Privacy Policy

Last updated: 29 October 2026

1. Introduction

TheGalleryCreatives ("we," "us," "our") is committed to protecting the privacy of our users ("you," "your"). This Privacy Policy outlines how we collect, use, and share your personal information, and how we handle sensitive user and device data on our platform, in accordance with UK data protection laws.

2. Data We Collect

2.1. Personal Information

• Email address & usernames.
• If you sign in with Apple or Google: the email address they share with us and, with Google, your name.
• Location data: when you share your location, we collect your precise location. We keep the exact point private: no other user ever sees it. We use it to tell people about new creatives in their area and, for creatives who turn on "Show on map", to place them on the map at a position rounded to about 1 km. Other users can see the name of your town or area.

2.2. Content You Share

• Your posts, photos and videos (including posts you import from Instagram, if you connect it), your profile picture, bio and links, and the messages you send in chats.

2.3. Usage Data

• We may collect information on how you use our platform, including interactions with other users, saved content, and engagement metrics. This data helps us improve our services and provide a better user experience. We use PostHog to understand how the app is used and Sentry to find and fix crashes and errors. They receive your account ID and device details (phone model, system and app version), never your name or email address.
• We do not show advertising, sell your data, or track you across other companies' apps or websites.

2.4. Identity Verification

• If you choose to verify your identity, Stripe checks your ID document (passport, driving licence or ID card) on its own secure page. We keep only the result and a one-way code made from your verified name and date of birth, which stops one person claiming a reward twice. We never receive your ID photos; Stripe handles them under its own privacy policy.

2.5. Device Data

• Your phone's notification address, so we can send you notifications.

3. Legal Basis for Processing Personal Data

We collect and process your data based on the following legal grounds:

• Consent: When you provide explicit permission for us to collect and use your data.
• Contractual necessity: When processing is required to fulfil our obligations to you (e.g., providing services you requested).
• Legitimate interest: For the purpose of improving our services, marketing, fraud prevention, and user verification.

4. How We Use Your Data

4.1. Service Provision

• To create and manage your account.
• To verify your identity and ensure a safe environment for all users.

4.2. Enhancing User Experience

• Personalising your experience and recommendations on the platform.
• Monitoring app performance and improving features.

4.3. Communication

• To provide customer support and respond to enquiries.
• To send you notifications and emails about your account, such as confirming your email address or resetting your password.

4.4. Fraud Prevention & Security

• Monitoring activity to detect and investigate suspicious behaviour.

5. Data Retention

We retain your personal information for as long as necessary to provide you with our services or as required by law.

When you delete your account, we delete your profile, posts, photos, videos, chats, messages and the rest of your account data. Some records are kept: reports made about your content (with your username and the reported content as it was then), reports you made about others (without your name), a record that we deleted your account if we did it for you (with your username), records of rewards paid (without your details), usage statistics and crash reports (which carry only an account ID), and copies in our backups for a limited time.

6. Children's Privacy

Our platform is not intended for users under the age of 16. If we become aware that we have collected data from a child under this age without parental consent, we will promptly delete it.

7. Security Measures

We use industry-standard security measures, including encryption, access control, and secure servers, to protect your data. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

8. Service Providers and Data Transfers

We use trusted service providers to run the platform. They process your data only to provide their service to us:

• Supabase: hosting, database and file storage.
• Resend: account emails.
• Expo: push notifications and app updates.
• Stripe: identity verification.
• Sentry: crash and error reports.
• PostHog: usage statistics.
• Apple and Google: sign-in, maps and delivering notifications.
• Meta: importing your Instagram posts, only if you connect Instagram.
• Vercel: our website and share links.

Your personal information may be processed or stored outside the UK. If this occurs, we take necessary steps to ensure your data is protected under UK data protection laws, including using standard contractual clauses where required.

9. User Rights

You have the right to:

• Access, update, or delete your personal information.
• Withdraw your consent at any time.
• Request the deletion of your account and associated data.

You can delete your account at any time in the app: open your profile, tap the menu button at the top right, then "Account" and "Delete Account". You can also ask us to delete it: see www.thegallerycreatives.com/delete-account.

To exercise these rights, contact us at chris@thegallerycreatives.com

10. Changes to this Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page, and significant changes will be communicated to you through the app or via email.

11. Contact Us

For questions or concerns about this Privacy Policy, please contact us at:

Email: chris@thegallerycreatives.com