1. Who we are
Owambe Snaps is operated by Madstrox Tech Limited (RC 1806575), a company incorporated in Nigeria under the Companies and Allied Matters Act 2020, with its registered office at C5-506 Rhine Street, River Park Estate, Abuja. In this policy "we", "us" and "our" mean that company. "You" means whoever is reading it, a host, a guest, or someone who appears in a photograph on our service.
We are the data controller for the personal data described in this policy, except where section 3 says we act as a processor for a host. This policy is issued under the Nigeria Data Protection Act 2023 ("NDPA"), read with the Nigeria Data Protection Regulation 2019 and the directives of the Nigeria Data Protection Commission ("NDPC").
Questions, requests and complaints about personal data go to madstrox@gmail.com. That address reaches the person responsible for data protection at Owambe Snaps, and it is monitored.
2. Who this policy covers
Three different groups of people appear in this service, and the law treats them differently. Read the parts that apply to you.
| Who | What that means here |
|---|---|
| Hosts | You created an account, paid for an album and control an event gallery. Most of this policy is about you. |
| Guests | You scanned a QR code at an event and uploaded photos or videos. You have no account with us and we never asked you for one. Sections 4, 7, 12 and 13 matter most to you. |
| People in the photographs | You never used Owambe Snaps at all, someone at the party took your picture and uploaded it. You still have full rights under the NDPA, and section 7 explains how to use them. |
3. Our role: when we are a controller and when we are a processor
This distinction decides who you complain to, so we set it out plainly rather than burying it.
| Data | Our role | Who decides what happens to it |
|---|---|---|
| Host account, payments, security and admin records | Controller | We do. We decide why and how this data is processed. |
| Photographs and videos in an event gallery, and guest display names | Processor, acting for the host | The host does. They chose to collect these photographs, they decide who sees the gallery, and they download and keep the results. |
In practice this means that where a photograph is concerned, the host who created the album is the data controller and carries the controller's duties under the NDPA, including the duty to tell their guests what is being collected and why. We hold and serve the files on their instructions.
That does not leave you without a route to us. If you cannot reach the host, or the host will not act, write to madstrox@gmail.com and we will act on your request ourselves and pass it to the host. We will not use a technicality about roles to avoid dealing with a genuine request about a photograph of you.
4. What we collect
From hosts, when you create and run an album:
- Your email address, and your phone number if you choose to add one. The phone number is optional and is not used to log you in.
- Your password, stored only as a bcrypt hash. We never store, and cannot recover, the password itself.
- The event details you type: event name, event date, the headline on your printed card, and any cover photo or card photo you upload.
- Your payment records: the Paystack reference, the amount in kobo, the plan bought and any discount applied.
From guests, when you upload at an event:
- The photographs and videos you choose to upload, and the file size, type and duration of each.
- A display name, if you type one. You choose what to put there, it is limited to 40 characters, and it is shown publicly beside your uploads in the event feed. If you would rather not be named, put something that is not your name.
- A guest session identifier, stored in a cookie on your device so your uploads stay grouped together. It contains no name, email or phone number.
Technical data, from everyone:
- Your IP address, used briefly to rate-limit abusive traffic. It is held as a short-lived counter that expires by itself within minutes and is not attached to your account or your uploads.
- Ordinary server logs generated when your browser talks to ours.
One point about photographs specifically. When you upload an image, your phone compresses it in the browser before it leaves the device, and that re-encodes the file and discards its embedded EXIF metadata, including any GPS coordinates. Videos are a different matter: they are uploaded as they are, without re-encoding, so any metadata embedded in a video file, which on some phones includes the location where it was recorded, travels with it. If that concerns you, strip the metadata before uploading, or upload a photograph instead.
5. What we deliberately do not do
These are the things people reasonably assume a photo service does. We do none of them:
- No facial recognition. We do not detect, match or identify faces, and we do not generate or store face templates, embeddings or any other biometric identifier from your photographs.
- No artificial intelligence analysis of your photographs. We do not send your media to any AI or machine-learning service, and we do not use it to train any model, ours or anyone else's.
- No analytics or tracking. There is no Google Analytics, no advertising pixel, no session recorder and no third-party tracker anywhere on this service.
- No advertising. We do not sell, rent or share personal data with advertisers or data brokers, and we do not build profiles for marketing.
- No automated decision-making. Nothing about your account or your uploads is decided by an automated process producing legal or similarly significant effects.
If any of this changes, we will update this policy and tell hosts by email before the change takes effect.
6. Why we are allowed to process your data
Section 25 of the NDPA requires a lawful basis for each purpose. Ours are:
| What we do | Why | Lawful basis |
|---|---|---|
| Create and run your host account | You asked us to, and we cannot provide the service otherwise | Performance of a contract |
| Host an event gallery and serve its media | It is the service the host bought | Performance of a contract |
| Take payment and keep the record | To charge you, and to satisfy tax and accounting law | Contract, and legal obligation |
| Store a guest's photographs and display name | The guest chose to upload them after being told where they go | Consent |
| Rate-limit, block abuse and investigate fraud | To keep the service and other people's galleries safe | Legitimate interest |
| Send password reset and email verification messages | Account security | Contract, and legitimate interest |
| Keep financial records after an event ends | Nigerian tax and company law require it | Legal obligation |
Where we rely on consent, you may withdraw it at any time and we will stop. Withdrawing consent does not undo processing that was lawful before you withdrew it. Where we rely on legitimate interest, you may object and we will stop unless we can show compelling grounds that override your rights.
7. Photographs of other people
This is the hardest problem in a service like ours, and we would rather address it directly than pretend it does not exist. At a wedding or an owambe, guests photograph each other. The person in the photograph did not upload it, did not agree to anything, and may not know the gallery exists. Under Nigerian law they are still a data subject with full rights.
How we handle it:
- Every guest who uploads is told, before their first upload, not to upload photographs of people who would not want them shared. That notice is on the upload screen, not buried in this policy.
- The host who created the album is responsible, as controller, for the photographs collected at their event, and for telling their guests what is happening.
- An event gallery is not indexed by search engines and is not listed anywhere public. It is reachable only through the unguessable link in the QR code. Please read section 11, which explains the limits of that protection honestly.
Children. Nigerian ceremonies involve children, naming ceremonies most of all. Under section 31 of the NDPA a child is anyone under 18, and processing a child's personal data requires the consent of a parent or guardian, verified so far as is reasonable. Read with the Child's Rights Act 2003, which protects a child's privacy directly, the position is this: a host who collects photographs at an event where children are present is responsible for that consent. A parent or guardian may ask us to remove any photograph of their child using the address above, and we will remove it without asking for a reason.
9. Data leaving Nigeria
Some of our providers store or process data outside Nigeria. Cloudflare, Resend and DigitalOcean are United States companies operating global infrastructure, so your photographs and account data may be stored on servers outside the country. Paystack processes payments within Nigeria.
Sections 41 to 43 of the NDPA govern this. We will not tell you that any of these destinations benefits from an adequacy decision by the NDPC, because we cannot verify that any such decision has been made. We rely instead on the statutory ground that the transfer is necessary for the performance of the contract you entered into with us, you cannot have a photo gallery without somewhere to store the photos, and on contractual terms with each provider requiring them to protect the data and process it only on our instructions.
If you would rather your data did not leave Nigeria, we cannot currently offer that, and you should not use the service.
10. How long we keep things
So the honest statement of our retention position is this: media uploaded to a gallery is retained until it is deleted on request, or until we delete it under a future retention schedule that we will publish here, and give hosts notice of, before it takes effect. If you want your event's media erased on a particular date, ask us and we will erase it.
| Data | How long |
|---|---|
| Photographs and videos in a gallery | Until deleted on request, see the paragraph above |
| Host account details | While the account exists, and until you ask us to delete it |
| Payment and tax records | For the period Nigerian tax and company law requires accounting records to be kept, even after the account is closed |
| Password reset and email verification links | 1 hour, then they stop working |
| Guest session cookie | 1 year on your device, or until you clear it |
| Rate-limiting records of IP addresses | Minutes, they expire automatically |
11. How we protect your data, and where the limits are
What we do:
- Passwords are hashed with bcrypt at cost factor 12. They are never stored in a readable form.
- Traffic runs over HTTPS.
- Session cookies are HTTP-only and same-site restricted, so scripts on other sites cannot read or replay them. Sessions time out on idle and have a hard maximum lifetime.
- New accounts must verify their email address before they can log in.
- Uploads go straight from the guest's browser to storage using a signed link valid for five minutes. Media does not pass through our application servers.
- Galleries and admin pages are excluded from search engine indexing.
No system is perfectly secure and we do not claim ours is. What we do commit to is telling you the truth about how it works, so that you can decide what to upload.
12. Your rights
Under the NDPA you have the right to:
- Ask what personal data we hold about you, and get a copy of it.
- Have inaccurate data corrected.
- Have your data erased, including your account and any photograph of you.
- Ask us to restrict processing while a dispute is resolved.
- Receive your data in a portable, machine-readable format, or have it sent to another service.
- Object to processing we carry out on the basis of legitimate interest.
- Withdraw consent at any time, where we relied on consent.
- Complain to the Nigeria Data Protection Commission.
To use any of these, email madstrox@gmail.com. We will acknowledge you promptly and respond within 30 days. If a request is unusually complex and we need longer, we will tell you why before the 30 days is up. We do not charge for this. We may ask you to confirm your identity, but only so far as is necessary to be sure we are not disclosing someone else's data to the wrong person.
One point of candour about erasure. There is currently no button in the product that deletes your account, we are building it. Until it exists we handle deletion requests by hand, and the 30-day commitment above applies in full. The absence of the button does not reduce your right, and we will not ask you to wait for the feature.
If you are not satisfied with how we have handled a request, you may complain to the Nigeria Data Protection Commission, which regulates us. You are entitled to go to the NDPC directly, and you need neither our permission nor our agreement to do so.
14. Children
You must be at least 18 to open a host account. We do not knowingly collect personal data directly from children.
Photographs of children are a separate matter, dealt with in section 7, which you should read if you are a parent or guardian. In short: a host collecting photographs at an event where children are present is responsible for parental consent under section 31 of the NDPA, and any parent or guardian may have a photograph of their child removed on request, without giving a reason.
15. If something goes wrong
If personal data we hold is lost, exposed or accessed without authority, section 40 of the NDPA applies. We will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and where the breach is likely to result in a high risk to your rights and freedoms we will tell you directly, in plain language, describing what happened and what you should do about it.
We will not delay telling you in order to finish investigating. You will get what we know when we know it.
16. Changes to this policy
We update this policy when the service changes. The date at the top is the date of the current version. Where a change materially affects your rights or how we use your data, we will email hosts before it takes effect rather than change the page quietly.
17. Contact and complaints
For anything in this policy, a question, a data subject request, or a complaint, write to madstrox@gmail.com, or to Madstrox Tech Limited, C5-506 Rhine Street, River Park Estate, Abuja. For general support you can also reach us on WhatsApp at +234 904 257 8445.
If we have not resolved your complaint to your satisfaction, you may take it to the Nigeria Data Protection Commission, the regulator responsible for data protection in Nigeria. Complaints about the service as a consumer matter can go to the Federal Competition and Consumer Protection Commission.