Privacy policy

Gallerite is operated by Gallerite Ltd ("Gallerite", "we", "us"). We provide software that Nigerian and African professional photographers use to deliver client galleries, send invoices and receipts, take payments and run their studio.

We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR), overseen by the Nigeria Data Protection Commission (NDPC). Where your clients are located in other African countries, their local data protection laws may also apply.

Photographers (also "Users", "you") are our customers who hold a studio account. Clients are the people a photographer serves — the people whose contact details and photographs a photographer uploads to, or collects through, Gallerite. For a photographer's own account data we are the data controller. For their Clients' data the photographer is the controller and we act as their processor (see our Data Processing Addendum).

We collect:

• Account information — your name, studio name, email address, phone/WhatsApp, and (where you provide them) business registration details such as CAC name and RC number.
• Content you upload — galleries, photographs, invoice and client details, and the names, email addresses and phone numbers of your Clients.
• Payment and payout details — for payouts we collect your bank account details. Card details are handled by our payment partner and are never stored on our servers.
• Technical and usage data — IP address, device and browser information, dates and times of access, and how you use the service. Some of this is collected through cookies and similar technologies (see our Cookie Policy).

We use your information to operate Gallerite: to deliver galleries to your Clients, generate invoices and receipts, process payments and payouts, provide support, keep the service secure, and comply with the law. Our lawful bases under the NDPA are:

• Performance of a contract — to provide the service you signed up for.
• Legitimate interests — to secure, maintain, analyse and improve the service and prevent fraud.
• Legal obligation — to keep financial records and respond to lawful requests.

We do not sell your personal data, and we do not use advertising or cross-site tracking networks.

You may optionally create or sign in to your Gallerite studio account using Google Sign-In. When you choose this option, Gallerite uses the minimum information needed to confirm your identity and set up your account (your email address and name). We do not receive your Google password.

Payments are processed by Paystack. Gallerite is the merchant of record: payments your Clients make run through our Paystack account and are then settled to you. Card details are handled entirely by Paystack and are never stored on Gallerite's servers.

We share data only with the service providers (sub-processors) needed to run Gallerite, and only the information each one needs. Your Clients only ever see the galleries and documents you choose to share with them. Our current providers are:

• Paystack — payments and payouts (Nigeria).
• Cloudflare — photo and file storage (R2) and content delivery (storage region: Eastern Europe).
• Google — sign-in and website analytics (outside Nigeria).
• Transactional email provider — receipts, notifications and other service email (outside Nigeria). We keep more than one email provider under contract and may move between them; each is bound by the same terms as the providers named here.
• Railway — application hosting and infrastructure (outside Nigeria).
• Meta (Facebook, Instagram) — measuring which of our adverts bring photographers to Gallerite (outside Nigeria). This runs on our marketing and sign-in pages only — never in client galleries, on booking or invoice payment pages, or in the photographer dashboard.

We may also disclose information where required by law, or in connection with a merger, acquisition or reorganisation, subject to confidentiality.

Some of our providers process data outside Nigeria — Cloudflare R2 storage is hosted in Eastern Europe, and our email provider, Google, Meta and Railway all process data outside Nigeria. Where personal data is transferred outside Nigeria we rely on a transfer mechanism permitted under Part IX of the NDPA, such as an adequate level of protection, your consent, or contractual safeguards with the provider.

We keep your data for as long as your account is active. After you cancel, we keep account and gallery data for a reasonable period in case you reactivate, then delete it. We retain payment and invoice records for as long as required by Nigerian tax and accounting law, and security and audit logs for a limited period. You may request deletion at any time (see below).

Subject to the exemptions in the NDPA, you have the right to access, correct, delete, port, restrict or object to the processing of your personal data, and to withdraw consent at any time. You can manage most of your information directly in your dashboard, or contact us at privacy@gallerite.com. We may ask you to verify your identity first. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

If a photographer used Gallerite to send you a gallery, invoice or receipt, that photographer is the controller of your personal data and we act as their processor. To exercise your rights over that data, please contact the photographer directly. If you contact us, we will refer your request to them.

Photographers are responsible for having a lawful basis and any required consents to collect and share their Clients' data — including, where photographs feature children, the consent of a parent or guardian.

We use technical and organisational measures appropriate to the risk, including encryption in transit, encryption at rest for sensitive data such as payment keys and two-factor secrets, hashed passwords and gallery PINs, access controls, and private photo storage that is only reachable through short-lived signed links. No method of storage or transmission is completely secure, but we work to protect your data and will notify you and the NDPC of a personal data breach where the law requires.

We may update this policy as the service or the law changes; we will post the new version here with an updated date. For any question about this policy or your data, or to reach our data protection contact, email privacy@gallerite.com.