Shotpot ("Shotpot", "we", "us") is a photo gallery platform operated by Crunchy Software Ltd, a company registered in England and Wales (company number 14576468) with its registered office at 70 Grange Road East, Birkenhead, Wirral, United Kingdom, CH41 5FE.
This policy explains what personal data we collect, how we use it, and the rights you have under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. Crunchy Software Ltd is the data controller for the personal data described in this policy.
If you have any questions, contact us at hello@shotpot.co.uk.
Who this policy covers
- Account holders — photographers and event organisers who create a Shotpot account to upload and publish galleries.
- Gallery visitors — people who view a published gallery.
- Website visitors — anyone browsing our marketing site, including people who submit their email address or request a demo.
What we collect
Account holders
- Account details — your email address and authentication data. Sign-in is handled via one-time codes; we do not store passwords.
- Content you upload — the photos you upload to your galleries, gallery titles, folder names, and related settings.
- Billing information — your subscription plan and payment history. Card details are collected and processed by our payment provider, Stripe; we never see or store your full card number.
- Usage data — actions you take in the product (for example creating a gallery or publishing it), recorded against your account ID for analytics and support.
Gallery visitors
- Photos of you — galleries published on Shotpot contain photos uploaded by the account holder (for example, the photographer at an event you attended). The account holder is responsible for having an appropriate basis to publish those photos; we host and display them on their behalf.
- Technical data — standard server logs (IP address, browser type, pages requested) needed to serve and secure the site.
Website visitors
- Contact details you give us — if you join our mailing list or request a demo, we collect your email address and any details you include, and use them to respond and to send you relevant updates about Shotpot. You can unsubscribe at any time.
How we use your data and our legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service — hosting galleries, authentication, serving photos | Performance of a contract |
| Billing and subscription management | Performance of a contract; legal obligation (tax/accounting records) |
| Product analytics and service improvement | Legitimate interests (understanding and improving the product) |
| Marketing emails to people who signed up for them | Consent |
| Security, fraud prevention, and abuse detection | Legitimate interests |
| Responding to support requests | Legitimate interests / performance of a contract |
Who we share data with
We use a small number of service providers ("processors") to run Shotpot:
- Amazon Web Services (AWS) — storage and delivery of photos.
- Vercel — application hosting and content delivery.
- Stripe — payment processing. Stripe acts as an independent controller for the card data it processes; see Stripe's privacy policy.
Each provider only processes data on our instructions and under a data processing agreement. We do not sell personal data, and we do not share it with third parties for their own advertising.
We may also disclose data where required by law, or in connection with a business sale or restructuring (in which case this policy would continue to apply to your data).
International transfers
Some of our providers store or process data outside the UK (for example in the United States or the EU). Where that happens, transfers are protected by UK-approved safeguards such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy decision.
How long we keep data
- Account data and gallery content — for as long as your account is active. If you delete your account (or ask us to), we delete your account data and uploaded content within 30 days, except where we must keep records to comply with legal obligations.
- Billing records — kept for 6 years as required by UK tax law.
- Server logs — kept for a short rolling period for security and debugging.
Cookies
We use cookies that are essential for the service to work — primarily authentication session cookies that keep you signed in. We do not use third-party advertising cookies.
Your rights
Under UK GDPR you have the right to:
- access a copy of your personal data;
- correct inaccurate data;
- have your data deleted;
- restrict or object to certain processing;
- data portability;
- withdraw consent at any time (for example, for marketing emails), without affecting processing that happened before withdrawal.
To exercise any of these rights, email hello@shotpot.co.uk. We will respond within one month.
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how we handle your data.
Changes to this policy
We may update this policy from time to time. We will post the updated version on this page and, for material changes, notify account holders by email.
Contact
Crunchy Software Ltd 70 Grange Road East, Birkenhead, Wirral, United Kingdom, CH41 5FE hello@shotpot.co.uk