Privacy Policy

1. Who we are and our role

SendShoot is operated by Asika Emmanuel Digital Enterprise, Nigeria (“we”, “us”). This policy explains how we handle personal data on sendshoot.com, in the SendShoot app and in the client galleries it serves.

• For photographers with an account, we are the controller of your account and billing information.
• For clients and other gallery visitors, the photographer who shared the gallery decides what is uploaded and why. They are the controller of that information, and we process it on their behalf under our Data Processing Addendum. We are the controller only of the limited security and technical data described below.

We follow the Nigeria Data Protection Act 2023, and the EU and UK General Data Protection Regulations where they apply to you.

2. What we collect

If you’re a photographer

• Account details: your name and email address, and your Google profile name and picture if you sign in with Google. Sign-in is handled by Clerk.
• Studio details and settings: your studio name and your default gallery settings.
• Billing details: your plan, subscription status and a customer reference from Polar. Polar handles your card details, and we never see or store them.
• Your content: the photos you upload with their filenames and sizes, shoot names and dates, and the client names and email addresses you enter.
• Activity: actions in your account, such as sharing a gallery, delivering photos or extending a link.

If you open a gallery

• What your photographer added about you: usually your name and email address.
• What you add: favourites, notes on photos, messages to your photographer, and an email address if you ask us to email you a download link or ask for a gallery to be reopened.
• Visit records: when a gallery is opened, we record the date, the device type (such as iPhone or Windows) and an approximate city and country worked out from your connection. Your photographer sees these in the gallery’s activity, along with downloads and picks.
• Security records: if a wrong passcode is entered, we record the IP address it came from, so repeated guesses can be blocked.
• A gallery cookie that keeps you signed in to that gallery for 30 days. See our Cookie Policy.

For everyone

• Emails we send: a record of who we emailed, which email it was and when, for example “your photos are ready”.
• Support conversations: what you tell us when you email us.
• Technical logs: our hosting provider processes IP addresses and request details to deliver pages and protect the Service from attacks.

We don’t use advertising, analytics or tracking cookies, and we don’t buy data about you.

3. How we use it

• To provide the Service: storing photos, showing galleries, recording picks and delivering finals.
• To send service emails, such as sign-in links, “your photos are ready”, pick reminders a photographer has switched on, and download links.
• To keep the Service secure, for example by limiting passcode guesses and preventing abuse.
• To take payments and manage subscriptions through Polar.
• To answer support requests and fix problems.
• To meet legal obligations, such as keeping records or responding to lawful requests.

We don’t sell personal data, we don’t show ads, and we don’t use your photos or your clients’ photos to train artificial intelligence models. We don’t currently send marketing emails. If we start, we’ll ask first where the law requires it, and every one will include an unsubscribe link.

4. Our legal bases

• Contract: to provide the Service you signed up for, and the galleries a photographer shares with you.
• Legitimate interests: to keep the Service secure, prevent fraud and abuse, and improve reliability, in ways you would reasonably expect.
• Legal obligation: to keep financial records and comply with the law.
• Consent: where we ask for it, which you can withdraw at any time.

5. Who we share it with

Between photographers and clients. A gallery shows your photographer’s studio name and the photos they shared. Your photographer sees your favourites, notes and messages, and when the gallery was opened or downloaded.

Service providers. We use a small number of providers to run SendShoot. They process personal data only on our instructions:

Legal reasons. We may disclose information if the law requires it, or to protect people’s safety or our rights. If the business is sold or merged, the buyer would take over this information under this policy.

6. International transfers

We are based in Nigeria. Our database is hosted in Western Europe, photos are served through Cloudflare’s global network, and some of our providers are in the United States. Where data protection law requires it, we rely on safeguards such as the European Commission’s Standard Contractual Clauses and our providers’ data processing terms.

7. How long we keep it

• Account details: for as long as you have an account.
• Photos: until you delete them. Photos in a shoot that has expired are permanently deleted 90 days after it expired. Photos in a shoot you delete are removed from storage shortly afterwards.
• ZIP downloads: deleted after 7 days.
• When you delete your account: your galleries stop working, your photos are removed from storage and your sign-in account is deleted. Some records stay in our database marked as deleted, such as shoot names, the client names and emails you entered, and gallery activity. We no longer use them, and you can ask us to erase them completely by emailing support@sendshoot.com.
• Billing records: kept by Polar and by us for as long as tax and accounting law requires.
• Support emails: for as long as they’re useful to help you, and no longer than three years.

8. Security

All connections to SendShoot are encrypted. Photos sit in private storage with no public access and are only served to the photographer who owns them, or to someone who has the gallery link and passcode. Passcode guesses are rate-limited, and regenerating a passcode signs everyone out of that gallery. Our providers encrypt stored data. No system is perfectly secure, but we work to protect your information. If a breach puts your rights at risk, we will tell you and the regulators as the law requires.

9. Your rights

Depending on where you live, you can ask to see the personal data we hold about you, correct it, delete it, receive a copy to take elsewhere, object to or restrict how we use it, and withdraw consent. You can delete your account yourself from Settings.

To make a request, email support@sendshoot.com. We will reply within one month, and may need to confirm your identity first.

If you’re a photographer’s client, your photographer controls the gallery and its contents, so please contact them first. If you can’t reach them, email us and we’ll help.

You can also complain to a data protection authority, such as the Nigeria Data Protection Commission, the UK Information Commissioner’s Office, or the authority in your EU country. We would appreciate the chance to put things right first.

10. Children

SendShoot accounts are for adults. Photographers sometimes upload photos of children, for example at family and newborn shoots. The photographer is responsible for having a parent or guardian’s consent to do that, and for sharing those galleries only with the right people.

11. Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and email account holders before the change takes effect.