Privacy Policy

This Privacy Policy explains how Gather Shot ("Gather Shot," "we," "us," or "our") collects, uses, and shares personal information when you access or use our websites, apps, and related services (the "Service"). This Policy applies wherever we act as a controller of your personal information.

Gather Shot LLC acts as an independent controller for account administration, billing, security, and our own analytics and marketing. For business event data processed on a customer's instructions, the business is the controller (or an authorized processor) and we are its processor (or subprocessor) under our Data Processing Addendum. That DPA applies when the business accepts our Terms. Event-data rights requests should normally go to the business host; contact us if you need help identifying it. We forward relevant requests and assist the customer rather than independently deciding how its event data is used.

1) Information We Collect

a) Information you provide to us

• Account details (e.g., name, email, password).
• Event details (e.g., event name, date/time, location, host notes, customizations).
• Collaborators/guests you invite (e.g., names/emails and roles/permissions).
• Content you upload (photos, videos, captions, and associated metadata), guest names and identifiers, event custom-field responses, scavenger-hunt submissions and progress, moderation status, and generated download archives.
• Business Account information, including organization details, team invitations, membership and permissions, and shared upload allowance usage and billing history.
• Support and communications (messages you send us, survey responses).

b) Information collected automatically

• Usage and device data (IP address, approximate location derived from IP, browser and device type, app version, pages viewed, timestamps, referring/exit pages).
• Cookies and similar technologies used to keep you signed in, remember your preferences, and help us secure the Service. See Cookies & Tracking below.

c) Payment information

• When you make a purchase, payment is processed by our payment processor. We do not collect or store full payment card numbers or security codes. We receive limited information (e.g., billing contact, transaction status, amount, and internal identifiers) to record your purchase, prevent fraud, and deliver receipts.

d) Location lookup

• If you use location autocomplete/lookup features while creating an event, the text you enter may be sent to a location services provider to return suggestions. We log minimal diagnostic information for security and troubleshooting.

e) Public galleries and links

• If an event's gallery is configured as public, accepted media may be accessible to anyone with the link. Direct file links may persist in caches or third‑party systems for a period even after deletion.

In organizational workspaces, authorized owners, managers, organizers, and moderators can access event data according to their permissions. An event invitation does not grant access to every workspace event. Hosts determine collection settings and gallery visibility. Pending moderation restricts gallery publication, not authorized administrative access; eligible Enterprise archives include pending submissions. Copies downloaded by a host or participant are outside Gather Shot's storage and must be addressed with that recipient.

2) How We Use Information

We use personal information to:

• Provide and operate the Service (create accounts, host events, uploads/downloads, moderation, customer support).
• Process payments and manage orders, subscriptions, add‑ons, and invoices.
• Communicate with you about your account and the Service, including:
  • Transactional messages (e.g., password resets, invitations, purchase confirmations, important service notices).
  • Marketing & promotional messages, including newsletters, product updates, and cross‑promotions with our affiliates and partners (see Sharing below). You can opt out at any time via the unsubscribe link in our emails or by contacting us.
• Personalize features and content, and measure engagement (e.g., to understand what features are useful).
• Maintain safety and integrity (detect/prevent fraud, abuse, and security incidents; enforce our Terms).
• Comply with law and exercise or defend legal claims.

Legal bases (EEA/UK only): We process personal information as necessary to perform our contract with you; based on our legitimate interests (e.g., to secure and improve the Service, to send marketing where allowed); with your consent (e.g., mailing lists where consent is required); and to comply with legal obligations.

We do not use customer photos, videos, custom-field responses, or archives for our independent advertising. Business hosts are responsible for their own lawful basis, notices, permissions, and any separate promotional use of event content.

3) Cookies & Tracking

We use the following categories of cookies and similar technologies:

• Essential: required for core functionality and security (e.g., keeping you signed in, rate limiting, CSRF protection).
• Functional: remember preferences and improve experience.
• Performance/Analytics: help us understand usage to improve the Service.
• Marketing/Email analytics: measure campaigns and email engagement and support advertising attribution and audiences. These activities can involve disclosures to advertising recipients, not only processing on our instructions.

Technologies used: Google Analytics 4 measures traffic and conversions. Meta Pixel and server-side Conversions API send advertising and conversion events to Meta, potentially including device information, event identifiers, and hashed contact identifiers. PostHog may be enabled for product analytics. The marketing website also uses Fathom for traffic measurement. Exact collection depends on the page, configuration, and interaction; hashing identifiers does not make them anonymous.

Your choices and current limitations: You can manage cookies through your browser, use provider opt-out tools, unsubscribe from marketing emails, and contact us about advertising opt-outs or consent withdrawal. Browser cookie blocking alone does not stop server-side conversion disclosures. We have not confirmed automatic site-wide consent gating or Global Privacy Control handling, and this Policy does not promise those controls are implemented. Applicable consent and opt-out obligations still apply; publishing this Policy does not implement the necessary technical controls.

4) How We Share Information

We disclose personal information in the following circumstances:

• Service providers. Providers help deliver hosting, storage, email, payment, analytics, and security. Providers processing business event data on our behalf are subject to the DPA's subprocessor requirements. Some providers, including payment providers for their compliance and fraud functions, also act independently; not every recipient is solely our processor. See section 14.
• Advertising recipients. Google and Meta receive measurement and advertising information through the technologies described above. Their processing may include their own purposes under their terms and applicable law. Such disclosures are distinct from business event processing under the DPA and may constitute sale or sharing under applicable privacy law even without monetary payment.
• Public content. Content in public galleries is viewable by anyone with the link and may be shared by others. Please consider this when uploading.
• Business transfers. In connection with a merger, acquisition, financing, or sale of all or part of our business, information may be transferred to the relevant entity subject to this Policy.
• Legal and safety. We may disclose information to comply with law, legal process, or lawful requests; to enforce our terms; or to protect the rights, property, or safety of Gather Shot, our users, or the public.

Connected AI assistants

If you connect an assistant or other application through Gather Shot's MCP integration, you authorize it to access the account you select within your existing permissions. Current tools can return account and event names and identifiers, event configuration (including host-entered text and hunt prompts), upload availability, sharing and management links, and aggregate activity counts. They do not return guest email lists or media files. With write permission, the connected application can create eligible events and change event settings or hunt prompts; removing prompts can delete their responses.

We store the authorization grant and hashed token credentials to manage access. Access tokens expire after one hour; rotating refresh tokens expire after 30 days without renewal. Expiry limits access and is not a promise that security records are deleted on that date.

Disconnect at Connected applications to stop future access through that connection. Disconnecting does not erase information already received by your assistant provider; its own terms, privacy policy and retention controls govern those copies. Tool usage may be recorded in our operational and product analytics as described in this Policy.

California (CPRA): Advertising disclosures may constitute sale or sharing, including cross-context behavioral advertising. Where applicable, you have the right to opt out. Contact [email protected] to submit a request. This contact route is not a representation that automatic browser-signal handling or global advertising suppression is implemented.

5) Data Retention

We retain personal information for as long as needed to operate the Service, comply with legal obligations, resolve disputes, and protect our rights. For example:

• Account and event data are kept while your account is active and for a reasonable period thereafter.
• Content follows applicable event retention terms. Enterprise events are live for one year from the event date, then archived while subscribed, without a separate storage cap. Archives include non-deleted, unlocked uploads, including pending moderation. Locked originals can be retained and later unlocked, with archives regenerated. Archive downloads require an active subscription.
• Enterprise recovery lasts one year from the later of event retention expiration or paid subscription expiration. Lapsed Accounts have only limited viewing, moderation, deletion, and eligible downloads, not configuration or uploads. Expiry leads to staged deletion, including originals and archives. Explicit erasure requests are independent of recovery; business customers can instruct earlier deletion under the DPA, subject to legal holds.
• Payment and transaction records are kept as required for tax/audit and fraud prevention.
• Logs and security records are kept for a limited period for safety and troubleshooting.

When no longer needed, we take steps to delete or anonymize information.

6) Your Rights & Choices

Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or to object to certain processing (including marketing). You can:

• Access or update certain information in your account settings.
• Unsubscribe from marketing via the link in our emails.
• Contact us to exercise rights or appeal a decision. We will respond as required by law.

Residents of California may also request information about our practices and exercise the right to opt out of sale/sharing, limit the use of sensitive personal information (if applicable), and non‑discrimination for exercising rights.

7) Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and protections against unauthorized access and abuse. No system is perfectly secure, and we cannot guarantee absolute security.

8) International Transfers

We are based in the United States, and providers may process information in the U.S. and other countries. Restricted transfers must rely on a valid mechanism where required, such as an applicable adequacy decision or properly executed Standard Contractual Clauses with any required UK mechanism and supplementary safeguards. This Policy does not itself execute transfer clauses or confirm a particular storage region or provider's eligibility. Contact us for information about the mechanism applicable to your processing before arranging a restricted transfer.

9) Children's Privacy

The Service is not directed to children under 16 (or the age required in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided personal information to us, please contact us so we can take appropriate action.

10) Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you by posting the updated Policy and, where appropriate, by email or an in‑product notice. The revised Policy will be effective when posted unless otherwise stated.

11) Contact Us

Email: [email protected]
Address: 502 W 7th ST STE 100 Erie, PA, 16502, USA
Website: gathershot.com

12) California (CCPA/CPRA)

• Categories collected: identifiers; commercial information; internet/network activity; geolocation (coarse); user‑generated content; inferences (e.g., preferences) where permitted.
• Sources: directly from you or your event host; automatically from your device/browser; service providers and advertising measurement recipients.
• Purposes: as described in How We Use Information.
• Disclosures: to authorized event participants, service providers, advertising recipients (subject to applicable opt-out rights), legal authorities as required, and business transfers.
• Retention: as described in Data Retention.
• Your rights: right to know/access, delete, correct, portability, opt out of sale/sharing, limit sensitive PI, non‑discrimination.

13) EEA/UK (GDPR)

• Controller: Gather Shot LLC.
• Privacy contact: [email protected]. This is not a representation that a statutory DPO has been appointed.
• Legal bases: contract, legitimate interests, consent (where required), legal obligations.
• Your rights: access, rectification, erasure, restriction, portability, objection (including to direct marketing), and to withdraw consent at any time without affecting prior processing.
• Complaints: You may lodge a complaint with your local supervisory authority.

14) Service Providers & Subprocessors

The following service providers and subprocessors may process personal information on our behalf to help us deliver the Service. This list reflects our current technical implementation and is provided for transparency, though it may not be exhaustive. We may add, remove, or replace providers from time to time as we operate and improve the Service.

Payment Processing

• Stripe, Inc.: Payment processing, fraud prevention, billing records, and PCI-compliant card data handling. Stripe processes customer and billing information, payment methods (including card data collected directly via Stripe.js), transaction records, and device/telemetry data for fraud prevention.

Email Delivery

• Postmark: Transactional email delivery, including password resets, event invitations, magic login links, and payment receipts. Postmark processes recipient email addresses, message content, and delivery/engagement metrics.

Cloud Storage & Media Processing

• Cloudflare R2: Production storage for new original media and Enterprise archives, processing stored files, metadata, and storage-access information.
• DigitalOcean LLC: Legacy object storage may retain media or download archives, with file metadata and access information. Storage is not described here as a Basic/Pro plan split, and no specific region is asserted.
• Compute & Database Hosting: We use third-party infrastructure providers for application hosting and managed databases. These providers have access to data stored on their systems and are contractually required to maintain confidentiality. Specific providers depend on deployment configuration.

Location & Mapping Services

• Google LLC (Places API): Location autocomplete during event creation. When you use location lookup features, your typed queries are sent server-side to Google's Places API (v1). We log queries and truncated API responses for security and troubleshooting.

Analytics and Advertising Recipients

• Google (GA4) and Meta (Pixel and Conversions API): Traffic, conversion, and advertising measurement as described in section 3. They are not listed here as subprocessors authorized to use business event content for advertising.
• PostHog (when enabled) and Fathom (marketing website): Product and website usage measurement respectively.

Business customers may request the current business-data subprocessor list, including legal entities, processing functions, and locations, at [email protected]. DPA change-notice and objection rights apply to business-data subprocessors; this general recipient overview is not a substitute for that list or valid transfer documentation.