose an AI style (for example a painted portrait or a short animated clip).
• Your email address, only if you choose to type it in to receive your photos by email.
• Simple choices you make on screen, such as the style, frame or theme you pick.
• If a booth offers paid self-service sessions, the payment status of your session. The payment itself is handled by the payment provider shown on the QR code; we do not receive your card or wallet details.

How we use it

• To take, style, print and deliver your photos.
• AI styles: to create an AI-styled version, your photo is sent from the booth to our cloud server and from there to an AI provider: WaveSpeed or Google Cloud Vertex AI (Gemini). The provider returns the styled image or clip. We do not use your photos to train AI models.
• QR download links: after your session the booth shows a QR code. Scanning it opens a private, hard-to-guess link where you can view and download your photos. Anyone who has the link can open it, so please share it only with people you want to see your photos.
• Email delivery: if you enter your email address, we use it only to send you your photos from that event. We do not add you to a mailing list.
• Printing: prints are made on site and handed to you. We do not keep printed copies.
• With the event host's agreement, photos may be shared with the event host (for example in an event gallery or a slideshow at the event).

We will only use your photos in our own marketing (for example on this website or social media) if you or the event host have agreed to it. We ask for this in the event host's booking terms, and we put up a notice at the booth so guests know. If you don't want your photos used, tell the booth attendant or email us and we won't use them.

Where your photos are stored

• Photos are saved on the booth computer at the event. QR download links are served from that booth computer through a secure tunnel (Cloudflare).
• Photos sent for AI styling are kept temporarily on our cloud server only long enough to complete the job: by default they are deleted automatically within 24 hours.
• AI providers process the photo to return the result and handle it under their own terms and data policies.

Booths run by other vendors

If you used a booth run by another photobooth company that uses our software, that company is responsible for your photos and decides how they are used and kept. We process the photos only on its behalf, for example to create AI styles. Please contact that company first; if you can't reach them, contact us and we will help where we can.

Asking us to delete your photos

Email us at pencilwithjoy@gmail.com with the event name and date and, if you can, the QR link or a screenshot of your photo. We will delete the photos from our systems and stop using them, and confirm by email.

3. Photobooth vendors using our software

If your business uses our booth software, we collect:

• Account details: your name and email address when you sign in, either with Google or with an email sign-in link. Sign-in is handled by Supabase, our authentication provider.
• Business and team details: your business name, and the email addresses and roles (owner, manager or operator) of team members you invite.
• Booth usage records: your licence and booth details, and a record of each AI job (type of job, AI model used, status, time and billing month), so we can apply your plan's limits, show usage and bill correctly. We also keep an activity log of account changes, such as invitations and plan changes.
• Billing details: payments are processed by Stripe. Stripe collects your card details directly; we never see or store your full card number. We keep your Stripe customer and subscription references, plan and payment status.
• Support communications: messages you send us by email or WhatsApp, and any details you share to get help.

We use this data to provide and secure your account, run the booth software and AI features, bill you, give support, and tell you about important changes to the service. Photos taken at your events are handled as described in section 2: you decide how your guests' photos are used, and we process them on your behalf.

4. Google sign-in

If you choose "Sign in with Google", Google shares your name, email address and profile picture with us, through Supabase. We use your email address and name only to identify you, sign you in and link you to your business's account. We do not ask for access to your Gmail, Google Drive, contacts or any other Google data.

We do not sell Google user data, use it for advertising, or use it to train AI models. You can remove our access at any time from your Google Account permissions page.

5. Website visitors

Analytics and cookies

This website uses Google Analytics 4 to understand how visitors use the site. Google Analytics sets cookies (such as _ga) and collects information like the pages you view, the site that referred you, your device and browser type, and your approximate location (city or country, based on your IP address). We also record clicks on certain buttons, such as "Book the booth", WhatsApp links and package choices, so we can see which parts of the site are useful. We do not use this information to identify you personally.

You can block or delete cookies in your browser settings, or install Google's Google Analytics opt-out add-on. The site works without these cookies.

Enquiry forms

When you send an enquiry through our booking form, we receive the details you enter: your name, WhatsApp number, email address, event date, event type, venue, package and add-ons. Our software enquiry form asks for your name, email, company, country, WhatsApp number, number of booths and the plan you are interested in. Forms are delivered to us by Formspree. We use these details only to reply to you and to prepare a quote or demo.

Camera demo

The vintage camera demo on our home page runs entirely in your browser. Your camera feed and the photo strips you make are not uploaded to us. Your browser stores a small counter (in local storage) of how many free demo strips you have used.

Other services the site loads

Pages load fonts from Google Fonts and some scripts from the jsDelivr content network. These services receive your IP address and browser details when your browser requests the files. Links to WhatsApp, Instagram or other sites are governed by those sites' own privacy policies. Our website host, Vercel, keeps standard server logs (such as IP address and pages requested) for security and operations.

6. Service providers and overseas transfers

We use trusted service providers to run our business. They process personal data only to provide their service to us.

Overseas transfers. Our cloud server (DigitalOcean) and vendor sign-in (Supabase) are hosted in Singapore. Some of our other providers, such as Stripe, WaveSpeed, Google, Cloudflare, Vercel and Formspree, may store or process data outside Singapore, for example in the United States. When we transfer personal data overseas, we take steps to make sure it receives a standard of protection comparable to the PDPA, for example by using providers bound by contractual data protection commitments.

We do not sell personal data, and we do not share it with third parties for their own marketing. We may disclose personal data if required by law or to protect our rights, our customers or the public.

7. How long we keep data

We keep personal data only as long as we need it for the purposes above, or as required by law, and then delete it or make it anonymous.

• QR download links: work for 30 days after your session, then stop working.
• Guest photos on booth computers: deleted 30 days after the event.
• Photos sent for AI styling: deleted from our cloud server automatically, by default within 24 hours.
• Guest email addresses: deleted 30 days after the event.
• Event galleries shared with the event host: kept for as long as agreed with the host, and no longer than 12 months after the event.
• Vendor accounts: for as long as the account is active, and for 12 months after it is closed. Billing and transaction records are kept for as long as Singapore tax and accounting law requires (generally 5 years).
• Enquiries and support messages: 2 years after our last contact with you.

8. How we protect data

We use reasonable security measures to protect personal data, including encrypted connections (HTTPS) between the booth, our servers and our providers, sign-in for vendor accounts, role-based access for team members, random unguessable download links, and automatic deletion of temporary AI uploads. Access to our systems is limited to people who need it. No system is perfectly secure, so we cannot guarantee absolute security. If a data breach is likely to cause you significant harm, we will notify you and the Personal Data Protection Commission as the PDPA requires.

9. Children

Children may appear in photos taken at family events, weddings and parties. We expect a parent, guardian or the event host to supervise children at the booth and to agree on their behalf before a child uses AI styles or enters an email address. A parent or guardian can ask us to delete a child's photos at any time (see section 10).

Our vendor software and web app are for businesses and are not meant for children.

10. Your choices and requests

Under the PDPA you can:

• Access the personal data we hold about you and ask how it has been used or disclosed in the past year.
• Correct personal data that is wrong or incomplete.
• Withdraw consent to us collecting, using or disclosing your personal data, including asking us to delete your photos. We will tell you if withdrawing consent means we can no longer provide a service (for example, we can't email photos without an email address).

To make a request, email pencilwithjoy@gmail.com. We may ask you to confirm your identity. We will reply as soon as reasonably possible, and in any case within 30 days. If we need more time, we will tell you when to expect a full reply. We may charge a reasonable fee for access requests and will tell you the fee before we proceed.

If you are not satisfied with our response, you can contact Singapore's Personal Data Protection Commission.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. If we make significant changes that affect vendor accounts, we will also tell account owners by email.

12. Contact us

For any question or request about your personal data, contact our Data Protection Officer: