Privacy Policy

This policy explains how Goh Bing Han, an individual who operates Pelari.my ("Pelari.my", "we"), handles personal data, in line with Malaysia's Personal Data Protection Act 2010 (PDPA) as amended in 2024.

1. What we collect

• Runners: no account is needed. When you search, we use the event and bib number you enter to query photographers' sites. We don't save bib numbers to our database or logs; each site's answer (just the photo count) is cached under a scrambled, keyed-hash key so we don't ask the same site twice: up to 24 hours while photographers are still uploading, and up to 30 days once an event is finished. The bib itself is never stored. We keep anonymous counts only (event, day, number of searches and clicks).
• Photographers: the public name and gallery links of photographers whose galleries we list, and anything you send us by email. When self-service accounts launch, sign-in will use Facebook (name, email and Facebook ID).
• Admins: name, email and Facebook ID from Facebook Login, and an activity log of admin actions.
• Usage analytics: if enabled, Cloudflare Web Analytics, which is cookieless and builds no personal profile: page views, referrer and device type.

2. Why we use it

To run the bib search, keep album links working, review photographer listings, prevent abuse, and improve the service. We don't sell personal data and don't use it for advertising.

3. Photos

We don't host, copy or analyse photos. Photos stay on each photographer's platform, and that platform's own privacy policy applies when you open it.

4. Sharing

We use service providers to run the site: Cloudflare for hosting, the database and analytics, and Meta for Facebook Login. Data may be processed outside Malaysia by these providers with appropriate safeguards.

5. Retention

Photographer data is kept while your account is active, then deleted within 7 days of a deletion request.

Admin activity logs are kept for 12 months, and longer only where needed for security or to handle a legal dispute.

6. Your rights

Under the PDPA you can ask to access or correct your personal data, or withdraw consent. Email hello@pelari.my and we'll reply within 21 days. If you signed in with Facebook, you can also remove Pelari.my from your Facebook settings; see Data deletion.

7. Cookies

Public pages use no tracking cookies. We use only essential cookies for sign-in sessions.

8. Contact

Goh Bing Han (operator, Pelari.my) · hello@pelari.my