Privacy Policy

1. Who we are

Art+Ist ("we", "us", "our") operates the art+ist online marketplace (the "Platform"), which enables artists to showcase and sell artwork to collectors. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What data we collect

We collect the following personal data:

• Account information: your name, email address, and password (encrypted)
• Profile information: display name, bio, profile photo, location, and social media links (for artists)
• Address information: shipping addresses you save for faster checkout
• Communication data: messages you send to or receive from artists or collectors through the Platform
• Transaction data: records of purchases, including artwork details and amounts (card details are not stored — see below)
• Usage data: how you use the Platform, including pages visited and actions taken
• Social media data: when an artist connects their Instagram Business account, we receive an access token and basic account information (username and profile picture) to enable artwork sharing. We do not receive or store your Instagram password.

3. Payment data

We do not store your card details. All payment information is encrypted and processed directly by Stripe, our PCI-DSS certified payment provider. We only store records of transactions (amounts, artwork details, and order status). For more information, see Stripe's Privacy Policy.

4. How we use your data

We use your personal data to:

• Provide and operate the Platform, including account management and artwork listings
• Process transactions and facilitate communication between artists and collectors
• Send you notifications about inquiries, messages, and order updates
• Respond to your enquiries and provide customer support
• Maintain the security and integrity of the Platform
• Comply with legal obligations

5. Legal basis for processing

Under UK GDPR, our legal bases for processing your personal data are:

• Contract: processing necessary to provide the Platform services you've requested
• Legal obligation: compliance with applicable laws and regulations
• Legitimate interests: maintaining platform security, preventing fraud, and improving our services
• Consent: where you've given consent, which you can withdraw at any time

6. Who we share your data with

We share your personal data with:

• Stripe: for processing payments (card details only — see section 3)
• Artists/collectors: relevant information needed to complete transactions and communications (e.g. shipping address for an order)
• Service providers: third parties that help us operate the Platform (e.g. hosting, email delivery)
• Legal authorities: where required by law or to protect our rights

We never sell your personal data.

7. Instagram and Facebook integration

Artists may connect their Instagram Business or Creator account to the Platform to share their artwork directly to their Instagram feed. This integration is powered by the Meta (Facebook) Platform and the Instagram Graph API.

• What we receive: When you connect your Instagram account, Meta provides us with an access token and your Instagram Business account identifier, username, and profile picture. We do not receive your Instagram or Facebook password.
• How we use it: We use the access token solely to publish artwork images and captions to your Instagram feed when you choose to share, and to confirm your account is connected. We do not post without your explicit action.
• What we do not do: We do not read your private messages, access your followers, post advertising, or share your Instagram data with third parties.
• Data retention: The access token is stored only for as long as your Instagram account remains connected. Disconnecting your account removes the token from our systems.
• Your Meta data: Your use of Instagram is also governed by Meta's own policies, available at Meta's Privacy Policy.

8. How long we keep your data

We keep your personal data for as long as your account is active, and for a reasonable period thereafter where required for legal, accounting, or dispute resolution purposes. Transaction records may be retained for up to 7 years for tax and accounting compliance.

9. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Request erasure of your personal data ("right to be forgotten")
• Restrict or object to our processing of your data
• Data portability — receive your data in a structured format
• Withdraw consent at any time (where processing is based on consent)
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, please contact us using the details in section 11.

10. Cookies

The Platform uses essential cookies to function properly (e.g. maintaining your login session). We may also use analytics cookies to understand how the Platform is used. You can control cookies through your browser settings. We do not use cookies for targeted advertising.

11. Contact us

If you have any questions about this Privacy Policy or your personal data, please contact us.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on the Platform. Continued use of the Platform after changes constitutes acceptance of the updated policy.