Privacy Notice

Version 1.1 · Effective 31 October 2026

45shot is a shared photo gallery for events. Guests open an event's gallery with a link, QR code or event code, add their own photos and videos, and see what everyone else captured. Organisers create those events and manage them.

This notice explains, in plain language, what personal information we hold, why we hold it, who can see it, and what you can ask us to do about it. It is written to meet the Protection of Personal Information Act 4 of 2013 (POPIA).

We do not claim that this notice, on its own, makes 45shot compliant. It is one part of how we handle personal information, and it is reviewed as the service changes.

1. Who is responsible for your information

The responsible party for the information described in this notice is:

• Legal entity: 45shot (PTY) LTD, registration number 2026/856337/07
• Registered address: Port Elizabeth, South Africa
• Information Officer: the Information Officer appointed by 45shot (PTY) LTD
• Information Officer email: support@45shot.com

The Information Officer is registered with the Information Regulator and is the person to contact about anything in this notice. If you are not satisfied with our answer, you may complain to the Information Regulator (section 12).

2. What we collect

If you create an organiser account: your email address, your name if you give one, and how you sign in (email and password, or Google). We also hold the events you create.

About an event: the event name, type, date and times, venue and location, description, cover image, and the link, QR code and event code that guests use to open it.

If you join an event as a guest: you do not need an account. When you add photos or videos, we hold those files, the name and surname you type in, and the technical details needed to run and protect the gallery — a short-lived upload session and a hashed device fingerprint used to detect abuse. If you upload, we also hold the confirmation you gave before uploading.

When you accept this notice or the terms: we record which version you accepted, when, and which event it related to. The register stores a hashed identifier for your browser session — never your name, email address or IP address.

Payments: organisers pay for events through our payment provider. We receive confirmation that a payment succeeded and record it against the event. We do not receive or store your card details.

We do not collect: your identity number, your address, your contacts, your location, or any biometric identifier. We do not run facial recognition, we do not ask for selfies, and we do not compute face templates. See section 5.

3. Why we process it, and on what grounds

POPIA requires a lawful ground for each purpose. Ours are:

• To run the service you asked for (performance of a contract): holding your account, your events, your gallery files and your uploads, and showing the gallery to people you have given access.
• To take payment (performance of a contract): confirming an event purchase with the payment provider.
• To keep the service safe and working (legitimate interest): rate limits, abuse prevention, hashed device fingerprints, upload validation, and diagnosing faults. We balance this against your rights and keep it to what the service needs.
• To keep the legal record of consent (legal obligation and legitimate interest): recording which document version you accepted, and when.
• To answer you (legitimate interest, or consent where the law requires it): responding to a request about your information.
• To send you an email you need (performance of a contract): for example a password reset or an event notice. We do not send marketing without your consent.

We do not use your information for automated decision-making or profiling that has legal or similarly significant effects on you.

4. Event photographs and videos

Photos and videos added to an event belong to the person who took them, and are shared into that event's gallery on the basis set out in our terms.

A photograph can reveal more about a person than they intended — who was present, what they wore, their health, their beliefs. POPIA treats some of that as special personal information. We do not process event photos to infer any of it: we store, resize and display the photos for the event gallery, and nothing else.

Location and camera details (EXIF) are stripped from the versions shown in the gallery. The original file is kept so the person who uploaded it can retrieve their own quality, and is never shown publicly.

Event photos can be downloaded by people with access to that gallery where the organiser allows it, and by the organiser. That is what a shared gallery is for, and the upload confirmation says so plainly before anyone uploads.

5. No biometric processing

We do not process biometric information. We do not ask for selfies, do not compute face templates or facial embeddings, and do not run facial search over any gallery. The photo-search feature is not enabled, and no biometric consent is asked for or implied by opening a gallery.

If we ever offer a feature that processes biometric information, it will be separately assessed, separately consented to, and never bundled into ordinary gallery access.

6. Who can see what

• An event gallery opens for anyone holding that event's link, QR code or code. A private event only opens once the code has been entered.
• Organisers see every photo in their own events, and can remove any of them.
• Guests see the gallery of the event they opened. A guest session reaches that one event only.
• Our team can reach records for support, moderation and legal requests, under the access controls in section 8.
• Nobody else. We do not publish event photos, do not sell them, and do not share them for advertising.

7. Operators and where your information is held

We use service providers ("operators" in POPIA) to run 45shot. They act on our instructions and are not allowed to use your information for their own purposes.

• Platform hosting and database: the application, accounts and records run on the Base44 platform, which hosts the application and its database on our behalf.
• File storage: photos and videos are kept in a private Cloudflare R2 bucket operated by Cloudflare, Inc., served through links that expire.
• Payments: card payments for events are processed by Paystack, which takes your card details on its own hosted checkout page. 45shot does not receive or store your card number.
• Email: account emails (such as a password reset) are sent through the Base44 platform's email service.

We do not send event photos to any external model vendor, cloud vision service or advertising network.

8. Safeguards

• Photos are held in private storage, never in a public bucket, and reached only through short-lived signed links.
• Guest access is proved by a session tied to one event, and private events require their code.
• Administrative access is limited to named people, protected by account permissions, and reviewed as the team changes.
• Sensitive operations run on our servers, not in the browser, so a browser cannot grant itself access to another event's records.
• We keep the amount of information we hold to what the service needs: the consent register, for example, holds a hashed device identifier rather than a person.

If we become aware that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the people affected as soon as reasonably possible after discovery, as section 22 of POPIA requires, and tell you what happened and what we are doing about it.

9. International transfers

Some operators may process information outside South Africa. POPIA allows this only where the recipient is subject to a law, binding agreement or corporate rules that give substantially similar protection, or where another ground in section 72 applies. Our operators are bound by their own data protection terms with us, which we rely on for any processing that happens outside South Africa.

If you would like to know where a particular record is processed, ask the Information Officer.

10. How long we keep things

• Account details: while your account is open, and afterwards only as long as a legal or accounting obligation requires.
• Events and their galleries: until the event is deleted. Retention follows a published rule: an event becomes eligible for deletion a set period after the event date (or its closing date, if later), with notice before deletion and a verified deletion of the stored files afterwards.
• Photos and videos: removed from the gallery immediately when deleted, with the stored files queued for verified removal from storage.
• Consent records: kept for as long as we may need to prove what a person accepted, which is the point of keeping them at all. They hold no name or contact detail.

We do not keep information indefinitely "just in case".

11. Your rights, and how to use them

Under POPIA you may ask us to:

• confirm whether we hold personal information about you, and give you a copy of it;
• correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• stop processing that relies on your consent, by withdrawing it;
• object to processing based on legitimate interest;
• not be subject to a decision based solely on automated processing.

Email the Information Officer at support@45shot.com with what you want and enough detail to find the record — for example the event link and the name you uploaded under.

We respond within 30 days. We may ask you to prove your identity before handing over a record, so that we do not give someone else your information.

Two practical limits you should know about:

• Photos in someone else's event are controlled by that event's organiser. We will pass a removal request to the organiser and follow their instruction, and we can remove content that breaches our terms ourselves.
• Withdrawing a consent stops future processing based on it. It does not, by itself, delete photos that were validly shared before you withdrew — ask for those to be removed, and they will be.

12. Complaints

If you are unhappy with how we have handled your information, tell the Information Officer first so we can fix it. You may also complain to the Information Regulator (South Africa):

• Email: complaints.IR@justice.gov.za
• Website: https://inforegulator.org.za
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Switchboard: 010 023 5200

13. Cookies and local storage

We use the minimum needed to run the service: keeping organisers signed in, holding a guest's gallery session open while they browse and upload, remembering small preferences such as the order photos are shown in, and remembering that you accepted a particular version of this notice so you are not asked again on every page view. There is no advertising or third-party tracking on 45shot.

14. Changes to this notice

This notice is versioned. Each version records its text, its publication date, the date it takes effect, who published it and what changed, and an older version is never overwritten.

When a change affects what you are agreeing to, we will ask you to accept the new version before you continue — an earlier acceptance is not carried over, and the record of what you accepted before is kept as it was.

The version you accepted is shown when you open a gallery, and the current version is always published at /privacy.