Terms of Service

Version 1 · last updated 2026-05-22. By creating an account, ticking the acceptance box, or using MugShotter you agree to these Terms of Service, which incorporate the Data Sharing Agreement (section 16) and the Capture-Point Notice (section 17). Accepting these Terms constitutes signing the Data Sharing Agreement on behalf of your organisation.

1. Who provides the service

MugShotter (the "Platform", "we", "us") provides software infrastructure: a cross-firm, post-detention incident register and face-matching index. The Platform is hosted by MugShotter, with application data on secure Hetzner cloud infrastructure located in Germany.

In data-protection terms the Platform acts as an Operator under POPIA, a Processor under the EU-GDPR and UK-GDPR, and a Service Provider under the California CCPA / CPRA - and the corresponding processor-equivalent role under any other applicable data-protection framework. We process personal information on behalf of the organisations that use the service. Each member organisation - a licensed or regulated private-security firm or accredited neighbourhood-watch organisation - is the Responsible Party (POPIA), Controller (GDPR / UK-GDPR), or Business (CCPA / CPRA) for the data it contributes. You decide what to collect and you are legally responsible for the lawfulness, legitimacy and accuracy of the data you upload under the law of your own jurisdiction.

2. Eligibility & verification

The service is provided to licensed or regulated private-security firms and their authorised employees, and to accredited neighbourhood-watch organisations; it is designed to support - not to substitute for - the law-enforcement agencies that operate in your jurisdiction. Accounts are subject to verification of your firm's licensing (PSIRA registration in South Africa, the licensing authority in your country elsewhere) or equivalent accreditation evidence. MugShotter is not a consumer or citizen application and is not open to the general public.

3. Your data-protection responsibilities (read carefully)

• Prior authorisation / regulator engagement: processing information about a data subject's alleged criminal behaviour or unlawful/objectionable conduct on behalf of third parties may require prior authorisation, notification, lawful-basis registration, or a Data Protection Impact Assessment under your jurisdiction's data-protection framework - for example, POPIA s.57 prior authorisation by the South-African Information Regulator, GDPR Article 10 conditions on criminal-conviction data, the UK ICO's consultation guidance on criminal-offence data processing, or a CCPA/CPRA-compliant service-provider arrangement. By using MugShotter to record or look up incident profiles you confirm that your organisation has assessed its own data-protection position and holds any prior authorisation or registration its processing requires under your local law.
• Post-detention capture only: submit a face record only after the lawful detention of a person on a site where you have arrest authority under the law of the jurisdiction in which you operate (in South Africa: the Trespass Act 6 of 1959 + common-law arrest powers; in other jurisdictions: the equivalent statutory or common-law authority). No scan-before-detention, no mass surveillance, and no capture of bystanders, employees, customers or members of the public.
• Capture-point notice: display the notice (at /popia/notice, adapted as necessary for your jurisdiction's notice requirements) at every site where you operate the bot, and brief your officers on these Terms and that notice before granting them access.
• Person-of-interest, not "suspect": records describe persons of interest linked to a property-crime incident; they are not findings of guilt.

4. Per-upload certification & mandatory case link

For every incident you contribute you certify that the individual was lawfully detained and that the record is uploaded strictly as an operational identification aid for the prevention or investigation of property crime - not as an arbitrary, malicious or retaliatory accusation. Every original entry must carry a verifiable law-enforcement case number (in South Africa a SAPS case reference; elsewhere the equivalent police/prosecution case number) or an official internal incident reference to anchor it to a verifiable proceeding and maintain a clean chain of custody. False or malicious submissions are a serious breach of these Terms and may expose you and your organisation to defamation and data-protection liability.

5. Nature of the service - important disclaimer

MugShotter is an operational identification aid for security professionals. It is not a court record, not evidence for legal proceedings, and not a public "name-and-shame" forum. A match is an investigative lead only and must be independently verified. Nothing on the Platform constitutes a finding of guilt or a criminal record.

Data minimisation. The Platform does not collect names, identity numbers, or home addresses. It processes facial biometric data and incident event records - which remain personal information (and, for biometrics, special / sensitive personal information under POPIA s.26, GDPR / UK-GDPR Article 9, and equivalents) handled per our Privacy Policy.

6. Acceptable use

• Use the service only for the lawful investigation and prevention of property crime within your mandate.
• Keep your account credentials and bot access confidential; they are for your authorised employees only.
• Treat all cross-firm information as confidential and use it solely for the purpose for which it was shared.

7. Prohibited use

• Mass surveillance or scan-before-detention deployment.
• Use for stalking, harassment, debt collection, or any non-criminal-investigation purpose.
• Sharing account credentials or bot access with non-employees.
• Circumventing the cross-firm field-projection rules (we project only summary data cross-firm; do not screenshot and re-share internal notes).
• Reverse-engineering, decompiling, or attacking the service.
• Use by political parties, intelligence services, or for any non-criminal-investigation purpose.

8. Audit & accountability

Every view, search and upload creates an append-only, tamper-evident audit record identifying the user, the action and the time. We use these logs to investigate misuse. Abuse of access is a breach of these Terms and may be reported to your firm's licensing authority (PSIRA in South Africa; the equivalent regulator in your country) and to the relevant data-protection authority.

9. Cross-border processing

Application data is transmitted to and hosted on cloud infrastructure located in Germany. Germany is subject to the EU GDPR; we rely on the resulting level of data protection for the cross-border transfer (POPIA s.72 for South-African members; EU/UK-GDPR Chapter V mechanisms for European members; and the data-export rules of your jurisdiction for others). Full detail is in our Privacy Policy.

10. Subscription & payments

Pricing is in South African Rand (ZAR), monthly, billed in advance via our payment processor (PayPal). You may cancel at any time; cancellation takes effect at the end of the current billing period and we do not refund partial months. If a Personal plan exceeds its monthly lookup quota, further lookups pause until the next cycle or upgrade.

11. Suspension & termination

We may suspend or terminate any account for breach of these Terms, breach of the Data Sharing Agreement, abusive use, or non-payment after a 7-day grace period. On termination your data is purged on the next retention run; you may request an earlier purge in writing.

12. Liability

To the extent permitted by applicable law, our liability for any claim arising from your use of the service is limited to the fees you paid us in the 12 months preceding the claim. We are not liable for indirect, consequential, or punitive damages, nor for your unlawful or inaccurate use of the service.

13. Indemnity

You indemnify MugShotter and its operators against claims arising from your unlawful detention of any person whose photograph or incident you contribute, your failure to display the capture-point notice, malicious or inaccurate submissions, or your breach of these Terms or of your data-protection obligations in your own jurisdiction.

14. Governing law

These Terms are governed by South African law. The courts of the Western Cape have non-exclusive jurisdiction; this clause does not deprive a member organisation of any non-waivable consumer-protection or data-protection right available to it in its own jurisdiction.

15. Changes

We may update these Terms. Material changes increment the version number; you will be required to accept the new version before continuing to use the service. The current version is shown at the top of this page.

16. Data Sharing Agreement

This section is the Data Sharing Agreement (DSA) between the Platform and your organisation (the "Member"). Accepting these Terms constitutes signing it on behalf of your organisation.

• Roles. The Platform processes biometric identifiers (face embeddings) and incident records on the Member's behalf; the Member is the Responsible Party / Controller / Business for the data it contributes.
• Member obligations. Display the Capture-Point Notice (section 17) at every site where the bot is used; submit a face record only after lawful detention on that site; never submit photographs of bystanders, employees, or members of the public who have not been detained; brief and train your officers on this Agreement.
• Sharing model. On a query, only incident summaries (date, charges, contributing organisation) are returned cross-firm. Internal notes, site addresses, and items-recovered details are not shared cross-firm without an additional written request.
• Retention. Per our Privacy Policy and your firm's configured retention; embeddings and photographs are deleted and notes redacted at the retention horizon.
• Subject requests. Direct all subject access requests to the Information Officer (section 17) or via /popia/sar.
• Termination. Either party may terminate on 30 days' notice; on termination your contributed embeddings are purged on the next retention run.

17. Capture-Point Notice (display at every site)

Members must display this notice at every site where MugShotter is used. In South Africa this is the POPIA s.18 notice to data subjects; outside South Africa, members must adapt the notice to comply with their own jurisdiction's transparency requirements (e.g. GDPR / UK-GDPR Articles 13-14, CCPA / CPRA notice-at-collection). Open the printable version →