Privacy Policy
Last updated 22 October 2026
Memoroll is photo booth software: an Android app that runs the photo booth at an event, and a web dashboard where the business running the photo booth manages its events. This policy explains what we collect, why, who we share it with and how long we keep it.
- 1. Who we are
- 2. What we collect
- 3. Guest photos and email addresses
- 4. How we use data
- 5. Who we share it with
- 6. How long we keep it
- 7. App permissions
- 8. Security
- 9. Your rights
- 10. Children
- 11. Changes and contact
1. Who we are
Memoroll (“we”, “us”) is run by Neko Labz Solutions (SSM 202603210521 (IP0630481-A)), a business in Labuan, Malaysia. Memoroll provides the Memoroll Booth app, the dashboard at memoroll.my/dashboard and the guest photo pages linked from printed strips. You can reach us at [email protected].
Three groups of people use Memoroll, and this policy covers each of them:
- Operators: the photographers, studios and businesses who sign up, run photo booths and manage events in the dashboard.
- Guests: people who take photos at a Memoroll photo booth during an event.
- Visitors: anyone browsing memoroll.my.
For guests, the operator running the event decides how the photo booth is used. Under Malaysia’s Personal Data Protection Act 2010 (PDPA), the operator is responsible for the guest data collected at their event, and Memoroll processes it on the operator’s behalf to run the service.
2. What we collect
| Who | What | Where it comes from |
|---|---|---|
| Operators | Name, email address and password (stored only as a salted hash). Business details such as business name, logo, registration number, support contact, billing email and time zone. Team invitations and roles. Bank name, account name and the last four digits of the account number for payouts. | You, when you sign up and fill in Settings |
| Operators | Sign-in records: email, country, browser type, time and whether it succeeded. Active sign-in sessions with the browser used. A log of changes made in the workspace. | Automatically, when you sign in and use the dashboard |
| Operators | Events, strip templates, welcome screen photos and videos, prices, and session statistics (prints, shares, payments). | You, and the photo booths you pair |
| Photo booth devices | Device name, model, Android version and app version. Every minute while the app is open: battery level, charging state, the event it is running, printer connection and paper count. | The Memoroll Booth app, once it is paired with a dashboard |
| Guests | The photos taken at the photo booth (each shot and the printed strip). An email address, only if the guest asks to get their photos by email and ticks the consent box. | The guest, at the photo booth |
| Visitors | No accounts, tracking cookies or analytics on memoroll.my. Your browser fetches fonts and scripts from the providers in section 5, which receive your IP address. Cloudflare gives us total visitor counts that don’t identify you. | Your browser |
We do not collect location, contacts, microphone audio or advertising identifiers. The Memoroll Booth app has no sign-up: it pairs with an existing business using a code from the dashboard. If an operator charges guests for a session, we record that a payment was made and its amount. We never receive card or bank details from guests.
3. Guest photos and email addresses
- Photos upload from the photo booth to our storage so the guest can open them from the QR code on their strip.
- The guest photo page works for as long as the business chose for the event: 48 hours unless it chose otherwise, and never more than 90 days after the session. After that the link stops working and the photos are deleted automatically. When the business holds an event’s photos until after the event, a guest can leave their email on the photo page; we keep it only to send the photos when the business releases them, and delete it with the photos. We keep only counts, such as how many shots were taken and whether the strip printed.
- Operators can download their event’s photos while the link lasts.
- A guest’s email address is used once, to send their photos. It is not saved on our servers. The photo booth holds it only until the email has gone out, for example while it waits to come back online.
- Operators can require guests to tick a consent box before any photos are shared.
4. How we use data
- To run the service: sign you in, sync events to your photo booths, print strips, host guest photo pages and send photo emails.
- To show you how your photo booths and events are doing, and to alert you about low paper, a disconnected printer or a photo booth that goes offline.
- To keep accounts safe: limit repeated sign-in attempts, record sign-ins and investigate misuse.
- To contact you about your account, such as password resets, invitations and important changes to the service.
We do not sell personal data, use it for advertising or train AI models on guest photos.
5. Who we share it with
We use these providers to run Memoroll. They handle data only to provide their service to us.
- Cloudflare: network and security in front of memoroll.my, photo storage (R2) and hosting for our staff console.
- Our server host: the virtual server that runs the dashboard, database and photo booth sync.
- Our email delivery provider: sends guest photo emails, invitations, password resets and alerts.
- Expo: delivers updates to the Memoroll Booth app. The app contacts Expo’s servers to check for a new version.
- Google Fonts, cdnjs and unpkg: serve the fonts and scripts that memoroll.my and the dashboard load in your browser.
- Google Play: distributes the app under Google’s own privacy policy.
We may also disclose data if the law requires it, or to protect the safety of people or the service.
6. How long we keep it
- Guest photos: the time the business chose for the event (48 hours unless it chose otherwise, at most 90 days) after the session, then deleted automatically. A guest email left for photos released after the event is deleted when it’s sent or with the photos.
- Guest email addresses: not kept after the email is sent.
- Operator accounts and business data: for as long as the business exists. When an owner deletes the business, its records are deleted. See Delete your account.
- Backups: weekly database backups are kept for up to 8 weeks, then replaced.
- Security records: sign-in records and staff action logs may be kept after a business is deleted, to protect the service and meet legal duties.
7. App permissions
The Memoroll Booth app asks Android for:
- Camera: to take the guests’ photos. The app does not record audio.
- Bluetooth and nearby devices: to connect to a Bluetooth receipt printer.
- Internet and local network: to sync with your dashboard, upload photos and print to Wi-Fi photo printers.
- USB (optional): for printers connected by cable.
Staff can lock the app’s controls with a PIN so guests cannot change settings.
8. Security
All traffic uses HTTPS. Passwords are stored only as salted hashes. Sign-in, device and reset tokens are stored as one-way hashes, and dashboard cookies cannot be read by page scripts. Photo booths authenticate with their own device token. No system is perfectly secure, so please use a strong, unique password and tell us right away if you suspect misuse.
9. Your rights
Under the PDPA you can ask to access or correct your personal data, ask us to stop using it, or withdraw consent. Operators can see and edit most of their data in the dashboard. For anything else, email [email protected] from the address on your account and we will reply within 21 days.
Guests: your photos are deleted when your photo link expires, which the business sets for each event (48 hours unless it chose otherwise, at most 90 days). To have them removed sooner, email us with the link from your strip, or ask the business that ran the photo booth.
10. Children
Operator accounts are for businesses and adults aged 18 or over. Guests of any age may use a photo booth at an event. The operator running the event is responsible for getting a parent or guardian’s consent where needed.
11. Changes and contact
If we change this policy we will update the date at the top, and tell operators by email when the change is significant. Questions or requests: [email protected].