Privacy policy

CheeseLah (cheeselah.com) is run by SAB Digital Solutions (incorporation in Singapore in progress), Singapore. Until the company’s registration is complete, its founder is responsible for this service and this policy. We follow Singapore’s Personal Data Protection Act 2012 (PDPA).

Questions, requests or complaints about personal data: privacy@cheeselah.com. Our Data Protection Officer can be reached at the same address.

• Organisers (our clients, such as a company running its party) choose to run a CheeseLah booth at their event. For the photos and choices made at their event, the organiser is the organisation responsible under the PDPA. It is the organiser’s job to tell guests the booth is there, how the photos are used, and to get any consent needed (including a parent’s or guardian’s consent for children).
• CheeseLah processes event photos on the organiser’s behalf and only on their instructions, as a “data intermediary”. We protect that data, keep it only as long as set out below, and delete it.
• For organiser accounts, website visitors and our own business records, CheeseLah is the organisation responsible.

From organisers (people who sign up and run events)

• Your name and email address from Google or Microsoft when you choose “Continue with Google” or “Continue with Microsoft”. We never see your Google or Microsoft password.
• What you tell us about your event: type, date, number of guests, wording, themes and settings.
• Your WhatsApp number, so our team can contact you about your request.
• Your company logo, if you upload one.
• Records of plans and payments. Payment is arranged privately; we do not store card or bank details.

From event guests

• The photo taken at the booth, and the AI version made from it.
• The choices the organiser’s committee makes for that photo: costume style (for example Man, Woman, Neutral or Modest), theme, an optional idea, the caption, and whether it was approved, redone or rejected.
• Guests do not need an app or an account, and we do not ask guests for their name, email or phone number.

From committee members (the organiser’s team who check photos)

• Access works with a link and a PIN set by the organiser. We record the sign-in session and the actions taken (approve, redo, reject, take off screen) so the organiser can see what happened.

From screens and visitors

• Connected booth and display screens get a device key so only the organiser’s screens can join their event.
• Technical records needed to keep the service secure: IP address, browser type, times of requests, and error records. These do not contain photos.

Cookies. We only use cookies the site needs to work: staying signed in, committee access, connected screens, and remembering the party style and light/dark choice you picked on our home page. We use no advertising or tracking cookies and no third-party analytics. We also save a few settings in your browser, such as sound on/off, whether you have seen the intro, and a screen’s display mode. These never leave your device.

• To run the booth, make the AI version, show approved photos on the event’s big screen, and let guests download their photo.
• To set up and support events, contact organisers about their request, and keep records of plans and payments.
• To keep the service safe: preventing misuse, checking that an AI request follows our content rules, and investigating problems.
• To meet legal obligations.

We do not sell personal data, do not use it for advertising, and do not use guest photos to train AI models.

• These companies receive the data through their business services. Under their business terms they do not use it to train their AI models, and may keep it for a limited period (typically up to 30 days) only to detect abuse, after which it is deleted.
• Our rules for every AI picture: keep the person’s real face and expression, never change religious dress or head coverings, never mock body size, skin, age or religion, and keep it suitable for the office.
• AI pictures are never shown on the big screen until a person on the organiser’s committee approves them. The committee can redo or reject any picture.
• The AI provider may receive the whole photo, including anyone standing in the background.

We do not use face recognition. We do not create facial measurements, face templates or “faceprints”, and we never match people across photos or events.

• The guest, through the private link or code for their photo.
• The organiser and their committee, who check the photos for their event.
• People at the event, who see approved AI photos on the big screen. If the event shows a download code next to a photo on the big screen, anyone in the room who scans it can download that photo.
• Our service providers listed below, only to run the service.
• There is no public gallery. Photos from one event are never shown at another event.

We may share personal data if the law requires it, or to protect people’s safety, and we will only share what is needed.

• Our database, photo storage and servers are in Singapore (Supabase and Vercel, Singapore region).
• AI processing (section 5) takes place in the USA. When we send data outside Singapore, we use providers bound by business terms that give it protection comparable to the PDPA.
• Photos are kept in private storage, encrypted in transit and at rest, and shared only through short-lived links. Access is checked on our servers for every request, and our staff accounts use two-factor sign-in.

• Guests: if you do not want your photo used or shown, tell a member of the organiser’s committee at the event. They can reject it or take it off the screen straight away. After the event, ask the organiser or email privacy@cheeselah.com. Because we do not collect guests’ names, please tell us the event and roughly when the photo was taken, so we can find it.
• Everyone: you can ask to see the personal data we hold about you, ask us to correct it, ask us to delete it, or withdraw consent. We reply as soon as we reasonably can, and within 30 days. If a request is about an organiser’s event, we work with that organiser to answer it.
• If you are not satisfied with our answer, you can contact Singapore’s Personal Data Protection Commission (pdpc.gov.sg).

If a data breach is likely to cause significant harm, we will tell the organisers affected, the Personal Data Protection Commission and, where required, the people affected, as the PDPA requires.

CheeseLah is for organisers aged 18 and over. Organisers who invite children to their event are responsible for getting a parent’s or guardian’s consent before children use the booth.

When we change this policy we update the date at the top. If a change is important, we contact organisers directly before it applies.