Privacy Policy

Last updated: October 2026

Numeraxia Technologies Pte. Ltd. (UEN 202628793G) ("Numeraxia Photo", "we", "us") operates the Numeraxia Photo web application and mobile apps from Singapore. This policy explains how we handle personal data in line with the Personal Data Protection Act 2012 (Singapore PDPA) and the Personal Data Protection Act 2010 (Malaysia PDPA), including users in Malaysia and Singapore.

Data protection contact

For access, correction, withdrawal of consent, or privacy enquiries: privacy@numeraxia.com
Numeraxia Photo · 60 Paya Lebar Road, #06-28, Paya Lebar Square, Singapore 409051

Information we collect

• Account data: email, name, role (model, editor, admin), authentication logs
• Model identity verification (sensitive): legal name, date of birth, country of residence, government ID image, reference selfie, automated integrity metadata (face detection, AI-likelihood flags). Collected only with explicit consent before commercial uploads.
• Portfolio photos: original images (private), watermarked previews (public when approved), titles, tags, model release signatures, IP address and timestamp at upload
• Editor data: design projects, templates, brand kits, export and license records
• Payments: processed by Stripe; we store subscription status, wallet balances, and transaction references (not full card numbers)
• Technical data: IP address, user agent, device type, and security logs for fraud prevention and cybersecurity monitoring

Purpose and legal basis

We collect and use personal data only for stated purposes, including:

• Providing the design editor, marketplace, and licensing services
• Verifying model age, identity, and upload integrity (consent-based)
• Processing exports, subscriptions, and model payouts
• Admin review, audit trails, and legal compliance (licensing, DMCA)
• Service communications and security incident response

Where Singapore or Malaysia law requires consent (especially for ID documents and facial images), we obtain it through in-app checkboxes before processing. You may withdraw consent by contacting us or deleting your account, subject to retention limits below.

Model photo upload process (security & compliance)

1. Identity gate: Models must complete verified identity checks before uploading commercial photos.
2. Server-side validation: Uploads are scanned for allowed image formats, size limits, and content integrity (not executable files disguised as images).
3. Automated checks: Face detection, AI-generated content signals, and comparison against the reference selfie where configured.
4. Human review: Photos remain pending review until approved; originals stay in private storage.
5. Consent records: We store consent version, text snapshot, IP address, and timestamp for identity verification and each portfolio upload.
6. Access control: Identity documents and originals are in private buckets; only authorised administrators access them via time-limited signed URLs.

Cybersecurity measures

We align with reasonable security practices expected under Singapore PDPA Protection Obligation and Malaysia PDPA security principle, including:

• Encryption in transit (HTTPS/TLS) for all app traffic
• Role-based access, row-level security on database tables, and admin-only identity review
• Private object storage for ID documents and full-resolution originals
• Hashed credentials via Supabase Auth; secrets stored only in server environment variables
• Monitoring via hosting and database provider logs

If we become aware of a notifiable personal data breach affecting Singapore or Malaysia users, we will assess obligations under applicable law (including PDPA breach notification where required) and notify affected users and regulators as applicable.

Cross-border transfers

Data may be processed in Singapore and transferred to subprocessors in other countries (for example United States hosting). We use providers under contractual terms requiring appropriate protection comparable to PDPA standards. Subprocessors include Supabase (auth, database, storage), Vercel (hosting), Stripe (payments), Resend (email), and optional image-integrity services when enabled.

Retention

• Active accounts: profile and project data while the account remains open
• Identity verification: your reference selfie is kept for upload integrity while your model account is active. Government ID images are deleted from storage after admin approval (we retain verification metadata and consent logs). Further deletion on account closure except where law or completed licenses require retention
• License certificates and export records: retained for legal and audit purposes after exports
• Consent and release logs: retained to demonstrate compliance with PDPA consent and licensing obligations

Your rights (Singapore & Malaysia)

Subject to applicable law, you may request access to, correction of, or limitation on processing of your personal data, and withdraw consent where processing is consent-based. Use account deletion or email privacy@numeraxia.com. Model and editor accounts may have different retention requirements due to outstanding licenses or payouts.

Children

The service is not directed at persons under 18. Model accounts require verified minimum age before upload.

Third-party services

Each provider has its own privacy policy governing their processing. We do not sell personal data.

Mobile apps

Our iOS and Android apps use a WebView to load the same Numeraxia Photo service. Deep links may be used for authentication callbacks.

Changes

We may update this policy; material changes will be reflected by the "Last updated" date. Continued use after changes constitutes notice where permitted by law.

Related policies

See our Terms of Service and DMCA policy.