Privacy policy

Gerrit (www.gerrit.space) is a gallery service for studios. A studio uploads photos and videos, shares a gallery, and the client pays the invoice to unlock the original files. This page says what we collect, what we do with it, and who else receives it.

The operator of this service is Gerrit. Privacy requests go to support@gerrit.zohodesk.com.

Account data

If you create a studio with email and password, we store:

• your email address
• a hash of your password, not the password itself
• the studio name you enter

Google user data

If you choose Continue with Google, Gerrit requests the Google scopes openid, email, and profile. From your Google account we receive and store only:

• your Google account email address
• your Google account name

We use the email to sign you in or to create the studio account. We use the name only to suggest a studio name, which you can change before the account is created.

We do not receive your Google password. We do not read your Google contacts, files, photos, or calendar. We do not use Google user data for advertising. We do not sell Google user data. We do not use Google user data to train machine-learning models. We do not give Google user data to data brokers.

Google user data is stored on our application server so the account can sign in again. We email that address only for the service itself: gallery, payment, file-expiry, and support messages. The email provider that sends those messages is Resend.

Gerrit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Galleries, clients, and payments

When a studio uses Gerrit we also store:

• the photos and videos the studio uploads
• the client name, client email, event date, and invoice amount the studio enters
• a hash of the gallery PIN, not the PIN itself
• the studio's payout bank, account number, and the account name returned when that account is checked
• payment amount, payment reference, and payment status

Paystack processes the client's card, transfer, or USSD payment and sends the studio payout. We do not store full card numbers. When a client accepts the gallery notice we store the time, IP address, and browser user agent of that acceptance with the project.

Support and cookies

A support ticket stores the sender's email, the subject, and the message. An admin reply is saved on the ticket, shown in the studio's notifications, and emailed to that address.

The cookie gerrit_refresh keeps a studio signed in. The cookie gerrit_client keeps a client inside one gallery after they enter the PIN. We do not use advertising cookies.

Who receives data

We do not sell personal data. These processors receive only what they need to do their job:

• Google, to verify the sign-in and return the email and name above
• Paystack, to collect the invoice and pay the studio's bank account
• Cloudflare R2, to store the gallery files
• Resend, to deliver email to an address already on the account, the gallery, or the ticket
• Vercel, to host this website

An admin action that moves money stores an audit row: who acted, what they did, the target, and the reason they typed. Audit rows are kept.

How long we keep it

Account data stays while the studio account exists. Paid gallery files are kept for 30 days unless the studio vaults or extends them, and may be deleted after that. Files in a draft that nobody opens are removed on the storage schedule shown in the product. Payment records and audit rows are kept.

Access and deletion

Email support@gerrit.zohodesk.com from the account email to ask for a copy of your data or to delete the studio account. We delete the account and the personal data attached to it, including the Google email and name we stored. We keep payment records and audit rows where we have to. A client can use the same address to ask about the name, email, or acceptance record a studio stored for them.

You can also revoke Gerrit's access to your Google account from your Google Account permissions. Revoking that access stops future Google sign-in. It does not by itself delete the studio account.

Nigeria Data Protection Act

We process this data to provide the gallery, payment, and account service a studio signs up for. That is the basis under the Nigeria Data Protection Act.