Privacy & Cookie Policy

Account registration data

When you create an account, we collect your legal name (first name, middle name if provided, and last name), your chosen display name or artist name (if different from your legal name), your email address, your country of residence, and your chosen password (stored in hashed form — we never store your password in plain text). Your legal name is used solely for identity verification, commission agreements, and legal documentation. It is never displayed publicly on the Platform. Your display name or artist name is shown on your public profile and artwork listings.

Artist profile data

If you register as an artist, we additionally collect your biography, the country where you are based, and any optional YouTube or video link you choose to provide. This information is displayed publicly on your artist profile.

Artwork data

When you upload an artwork, we collect the artwork title, medium, dimensions, year of creation, description, uploaded images, pricing type and price (or formula parameters), and the sequence number assigned at upload. This information is displayed publicly on the artwork's listing page.

Purchase and transaction data

When you make a purchase, we collect your billing name and address, shipping address, payment confirmation data (processed by our payment provider, Stripe — we do not store full card details), the artwork purchased, the price paid, the date and time of purchase, and the applicable commission tier at the time of sale.

Offer and negotiation data

When you participate in the Make An Offer system, we collect the offer amounts submitted, counter-offer amounts, any messages exchanged during the negotiation, timestamps, and the outcome (accepted, declined, countered, or expired). Offer details are private between the parties involved and are not shown publicly.

In-platform messaging data

When you use the Platform's messaging system to communicate with other users, we collect the content of messages sent and received, timestamps, and the identities of the sender and recipient. Messages are private between the parties and are not shown publicly. All communications must take place within the Platform — Artoficial may review messages where there is reason to believe a violation of the Terms and Conditions has occurred.

Follower and following data

We record which artist accounts you follow and which users follow you. Follower counts are public. The specific identities of individual followers are not publicly displayed, though they are stored by Artoficial.

Technical and usage data

When you use the Platform, we automatically collect certain technical data including your IP address, browser type and version, operating system, referring URL, pages visited, and time spent on the Platform. This data is used to maintain and improve the Platform and is not used to identify you individually unless required for fraud prevention or legal compliance.

Customer support data

If you contact Artoficial for support, we collect the content of your communications and any information you provide in the course of resolving your query.

Performance of a contract (Article 6(1)(b) GDPR)

The majority of data processing is necessary to perform the contract between you and Artoficial — including account registration, artwork listings, purchases, delivery, commission agreements, and resale processing. Without this data it is not possible to use the Platform's core functions.

Legal obligation (Article 6(1)(c) GDPR)

Artoficial is required by law to retain certain data, including accounting records, invoices, and transaction histories. We retain this data for the periods required by applicable law regardless of any request to delete it.

Consent (Article 6(1)(a) GDPR)

Where we process data on the basis of your consent — for example, sending you optional email newsletters or marketing updates about the project — we will ask for your consent separately and clearly. You have the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before withdrawal.

Legitimate interests (Article 6(1)(f) GDPR)

Artoficial processes certain data on the basis of legitimate interests, always balancing those interests against your rights and freedoms. Legitimate interests include:

• Maintaining the integrity of the project archive, which requires retaining records of Artwork ownership for as long as each Artwork is in circulation, in order to honour resale royalty obligations to original artists
• Fraud detection and prevention
• Improving and maintaining the Platform
• Enforcing the Terms and Conditions, including investigating suspected off-platform transactions
• Communicating with users about their account activity, purchases, and offers

Account and profile data

Retained for the duration of your account and for 3 years following account closure or the expiry of any active contracts or agreements.

Transaction and purchase data

Retained for as long as the commission agreement remains in force — which, as set out in the Terms and Conditions, is for the lifetime of the Artwork — plus any additional period required by applicable law. This is necessary to maintain the integrity of the project archive and to honour the resale royalty obligations to original artists.

Accounting and financial records

Retained for 7 years in accordance with Estonian accounting law.

Offer and messaging data

Retained for 3 years from the date of the relevant offer or message, unless the data forms part of a concluded transaction, in which case it is retained as part of the transaction record.

Technical and usage data

Retained for up to 12 months unless required for ongoing fraud investigations.

Marketing and newsletter data

Retained until you withdraw consent or unsubscribe.

Payment processing

Stripe, Inc. processes payment card data on our behalf. Stripe operates under its own privacy policy and is certified under applicable payment security standards (PCI DSS). Artoficial does not receive or store full card details.

Hosting and infrastructure

Vercel and Supabase provide the technical infrastructure on which the Platform operates. They process data as data processors on Artoficial's behalf under appropriate data processing agreements.

Email delivery

Resend (or equivalent email service provider) is used to send transactional emails such as order confirmations, offer notifications, and account verification emails. These providers process email addresses and message content solely for delivery purposes.

Shipping and logistics

DHL or equivalent courier services receive the buyer's name and delivery address for the purpose of delivering purchased Artworks.

Legal and regulatory authorities

Artoficial may be required by law to disclose personal data to public authorities, courts, or regulators upon a legitimate and lawful request.

Right of access

You have the right to receive a copy of the personal data Artoficial holds about you and information about how it is processed.

Right to rectification

You have the right to request correction of inaccurate or incomplete personal data. You can update most profile information directly through your account settings.

Right to erasure

You have the right to request deletion of your personal data where there is no longer a legal basis or legitimate need to process it. Please note that this right is not absolute — we cannot delete data we are legally required to retain, or data that is necessary to fulfil active contractual obligations (including the commission agreement).

Right to restriction of processing

You have the right to request that Artoficial restricts processing of your data in certain circumstances, for example while a dispute about accuracy is being resolved.

Right to data portability

You have the right to receive your personal data in a structured, machine-readable format and to transmit it to another controller, where technically feasible and where processing is based on consent or contract.

Right to object

You have the right to object to processing based on legitimate interests. Artoficial will cease processing unless there are compelling legitimate grounds that override your interests.

Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact Artoficial at info@artoficial.pro. We will respond within one month of receiving your request.

If you believe Artoficial has infringed your privacy rights, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), available at www.aki.ee. You may also contact the supervisory authority in your country of residence within the EU.

8.1 What are cookies?

Cookies are small text files stored on your device by your browser when you visit the Platform. They allow the Platform to recognise your device and remember information about your visit — such as your login status and items in progress.

8.2 How to manage cookies

You can control and delete cookies through your browser settings at any time. You can configure your browser to refuse new cookies, to notify you when a cookie is set, or to delete all stored cookies. You can also activate your browser's "Do Not Track" function, which the Platform respects. Disabling certain cookies may affect the functionality of the Platform — in particular, disabling session cookies will prevent you from staying logged in or completing a purchase.

8.3 Cookies we use

8.4 We do not use cookies for advertising

Artoficial does not use advertising cookies, tracking pixels, or behavioural advertising of any kind. Your data is not used to serve you targeted advertisements on the Platform or on third-party sites.