Privacy Policy

Hihi Media Sdn. Bhd. (“HiHi Media”, “we”, “us”) provides photography, videography and graphic design services in Malaysia. This policy explains how we collect, use, store and protect your personal data when you use our website and services.

Account and contact data: name, email address, phone number, WhatsApp number and company name when you register, book, or send an enquiry.

Project data: booking details, project briefs, location details, uploaded reference documents, messages and review comments you provide while working with us.

Payment data: invoice and payment records. Card and banking details are processed by our payment providers (for example Xendit or PayPal) and never touch our servers.

Technical data: basic device and usage information (such as pages visited) collected through analytics cookies where you consent.

Crew location data: for crew members only, live location during an active assignment they have explicitly started sharing — see the Location Tracking Policy.

To provide our services: managing bookings, quotations, projects, payments, file delivery and support.

To communicate with you about your projects, including email and in-app notifications you can control in your settings.

To meet legal, tax and accounting obligations (for example invoices kept in our accounting system).

To improve our website and services using aggregated, non-identifying analytics.

We do not sell your personal data.

We use trusted service providers to run our platform: Supabase (database, authentication and file storage), Vercel (website hosting), payment gateways (Xendit, PayPal), Zoho Books (invoicing and accounting), Resend (transactional email) and Cloudflare (content delivery for final video files).

These providers process data on our behalf under their own security and privacy commitments. Some are located outside Malaysia; by using our services you consent to this transfer as permitted by the PDPA.

We may disclose data where required by law or to protect our legal rights.

Data is stored in access-controlled systems with row-level security so that clients can only access their own records.

Final project files are held in private storage and shared through expiring, signed links and access codes.

We retain personal data only as long as needed for the purposes above or as required by law, after which it is deleted or anonymised.

Under the PDPA you may request access to, or correction of, your personal data, and you may withdraw consent to processing (which may limit our ability to provide services).

To exercise these rights, contact us through the contact page and we will respond within a reasonable period.

We use essential cookies for login sessions, and analytics cookies only where you consent through the cookie banner. You can withdraw consent at any time.

We may update this policy from time to time. Material changes will be announced on this page with an updated revision date.