Privacy policy

Last updated 26 July 2026

Draft. This document has been prepared for review by a Singapore-qualified lawyer and has not yet been reviewed. It describes what the service actually does today.

Who we are

Sukimiya FrameFlow is operated by TWENTYTWELVE, a sole proprietorship registered in Singapore, UEN 53470445W.

Our Data Protection Officer is Saiful Bahri Bin Sulaimi, reachable at privacy@sukimiya.com. The PDPA requires us to name a DPO and publish a way to reach them, so this is a real address that a person reads, not a form that goes nowhere.

The two roles we play

This matters, because it decides who is answerable for what.

Photographs and galleries. The photographer decides whose photographs go into a gallery, who may see it, and how long it runs. They are responsible for having told the people in those photographs. We process that content on their behalf, as a data intermediary under Singapore's Personal Data Protection Act, under the contract set out in our Terms.
Photographer accounts. For the account itself, billing and the emails we send about a gallery, we decide the purposes ourselves and are responsible directly.

If you are an event guest and want a photograph of you removed, you do not have to work out which of us to ask. Use report a photo and we will act on it.

What we hold

Data	Why	How long
Photographs, and the name a guest optionally types when uploading	To show the gallery and deliver files to the photographer	The gallery's lifetime, then a 30-day grace period, then deleted
Photographer account: email, name, studio name, password hash	To run the account	Until the account is deleted
A random visitor identifier stored in a cookie	So favourites stay yours, and to count views for the photographer	12 months, and cleared when the gallery is deleted
Reports about a photograph: which photograph, the reason you picked, and your visitor identifier	To take the photograph out of the gallery, to let the photographer decide, and to stop one person reporting a whole gallery. We do not collect free text, and we never tell the photographer who reported a photograph	Deleted with the gallery
Payment records (amount, date, reference)	Billing and statutory record-keeping	As required by Singapore tax and company law
Server and access logs	Security and fault diagnosis	Rolling, short-lived

We do not run face recognition, we do not build profiles of guests, and we do not sell or share personal data for anyone else's marketing.

Cookies

We set one cookie on a gallery, ff_visitor. It holds a random identifier, not your name. It exists so that the photos you favourite stay yours across visits, and so the photographer can see how many people looked. There are no advertising or third-party tracking cookies. Signed-in photographers additionally have a session cookie.

Who else processes it

We use a small number of providers, and only these:

DigitalOcean — the server that fronts the site
Cloudflare — storage and delivery of image files
Stripe — payments. Card details go to Stripe and never reach us
Resend — sending the emails described above

Some of these operate outside Singapore. Where personal data is transferred out, we require the provider to protect it to a comparable standard, as the PDPA requires.

Your rights

Removal. Ask us to take a photograph of you down: report a photo.
Access and correction. Ask what we hold about you and have it corrected.
Withdraw consent. You can withdraw at any time; for gallery photographs this means removal.
Complain. If we handle it badly you can complain to the Personal Data Protection Commission of Singapore.

Write to privacy@sukimiya.com. We reply within 2 working days.

Children

Children are photographed at events. We rely on the photographer and the event host to have the consent of a parent or guardian where that is needed. If a photograph of a child should not be online, tell us and we will remove it without argument.

If something goes wrong

If personal data is exposed, we investigate immediately, tell affected photographers without undue delay, and notify the Personal Data Protection Commission where the law requires it.

Changes

We will post any change here and, if it materially affects photographers, email them.