Privacy Policy

1. Who is responsible for your data

[Company Legal Name], registered in [Jurisdiction] at [Registered Address], is the data controller for personal data processed to run the Artable platform. You can reach us about privacy at [Privacy Contact]. [Data Protection Officer / EU–UK Representative details, if required].

An important distinction: when a creator runs their own space on Artable and builds a relationship with their members, that creator is an independent controller of their own audience data, and Artable acts as a processor for them in that respect. What a creator does with their member list — for example emailing their own members — is governed by that creator's own practices, not only by this policy.

2. What we collect

Account data

Your email address, authentication credentials (held by our authentication provider — we never store your password ourselves), display name and avatar image if you set one, and the date your account was created.

Relationship and entitlement data

Which spaces you have joined, which plan you are on, when a membership started, renewed, was cancelled or expired, and what content you are consequently entitled to see. Creators can see the members of their own space and the state of those memberships.

Payment data

Records of purchases, subscriptions, refunds and payouts, and identifiers issued by our payment provider that link a record to their systems. We never receive or store your card number, CVC or bank details — those go directly to Stripe, who process the payment. Creators who take payments complete Stripe's own identity and payout verification directly with Stripe.

Content you create

Anything you upload or write: artwork and other media, titles, descriptions, comments, reactions, saved items, and the profile information for a space you run.

Communication preferences

Your notification and email settings, and whether you have unsubscribed from a particular kind of message.

Referral data

If you arrive through a referral or affiliate link, the code you arrived with, so the referral can be credited when you join. This is stored in a cookie on your browser — see our Cookie Policy.

Technical and diagnostic data

Server and infrastructure logs generated when you use the Service, and error reports (which can include the URL, browser and a technical stack trace) sent to our error monitoring provider so we can diagnose faults. We also count requests to sensitive endpoints to protect against abuse and brute-force attempts.

We do not currently run third-party product-analytics, advertising or tracking tools on Artable. If that changes, this policy and our Cookie Policy will be updated first, and consent will be requested where the law requires it.

3. Why we use it, and on what legal basis

• To provide the Service — creating your account, showing you the content you are entitled to, running memberships and purchases, delivering media. Basis: performance of a contract with you.
• To take payments and pay creators — processing charges, fees, refunds, disputes and payouts. Basis: performance of a contract, and compliance with legal obligations for financial records.
• To send service messages — verification and password-reset emails, receipts, billing failures, and notifications you have opted into. Basis: performance of a contract, and consent for optional marketing-style messages.
• To keep the Service safe — rate limiting, abuse and fraud prevention, moderation of reported content, protecting paid content from circumvention. Basis: legitimate interests in operating a secure platform, and legal obligations.
• To fix and improve the Service — diagnosing errors, investigating faults, understanding aggregate usage. Basis: legitimate interests.
• To comply with the law — tax, accounting, sanctions screening performed by our payment provider, and responding to lawful requests. Basis: legal obligation.

We do not sell your personal data, and we do not use your content to train machine learning models.

4. Who we share it with

We share personal data with service providers who process it on our behalf, under contract, only for the purposes we set. Our current providers are:

• Supabase — database, authentication and file storage.
• Stripe — payment processing, subscription billing, creator identity verification and payouts.
• Vercel — application hosting and content delivery.
• Resend — transactional and notification email delivery.
• Inngest — background job and scheduled task execution.
• Sentry — error and performance monitoring.
• Upstash — request-rate counters used for abuse protection.

We also share data with a creator when you join their space, as described in section 1; with professional advisers where necessary; with authorities where legally required; and with an acquirer if the business is ever sold or reorganised, in which case we will tell you.

[This list should be kept current and published as a subprocessor list at [Subprocessor List URL] as part of legal review.]

5. International transfers

Some of our providers operate outside [Jurisdiction], including in the United States. Where personal data is transferred internationally we rely on an appropriate safeguard — typically an adequacy decision or Standard Contractual Clauses — together with the provider's own technical and organisational measures. [Specific transfer mechanism and data-region configuration to be confirmed at legal review.]

6. How long we keep it

• Account and profile data: while your account is open.
• Content you publish: until you delete it, or your account is closed and the content is removed with it.
• Membership and entitlement records: for as long as they are needed to establish what access was granted, and to resolve any billing question afterwards.
• Payment, refund and payout records: retained for the period required by tax and accounting law in [Jurisdiction] — typically [Retention Period] — even after an account is closed.
• Diagnostic logs and error reports: a short rolling window, [Log Retention Period].
• Moderation and abuse records: as long as needed to enforce our terms and prevent repeat abuse.

7. Your rights

If you are in the UK or the EEA, data-protection law gives you the right to: access a copy of your personal data; have inaccurate data corrected; have data erased in certain circumstances; restrict or object to certain processing, including a right to object to processing based on legitimate interests; receive data you gave us in a portable format; and withdraw consent at any time where we relied on it. Similar rights exist under other privacy laws, and we apply these rights to everyone rather than only where legally compelled.

To exercise any of these, contact [Privacy Contact]. We will respond within the period the law requires, normally one month. If you are unhappy with our response you can complain to your data-protection supervisory authority — in [Jurisdiction], that is [Supervisory Authority].

8. Deleting your account — what actually happens

We want to be precise here rather than reassuring, because "delete everything instantly" would not be true.

Closing your account deletes your identity on Artable. It is deliberately not an instruction to erase every record connected to you, and we will never silently destroy things as a side effect of it. In particular:

• If you own a space, deletion is blocked and we will tell you why. You must delete or transfer that space first — closing a personal account will never quietly delete a creator's space and everything published in it.
• If you have an active paid subscription, deletion is blocked until it is resolved, so that a live billing relationship is never left running against a record that no longer exists. Cancelling is an explicit step you take, never something bundled invisibly into "delete my account".
• Financial and transaction history is retained, with your display identity detached from it, for the retention period in section 6. We cannot delete records we are legally required to keep.
• Personal items such as saved content and reactions are removed as part of normal cleanup.

Self-service account deletion is not yet available in your settings. Until it is, email [Privacy Contact] from your account address and we will handle it manually, telling you about anything that must be resolved first. Backups are overwritten on a rolling cycle, so a copy may persist in backup storage for up to [Backup Retention Period] after deletion.

9. Security

Data is encrypted in transit. Paid and private content is served through short-lived, authorised access rather than public links, and access is checked against your actual entitlement on every request. Access to production systems is restricted, and sensitive endpoints are rate limited. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authority where the law requires it.

10. Children

Artable is not intended for children under [Minimum Age]. We do not knowingly collect personal data from them. If you believe a child has given us personal data, contact [Privacy Contact] and we will delete it.

11. Changes to this policy

We will update this policy as the Service changes. The date at the top always reflects the current version, and for material changes we will give notice by email or in the product before they take effect.