1. Who we are
GuideGallery is run by Fleek Photos Limited, the data controller for the information described here. You can reach us at support@guidegallery.app.
For the photos in a gallery, the guide who took and uploaded them is the controller, and we host them on the guide's behalf as a processor. If you appear in a photo, you can ask for it to be taken down from the gallery: see Photo removal.
2. What we collect
From guides: your name, email, username, profile photo, the galleries and photos you upload, the links you add to your page, and the details our payment partner needs to verify you and pay you. If you connect PayPal, PayPal tells us your PayPal account ID, the email on that account and whether it is verified.
From guests: nothing to view a gallery. If you tip, the amount and an optional email for your receipt. Card details go directly to our payment partner. We also count gallery and page views without identifying you.
If you ask for a photo to be removed or message your guide from a gallery, we keep what you send: we pass the photos and reason to the guide (but not your email address for removal requests), and email messages on to the guide with your address so they can reply.
Gallery pages and guides' pages send simple events such as “gallery opened”, “photo downloaded” or which link on a guide's page was tapped, with the time, whether you came by QR code or link, the type of device and browser, your country and the site that sent you. We don't store your IP address, put any cookie or identifier on your device, or recognise you across visits.
Security records: when a guide creates an account, signs in with Apple or Google, changes their profile, settings or password, or asks us to delete their account or data, when a guest tips, and when someone asks for a photo to be removed, we record what happened and when, with the IP address and the browser or app it came from. We use these only to prevent fraud and abuse and to look into disputes. Opening a gallery or a guide's page is never recorded this way.
Guides see totals from these events, such as how often their page was opened, how many visits came from their QR code and how often each link was tapped. They never see individual events or anything about a particular guest.
3. How we use it
- To run guide accounts, galleries, guide pages and payouts: our contract with you.
- To process tips and send receipts: our contract with the guest, and our interest in reliable payments.
- For tax, accounting and fraud prevention records: our legal obligations.
- To measure how galleries and guide pages are used, so we can improve them and show guides totals: our legitimate interest, with as little data as possible. You can object at any time by emailing us.
- To keep the service secure, prevent fraud and handle removal requests and reports, including the security records above: our legitimate interest.
4. Companies we work with
These companies process data for us, only as needed to run GuideGallery:
- Supabase: sign-in, database and photo storage.
- Our payment provider: tips and guide payouts. For guides' payout accounts it is also an independent controller of the identity, bank and payment details it collects.
- Resend: email.
- Apple and Google: sign-in, and tip notifications to guides' phones.
- Render: hosting for our API.
- Vercel: hosting for this website and gallery pages.
5. How long we keep it
- Gallery photos: deleted 7 days after the tour.
- Photos a guest asked to remove: hidden at once, and deleted with the gallery.
- Tip records: kept as long as the law requires for tax and accounting.
- Guide accounts: until you delete your account in the app.
- Gallery and guide page events: 25 months. Removal requests and reports: 2 years after they're resolved.
- IP addresses and browser or app details in security records: 12 months, then removed from the record.
6. Sharing
We never sell personal data. We share it only with the companies above, with a guide when a guest messages them or asks for a photo to be removed, and when the law requires it or to protect someone's safety.
7. Security
Data is encrypted in transit and at rest, gallery links use long random tokens, and access to our systems is limited and logged. No system is completely secure, and we'll tell you if a breach affects you.
8. Your rights
Depending on where you live (including under the UK GDPR, the EU GDPR and US state laws such as the CCPA), you can ask to access, correct, delete or move your data, and object to or restrict how we use it. We don't sell or share personal information as the CCPA defines it, and we won't treat you differently for using your rights.
Email support@guidegallery.app; we reply within the time the law sets (usually 30 days). Guides can delete their account in the app: here's how. In the UK you can also complain to the Information Commissioner's Office.
9. Cookies
We only use the cookies needed to sign guides in. There are no analytics, advertising or social media cookies or tags on any page, and gallery and guide pages store nothing on your device.
10. Children
Guide accounts are for adults. Galleries may show children who were on a tour with their family, and guides must only photograph them with a parent or guardian's agreement. A parent or guardian can have any photo of their child removed straight away from the gallery, or by emailing us.
11. International transfers
Data may be processed in the UK, the US, the EU and other places our providers work. When it leaves the UK or EU, we use the legal safeguards the law provides, such as the UK International Data Transfer Addendum and EU standard contractual clauses.
12. Changes
We'll update this page when our practices change, and tell guides about important changes by email or in the app. The date at the top shows the latest version.