Who we are
Guestflock is a service for event photos: a host creates an event, guests scan a QR card at their table, share their photos, and the photos play on the venue's big screen and go into a shared album.
Guestflock is run by [Company legal name], a company registered in Nigeria with the Corporate Affairs Commission (RC [RC number]), at [registered address]. In this policy "we", "us" and "Guestflock" mean that company.
Our Data Protection Officer is [DPO name], reachable at [DPO email]. Write to them about anything in this policy.
This policy follows the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive 2025 (GAID) of the Nigeria Data Protection Commission (NDPC).
Who this policy covers
- Hosts: the people who create an event and pay for its plan, and their co-hosts.
- Guests: people who join an event from its QR card or link. Guests don't create accounts.
- Organizers: event planners and vendors who use Guestflock for their clients (see also the Organizer terms).
- Visitors to guestflock.com.
What we collect and why
Hosts and organizers
| What | Why | Lawful basis |
|---|---|---|
| Name, email address, password (stored only as a scrypt hash), or your Google account id if you sign in with Google | To create and secure your account | Contract |
| Email verification time, sign-in times, and for each signed-in browser its IP address and browser type | To keep your account safe and show you where you're signed in | Legitimate interest (security) |
| Your agreement to these Terms and this Privacy Policy (version, time, IP address, browser) | To show what you agreed to and when | Legal obligation and contract |
| Events: name, type, date, venue, plan, settings | To run your event | Contract |
| Orders and invoices: plan, amount, VAT, Paystack reference, payment channel, the name and email billed | To take payment and keep tax records | Contract and legal obligation |
| Payout bank account (for cash gifts and commissions): bank, account number, and the account name your bank returns | To pay gifts and commissions straight to you through Paystack | Contract |
| How you found us (for example an album link or an organizer's referral link) | To credit organizers and understand what brings hosts in | Legitimate interest |
| Organizers: business name, phone number, Instagram handle, logo, referral code, commissions | To run the organizer programme and co-brand your clients' events | Contract |
Your bank account number is encrypted (AES-256-GCM) before it is stored. We only ever show or log its last 4 digits.
Guests
When you join an event you agree that "I’m happy to share my photos with the hosts and other guests of this event." This section is the text behind that choice (consent record guest-sharing-v1).
| What | Why | Lawful basis |
|---|---|---|
| The name you type when you join (it can be a nickname) | So the hosts and the big screen know whose photo it is | Consent |
| Your consent record: the version you agreed to, the time, your IP address and browser | To show you agreed | Legal obligation |
| A cookie that keeps your phone joined to the event for 30 days | So you don't have to join again | Necessary to provide what you asked for |
| Your photos, captions, and your choice of "Show on the big screen" | To share them as you chose | Consent |
| Reports you make about a photo | To review them and take the photo down if needed | Legitimate interest and legal obligation |
| Cash gifts you send: the name and message you write, the amount, and whether the message may show on the big screen | To deliver your gift and show your message | Contract |
How your photos are handled:
- Before anyone sees a photo, our system re-saves it with all hidden details removed, including GPS location and camera information.
- "Show on the big screen" on (the default): the photo can appear on the venue screen during the party and in the shared album that anyone with the album link can open.
- "Show on the big screen" off: only the hosts (the host, co-hosts and an organizer the host added) can see it. It never goes on the screen or in the shared album.
- You can change that choice, delete a single photo, or delete everything you shared at an event from "My photos" on your phone, at any time while the album exists.
- Hosts can hide any photo. We can remove photos that break our Acceptable use policy.
- We don't use face recognition, we don't sell photos, and we don't use them for advertising.
Cash gifts: Paystack needs an email address to send you a receipt. We pass it to Paystack and never store it. The big screen can show your name and message (if you allow it) but never the amount. The hosts see the amount.
Album email
A guest can choose "Email me the album from this event. Use my address for this one email only, then delete it." This section is the text behind that choice (consent record guest-album-email-v1).
- We use the address for one email: the album link, the morning after the event (09:00 Lagos time).
- We erase the address as soon as that email is sent. If you change your mind first, use "Stop" on your phone or the unsubscribe link, and we erase it at once.
- If the album is deleted before the email goes out, the address is deleted with it.
Visitors and the waitlist
Before launch, people could leave an email on our waitlist (consent record waitlist-v1). We use it only to tell them Guestflock is open, and we delete waitlist emails 30 days after launch.
We don't use analytics or advertising trackers on guestflock.com. See the Cookie policy.
Support staff
Our support staff sign in to a separate admin portal with a password and a second code (two-factor). Each staff member only sees what their role needs. Every time a staff member opens an account, or looks at an event's private photos, it is recorded in an audit log that cannot be edited.
Who can see your data
- Everyone with the event's link or QR code: the event name, date and venue, and the photos guests chose to show (on the big screen and in the shared album), with the guest's name.
- The hosts (and an organizer the host added to the event): every photo of their event, including private ones, guests' names, and the cash gifts with amounts and messages.
- An organizer who only referred a host sees the event's name, date, plan and their commission. Never photos, guests or gifts.
- Guestflock staff, only as their role needs (support, finance or owner), with views of private photos recorded.
We share data with these service providers, who process it for us under contract:
| Provider | What for | What they get | Where |
|---|---|---|---|
| Railway | Hosting our servers, database and photo storage (Railway Bucket) | Everything we store | [Railway region] and [bucket region], outside Nigeria |
| Paystack | Payments, cash gifts, payouts and refunds | Payment details, the payer's email, the payout bank account | Nigeria |
| Resend | Sending emails | Your email address and the email's content | [Resend region, e.g. United States] |
| "Continue with Google" sign-in, only if you use it | Your sign-in | [Google region] | |
| [Sentry, if enabled] | Error reports so we can fix bugs | Technical details of an error, with emails, phone numbers, account numbers, tokens and guest names removed first | [Sentry region] |
We may also share data when the law requires it (for example a valid court order), or to protect people from harm.
Where your data is stored
Our servers run on Railway in [Railway region], and photos are stored in a private Railway Bucket in [bucket region]. Both are outside Nigeria, so using Guestflock involves transferring personal data abroad.
We rely on [transfer basis under NDPA section 41–43 and GAID, to be confirmed by our lawyer] for these transfers. We protect the data the same way wherever it is: it is encrypted in transit, photos are only reachable through private links that expire after one hour, and bank account numbers are encrypted at rest.
How long we keep it
Nothing is kept forever. Deletions are done by an automatic job every night, not by hand.
| Data | How long |
|---|---|
| An event's photos, guests, reports and album downloads | Until the album's end date: the event date plus the plan's album period. Free: 14 days. Basic: 3 months (90 days). Celebration: 12 months (365 days). Premium: 24 months (730 days). The host gets a reminder 7 days before. |
| Guests' consent records | Deleted with the guest when the album ends, or when the guest deletes everything |
| An album email address | Erased right after the album email is sent, when the guest stops it, or when the album ends, whichever is first |
| ZIP downloads of an album | 7 days |
| Photos we removed for breaking the rules | The image files are deleted 30 days after removal; a record of the removal is kept |
| Photos that failed to upload | 7 days |
| Cash gift records | At the album's end, the sender's name becomes "Guest" and the message is deleted. Amounts, fees and references stay as the host's financial record |
| A gift sender's email | Never stored |
| Payment notifications from Paystack | Stored without payer names, emails, phone numbers or card details; even that is emptied after 90 days |
| Invoices | Kept as tax records for [period required by tax law, to be confirmed]; they can't be edited |
| Your account | Until you ask us to delete it (see below) |
| Organizer invites to clients | Deleted 30 days after they expire (an invite expires after 14 days) |
| Waitlist emails | 30 days after launch |
| Backups | Our database backups expire after [BACKUP_RETENTION_DAYS, default 30] days, so deleted data can remain in a backup until then |
| Audit logs and support notes | [Period to be confirmed]. They record who did what and when, using ids rather than content |
If a host upgrades, the album is kept for longer. If a plan payment is refunded, the album goes back to the earlier plan's period, but never ends less than 7 days from the refund.
Your rights
Under the NDPA you can ask to see the data we hold about you, correct it, delete it, move it, object to how we use it, and withdraw consent at any time (this doesn't undo what was done before).
Things you can do yourself, right away:
- Guests: delete a photo, make a photo private, delete everything you shared at an event ("Delete everything I shared here" in My photos), and stop the album email.
- Hosts: hide photos, turn off the big screen, and download your album before it ends.
For anything else, email [DPO email]. Tell us who you are and, for guests, the event link and the name you joined with. We may ask you to confirm it's you. We complete deletion requests within 30 days.
What deleting an account does: you're signed out everywhere; events with no payments are deleted with their photos; events with payments keep their payment records but their album is deleted at once; your payout account is closed; your organizer profile and logo are deleted. Because invoices are tax records, if you have paid for anything we keep your invoices and replace your name and email elsewhere with "Deleted user". Data in backups disappears when those backups expire.
If you're not happy with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
Children
Guestflock accounts are for adults (18 and over). Children often attend weddings and birthdays, so photos at an event may show them. Hosts are asked to make sure parents are happy for their children to be photographed and shared [lawyer to confirm the parental-consent wording and mechanism].
If you're a parent and want a photo of your child taken down, ask the host to hide it, or email [support email] and we will act within 24 hours. To have every photo you shared of your family deleted, use "Delete everything I shared here" or email [DPO email].
How we protect your data
- Everything is sent over encrypted connections (HTTPS).
- Photos are stored privately and only shown through links that expire after one hour.
- Passwords are stored as scrypt hashes; sign-in links and codes are stored only as hashes.
- Bank account numbers are encrypted (AES-256-GCM); we only show the last 4 digits.
- Staff use two-factor sign-in, roles limit what each person can see, and an audit log records what they do.
- Our logs never contain passwords, codes, full phone numbers, emails or bank account numbers.
If a personal data breach puts people at risk, we will tell the NDPC within 72 hours of finding out, and tell the people affected when the law requires it.
Changes to this policy
Each version of this policy is published with its own number and date, and every earlier version stays available below. When a change matters for your choices, we'll ask again before it applies to you. The version you agreed to is recorded with your consent.
Contact
[Company legal name], [registered address]. Data Protection Officer: [DPO name], [DPO email].
Versions
- v1Effective 20 October 2026You’re reading this
This is the first version. When it changes, earlier versions stay listed here.