Privacy notice
Last updated 30 October 2026.
Galleris is made by Hoo Socials Limited. This notice says what we collect, who holds it, how long it stays and how to get rid of it. It is written to be read once, by a person, rather than filed.
Three different people use Galleris, and what is collected is different for each. Find yourself in this list:
- You scanned a code beside an object, or opened a museum's link. Almost nothing. Which museum you opened, a random number your browser made up for itself, and how many seconds the museum took to open on your phone. No name, no email, no account. If you press a heart or Enquire on a work, the gallery is told that the work was hearted or asked about, never by whom. If you write a note, you give your name and email to that gallery.
- You signed in to a museum's archive. Your email address and the name you typed. Those belong to the museum, not to us — see Whose data it is.
- You are building a museum, or you wrote to us. What you typed into the studio stays in your own browser until you publish. What you typed into the contact form comes to us.
Index
1. Personal information we collect 2. Tracking and other technologies 3. How we use your personal information 4. Retention 5. How we share your personal information 6. Your choices 7. Who is responsible for what, and other sites 8. Security 9. International data transfer 10. Children 11. Changes 12. How to contact us 13. Your rights, and notice to European users
Personal information we collect
If you only opened a museum
| What | Why |
|---|---|
| The museum's short name | so the curator can see that somebody opened it |
| A random number your browser made up | so two visits from the same phone in one hour count as one |
That random number is not a person. It is not derived from your device, your network or anything about you, it is never joined to a name or an address, and it is never shared with another museum. For a museum on a fourteen-day trial it sits in trial_visits on our database and is deleted when the museum ends. For every other published museum we keep only a one-way scramble of it, for two hours, so that a refresh is not counted as a second visitor.
What the curator sees is a total per day — the museum's short name, the date and a number — kept in museum_days. Nothing in it says who you are.
The guide itself keeps a count of which objects you opened and how far through each recording you got. That stays on your own phone, and is what fills in the curator's numbers only on their own device, not yours. Clearing your browser clears it. Three things are sent when you do them, and only then: a heart, a press of Enquire, and a note. The next section says what each holds.
If you hearted a work, pressed Enquire, or wrote a note
| What | Where | How long |
|---|---|---|
| A heart: which gallery, which work, when, and a one-way scramble of your browser's random number, made with that gallery's name so it matches nothing else | hearts | until you press it again, then eight days; or until the gallery is no longer published |
| Enquire: which gallery, which work, WhatsApp or email, and whether you scanned the work's code. Nothing about you | enquiries | 400 days |
| The random id your phone gave that press of Enquire, so a press sent twice because the connection dropped counts once. Each press counts. It names no phone | enquiry_seen | eight days |
| Signing in to one gallery: your email address, the name you typed, and a one-way scramble of the key your phone keeps | visitor_sessions | 30 days |
| A note: the name and the words you typed, which work, when, whether you scanned its code, and your email address | notes | until you remove it, the gallery is no longer published, or 400 days after you last changed it |
A note goes to that gallery and nobody else. The gallery may reply to it by email, and the sign-in screen says so before the code is sent. Nobody else sees it unless the gallery shows it on the work, under the name you gave; changing it takes it off again until the gallery shows it again. Your address is never shown to anybody but that gallery. For a gallery's notes, the gallery is responsible, as for its archive list. Signing in to write a note puts you on that gallery's list as signed in only, never for its news.
A sign-in is for one gallery. Signing in to one gallery does not sign you in to another.
On our own example galleries, hearts and notes stay on your phone and are never sent: nobody is there to read them.
If you asked for a sign-in code
| What | Where | How long |
|---|---|---|
| A one-way scramble of your email address | sign_in_codes | ten minutes, then swept within the hour |
| A one-way scramble of the code we sent | sign_in_codes | the same |
| Your real email address | in the sending request, and then in the museum's list | see the next table |
A one-way scramble (a SHA-256 hash) cannot be turned back into your address. We store it that way on purpose: a copy of that table is not a mailing list and not a set of working codes. Your address itself exists for the length of one request while the email is sent.
If you signed in to a museum's archive
| What | Why |
|---|---|
| Your email address | it is how the museum recognises you and how it can write to you |
| The name you typed | so the museum can address you |
| Whether you ticked the box asking for museum news | see Two questions, not one |
| When you joined, and when you last signed in | so a list that nobody uses can be cleared |
| A random unsubscribe token | so one press of a link in an email takes you off |
If you said you are coming to a show
| What | Why |
|---|---|
| The name and email address you typed, and how many of you are coming | so the gallery or museum has a door list for its private view |
| Which show, and when you said yes | so saying yes twice changes your answer rather than counting you twice |
Only the gallery or museum that runs the show can read this list. Nothing is paid, no place is held, and nobody checks you in.
If you signed in with Google
Google tells us your email address and your name, and that Google has checked the address. We keep the address, exactly as if you had signed in with a code, and use the name only to fill an empty full name in Details. We do not see your Google password, your contacts or anything else in your Google account. Google is a sign-in provider for this and nothing more; its own privacy policy covers what it does.
If a gallery invited you to add to its works
| What | Why |
|---|---|
| Your email address | the gallery typed it to invite you; we email you the link and show the gallery who it invited |
| A one-way scramble of your link | so the link can be checked without being kept; a copy of our records opens nothing |
| What you typed and any recording you uploaded, per work | so the gallery can approve it or send it back |
| When you opened the link, last edited, and sent | so you and the gallery can both see where it stands |
You sign in to a Galleris account for that address, by a code or with Google, before the link opens anything: a forwarded link opens nothing for anybody else. Nothing you add is public until the gallery approves it. Your recording is kept in private storage that only the gallery can play, through a link that stops working after an hour.
If you wrote to us
The contact form asks for your name, your organisation, your email, what you look after, roughly what budget you are working with, and your message. It comes to our server, where we keep it with the feedback we receive, and to our inbox by email. If our server does not answer, or answers with an error, it goes to our inbox through Formspree instead. There is a hidden field on the form that a person never sees, used to catch automated spam; if you are a person you will never fill it in.
If you opened the studio
Opening the studio asks for nothing. What you build stays in your own browser (see below) until you publish.
The studio tells us how far you have got — opened, first work added, spreadsheet brought in, published, link shared, card made, template used, bank details saved; the sign-up screen shown, a code sent, Google chosen, and whether you signed up or in by code or by Google — and any problem you hit, by a short code such as publish:too-big — and how long the slow steps took (publishing, adding photos, bringing in a spreadsheet), so we can make them faster. Each step goes to our own database with a one-way scramble of the random number your browser made for itself (never the number), the kind of collection, a count, and, once you have an account, which account it was. When you publish, the step also carries your viewing room's name, which is on a public page anyway. Mixpanel is told the same steps with the kind of collection and a count, and no name, email address or link.
Once your viewing room is published, the studio may ask one question — sad, okay or happy — and then not again for a month. Closing it counts as an answer. If you pick a face, it goes to our own database with your account, so we can reply, and a sad one is emailed to us the same day. Answers are deleted after 400 days with the other steps.
If you made an account
Publishing asks for your email address and sends you a six-digit code. That is the account: there is no password. We keep your address, when you joined and when you were last in, and anything you type into Details — your full name, gender (or "prefer not to say") and location. Your full name is on your card, which people who look you up see (below); your gender and location are only seen by you and by us. Signing in keeps a one-way scramble of a random key in your browser for 180 days, so you are not asked again; we do not keep the key itself. Signing out ends it. The address gets the code, one welcome email when the account is first made, and an email when your viewing room goes live. We may also write to you ourselves, by email or on WhatsApp where your viewing room publishes a number, about your account or about something you told us. Never marketing. When we open your account's record, that is noted (who opened it, and when) and kept for 400 days, like a look-up.
Which version of the Terms you agreed to, and when. Kept while your account exists.
Every account has a username, which you can change, and a Galleris ID, six letters and numbers we make. Either lets somebody find you to send you a work. What they see is your name, your username, your Galleris ID and your galleries' names and logo — never your email address. Only somebody signed in can look you up, at most 30 times an hour, and each look-up is recorded (who asked, and when) for 400 days. A username you give up is kept for you for 30 days, so nobody else can take it in that time.
People you list under Contributors — with an email, phone, location, gender or date of birth — are kept in your browser and are never published: only their name and role leave it. Once your gallery is published, the studio asks us which of those emails belong to a Galleris account, so it can show them as "On Galleris"; the emails are checked and not kept.
If you published a museum
The museum's own document and its photographs go to our storage so that a stranger's phone can reach them. We also keep the museum's short name, its size, how many times it has been sent up, which account published it, and a one-way scramble of the key your browser made to prove the museum is yours.
A draft is never uploaded. Everything you build in the studio stays in your own browser, in its own storage, until you press Publish. We cannot see it.
If you set up payments for your archive
Through Galleris, you give a bank and an account number. Paystack checks the name on the account and makes a "subaccount" for your gallery, so that when a visitor pays, Paystack sends your share straight to that bank. We keep the bank's name, the name on the account and its last four digits — never the full number, which Paystack holds. If you use your own Paystack instead, we keep only your public key, which is in your published museum for the payment window to use. Your secret key never comes to us.
If you paid for an archive
You pay on Paystack's own page, not ours, and your card details go only to Paystack. We keep a record of the payment: a reference, which archive, which plan, the amount and currency, the email you gave, and whether it was paid. Payments are financial records and are kept as such.
If you joined the GAID waitlist
The box on the GAID page keeps your email address, the moment you joined, and the page you joined from, so that we can tell you when GAID opens. Nothing else, and nobody else is sent it. If our server does not answer, the address goes to our inbox through Formspree instead. To come off the list, reply to any email from us or write to us, and we delete it.
If you sent us feedback
The box under Contact us sends your words, the page you were on and, if you are signed in, your account's email address, so that we can answer. It is kept in our database, and the owner of Galleris is sent a copy by email.
Tracking and other technologies
Galleris sets no cookies of its own. Google Analytics and Mixpanel set theirs on the marketing site and in the studio, to tell one visit from another. The visitor guide sets none.
What the product does use is your browser's own storage, which is not a cookie and is not sent to anybody: the random number described above, a note of which galleries you have signed in to on this device, the hearts you pressed, a heart or note still waiting for a signal, your own count of what you opened, and — in the studio — the museum you are building, your account's signed-in key if you have one, and any note to us still waiting to be sent. Clearing your browser's site data clears all of it.
How we use your personal information
Three parts of the product, and they are treated differently on purpose.
| Where | What runs |
|---|---|
The marketing site (gallerismuseum.com) | pages counted, clicks counted, and the screen recorded |
| The studio | pages and clicks counted. No screen recording, because a curator's unpublished material is on it |
| The visitor guide | nothing, by default. No pages counted, no clicks, no recording. A heart, an Enquire press and a note are sent only when you make one |
The visitor guide is the one that matters most. Somebody who pointed a phone at a square on a wall agreed to nothing, may be a child on a school trip, and cannot opt out of something they were never told about. So it measures itself on the device, and sends a heart, an Enquire press or a note only when somebody makes one.
Where recording does run, every field and every piece of text is masked before anything is stored, so what somebody typed is never in the recording. Your network address is shortened by Google Analytics before it is stored. If your browser sends a "Do Not Track" signal, Mixpanel is switched off.
What we do not measure at all: how long you looked at anything. There is no timer anywhere in the product, and nothing we say about the product will claim one.
Retention
| What | How long |
|---|---|
| A one-way scramble of an address, and of a sign-in code | ten minutes, then swept within the hour |
| The counter that stops one address being sent hundreds of codes | one day |
| A trial visit: museum name and random number | until the museum ends, then deleted |
| A one-way scramble of the random number, for any other published museum | two hours |
| A museum's total visits per day | kept; it holds no device number and no address |
| A trial museum's own record | until it ends, then deleted |
| A record that a museum ended: its name, when it opened, when it ended, why, and how many visits it had | kept, and it holds no addresses and no device numbers |
| An archive member's row | until the museum stops existing, or three years after that person last signed in — whichever comes first |
| Somebody's yes to a show: name, email, how many | 180 days, then swept automatically |
| A heart on a work | while it stands; eight days after it is taken away; gone when the gallery is no longer published |
| An Enquire press: gallery, work, WhatsApp or email, whether scanned | 400 days, then swept hourly |
| The random id of an Enquire press | eight days, then swept hourly |
| A sign-in to one gallery: address, name, a one-way scramble of its key | 30 days, or at once when you sign out |
| A note on a work: name, words, address | until you remove it, the gallery is no longer published, or 400 days after you last changed it |
| An invitation to add to a gallery's works, what was added, and any recording | 30 days after the link ends or is revoked, then deleted automatically, recording first. What the gallery approved is part of its gallery from then on |
| A row saying somebody left a list | kept, because deleting it is how the next import puts them back |
| A published museum's document and photographs | while it is published |
| Anything in your own browser | until you clear it |
| An account: address, profile, when you joined and were last in | while you use Galleris. Ask and we will delete it |
| Which version of the Terms you agreed to, and when | while your account exists, then deleted with it |
| A signed-in browser: a one-way scramble of its key | 180 days, then swept daily |
| A step or a problem in the studio | 400 days, then swept daily |
| A GAID waitlist address | until GAID opens and we have told you, or until you ask to come off it |
| A record that somebody looked an account up: who asked, when, whether it was found | 400 days, then swept daily |
| A record that we opened your account or viewing room, or wrote to you from it: who, when, and by email or WhatsApp | 400 days, then swept daily |
| A username somebody gave up | 30 days, kept for them, then let go |
| Feedback you sent | until we delete it by hand. Ask and we will delete it |
| Bank details for a payout: bank, name on the account, last four digits | while the archive takes payments through us |
| A payment record | kept, as a financial record |
| An enquiry you sent us | until we delete it by hand. Nothing clears our own inbox on a timer, and we are not going to claim otherwise. Ask and we will delete it |
How we share your personal information
We use other companies to run this. None of them is sold your data, and none of them may use it for their own purposes.
| Company | What they do with it | Where |
|---|---|---|
| Supabase | the database, the functions and the file storage | Ireland (eu-west-1) |
| Vercel | serves the website | global network |
| Resend | sends the sign-in codes, the "your museum is live" email, and the owner's alerts and weekly summary | United States |
| Paystack | takes archive payments on its own page, checks bank account names and pays galleries their share | Nigeria |
| Formspree | receives what you type into the contact form | United States |
| Google Analytics | counts pages on the marketing site and the studio | United States |
| Mixpanel | counts pages, clicks, and records screens on the marketing site only | United States |
| Google Fonts | serves the two typefaces the site is set in | global network |
Google Fonts is worth naming plainly. The site asks Google's servers for its typefaces, which means your browser tells Google your network address when a page loads. That is true of a great many websites and it is still true here. We list it rather than leave it out.
Your choices
Giving an address to open a door is not the same as agreeing to be written to. They are asked separately.
The tick box asking to hear from the museum is not ticked for you, it is asked once when you join and never again, and the answer is stored as its own yes-or-no beside your row. If you say no, you get a working archive and no email. If you say yes and later change your mind, one press of the link at the bottom of any of their emails takes you off — and signing in again afterwards cannot put you back on.
Under the Nigeria Data Protection Act 2023 and under the UK and EU GDPR, that separation is the difference between a list a museum may lawfully write to and one it may not.
Who is responsible for what, and other sites
This matters more than it sounds, because it decides who you complain to.
For a museum's archive list, the museum is responsible and we are not. The museum decides to have an archive, decides what is behind it, and holds the list of who signed in. We store it for them and hand it back to whoever holds that museum's key. In the words the law uses, the museum is the data controller and Hoo Socials Limited is the data processor. If you want off a museum's list, the museum is who that is between — and there is a one-press way to do it at the bottom of every email they send.
For everything else, we are responsible. The contact form, the marketing site, the studio, and the measurements described below.
Security
- The tables holding real addresses have their row-level security switched on with no policy at all, which is the strictest setting the database has. Nothing reaches them but one function holding a key that never leaves the server.
- A sign-in code is six digits from a cryptographic random source, is good for ten minutes, and stops working after five wrong guesses.
- A museum's list is only ever read one museum at a time, with that museum's own key. A wrong key and a museum that does not exist give the same answer, so the product cannot be used to find out which museums exist.
- Every page is served over HTTPS with a content security policy that names every outside service it may talk to.
- Nothing about sign-in is trusted from the browser: the code is checked on the server, and the count of wrong guesses is kept there too.
We do not claim this is unbreakable. Nobody honest does.
International data transfer
Our database sits in Ireland and several of the companies above are in the United States. That is a cross-border transfer under section 41 of the Nigeria Data Protection Act 2023, and under Chapter V of the GDPR.
The legal footing is:
- Ireland is inside the European Economic Area, which the Nigeria Data Protection Commission treats as offering adequate protection.
- The United States companies above are used under the standard contractual clauses in their own data processing terms, which is what section 41(1)(a) of the Act asks for.
If a transfer is not something you want, the only part of the product that requires one is signing in to an archive. Everything a visitor does in the guide itself works without it.
Children
Galleris is not aimed at children, and the visitor guide asks nobody for anything, which is deliberate — a class of eleven-year-olds can use a museum's guide from start to finish without typing a word. Signing in to an archive is meant for adults. If you believe a child has given us an address, write to the contact above and we will remove it.
Changes
When this changes we update the date at the top and post the new version here. If a change means we start collecting something new, we will say so on the screen where it happens rather than only here.
How to contact us
- Hoo Socials Limited, registered in Nigeria.
- RC number: 1974588
- Registered address: 10 Oyelowo Close, Surulere, Lagos
- WhatsApp: +234 905 937 1877
Governed by the laws of the Federal Republic of Nigeria, and disputes belong to the courts of Lagos State.
Your rights, and notice to European users
Under the Nigeria Data Protection Act 2023 (sections 34 to 37) and under the GDPR, you may ask to:
- See what is held about you.
- Correct it if it is wrong.
- Delete it.
- Take it with you, in a form another service can read.
- Stop it being used for marketing, at any time, with no reason given.
- Object to it being used at all, where we are relying on our own legitimate interest.
You may also complain to the Nigeria Data Protection Commission (ndpc.gov.ng), or, if you are in the UK or EU, to your own supervisory authority.
How to ask. Message Emeka Ugochukwu on WhatsApp at +234 905 937 1877. We answer within 30 days, which is what section 38(2) of the Act asks for.
Two honest limits.
If you are asking about a museum's archive list, we will pass the request to that museum, because it is theirs. We will do it and tell you we have.
If what you want deleted is only in your own browser, we cannot reach it — and neither can anybody else. Clearing your site data is the whole of it.