Privacy Policy

1What we collect

What you give us

• Your account: email address, username, display name, profile, the ways you sign in and your preferences.
• Your store, if you sell: your application to open it, its name, description, policies, look, how its place shows, where its payout setup stands, how buyers may pay it, its team, listings, prices, files and delivery details.
• What you buy: shipping addresses, billing and tax details, the billing place sent to Stripe, orders, bids, raffle entries, commission requests, what you agree to at checkout, reference pictures, reviews, reports and dispute evidence.
• If you buy as a guest: your email address, the name you give and your orders. We email you codes and links to reach them, and move them into an account you later make with that email.
• Messages, support requests, appeals, requests for your data on Discord or by email, and anything else you send to Artist Alley or to other people here.
• Files you upload: listing pictures, references, review pictures, delivered files, store media, attachments and their details. Pictures sent in messages are saved without their camera or location details.
• Your support for Artist Alley, if you give it: its amount and how often, a note you choose to show, whether your name shows on the supporters' page, and your Patreon membership if you link it.
• Proof of what you agreed to: the Terms and Privacy versions, age statements, consumer rights agreements, when and where you agreed, and minimized details of the request.

What we collect as you use it

• Device, browser, IP address, request, session, security and error details we need to run and protect the service.
• The time zone your browser reports while you're signed in, so times and emails show in your own.
• Counts kept as private as we can: qualified views of listings and stores, the place an artist's share link was posted when an order came through it, and marketplace facts such as saves, bag activity, checkout status, orders, bids, follows and reviews.
• Payment, tax, shipping, fraud, chargeback, dispute, moderation and status details from our providers.
• Country, region, postal code, where a piece ships from and to, customs, import charges, tax work, tax monitoring and tax readiness details, needed to decide whether a checkout can go ahead, which currency you see and how it's taxed.

Cookies and browser storage

We use only the cookies we need, such as session cookies and access cookies, including a guest's access to their own orders. We also keep sign-in state, preferences, the state of a sign-in or a Stripe step you return from, display settings, a guest's bag, recent searches and similar product details in your browser's storage.

We don't use advertising cookies from others, social media tracking pixels or outside traffic analytics.

We also keep all-time view counts for public listings and for stores' private dashboards. These counts make no lasting browser identifier, don't link your activity across pages, keep no raw IP address or browser string in the count, and don't tie purchases to past visits. To avoid counting twice, the server may briefly keep a key made from details of the request, which expires within a short window and is never used as browsing history.

When you agree to something, we keep minimized proof: a hash of your IP address, its network part, a hash of your browser string and its length, the time, where you agreed and related context, so we can prove which versions you agreed to without keeping your raw IP address or full browser string in that record. Our separate security, fraud, payment, provider and running logs may still handle your IP address or browser string when needed to run and protect the service.

2How we use it

• To make accounts, sign people in, run stores, publish listings, process orders, deliver files and offer the marketplace's features.
• To handle payments, payouts, refunds, chargebacks, tax work and monitoring, which countries can buy, currency conversion, fraud checks, tracking, customs and import notices, and delivery.
• To tell you about orders, commissions, bids, raffles, disputes, support, policy changes, moderation, security and your account.
• To enforce our Terms, Trust and Safety rules, DMCA Policy, payment providers' rules and the law.
• To stop fraud, spam, abuse, sanctions breaches, security incidents, access without permission and misuse. Our own systems look for the same link or words sent from new accounts to many artists, so staff can stop a scam.
• To keep the service running, fix it, improve it, measure it and secure it.
• To keep the proof of Terms, Privacy, age, bid and checkout agreements that marketplace commitments and the law need.

Legal bases, where the law asks

Where laws such as the GDPR or the UK GDPR ask for a legal basis, we handle personal information as needed to perform our contract with you, to meet legal duties, for legitimate interests such as security, stopping fraud, running the marketplace, support, private measurement and enforcing our policies, to protect someone's vital interests in an urgent safety case, or with your consent where it's needed for some messages or other uses.

3What we don't do

• We don't sell personal information.
• We don't use your artwork, files, references, private messages or delivered files to train AI.
• We don't knowingly let advertising networks or social media pixels track people across Artist Alley.
• We don't publish your card number. Stripe handles card details.

4Who we share it with

We share personal information only as needed to run Artist Alley, complete sales, protect people, follow the law, or work with providers who handle it for those reasons. We don't sell it or share it with advertising networks.

• Payment, payout, tax and fraud providers, to process checkouts, artists' payouts, taxes, refunds, chargebacks, fraud checks and disputes. Stripe handles card details; the records may include identity, onboarding, billing, shipping, tax, sale, fraud, refund and dispute details.
• Sign-in providers you choose, to sign you in or link another account: the sign-in identifiers, profile details, account tokens and status from that provider.
• Patreon, if you link your Patreon membership to support Artist Alley: the amount you're entitled to, whether you pay, your charges and the name you use there.
• Hosting, storage and delivery providers, to run the website and API, store files, serve media and keep running logs: the app's data, uploaded pictures, media, attachments, evidence, delivered files, public media, references to private files, signed access details, requests and logs.
• Email and message providers, to send messages about sales, security, support, orders and policies: email address, display name, the message, notification settings and delivery details.
• Monitoring and security providers, to find errors, look into incidents, protect accounts and keep the service reliable: error logs, request details, device and browser details, the account involved, IP address where there is one, and related details.
• Shipping and address providers, to price shipping at checkout, check addresses, buy labels, track parcels and handle customs where that's on: carrier, tracking number, shipping address, parcel sizes and status, address check details, customs and shipping details.
• Picture checks: pictures sent and shown here may be checked by outside services, such as Cloudflare's, against known child sexual abuse images. A match is removed and reported as the law requires. These checks compare fingerprints of pictures and don't train AI.
• Our public Discord, where new pieces, restocks, bids, auction results and raffle draws are posted by themselves: a bidder shows by the name they chose to show, else as anonymous.
• The other people in a sale, message, review, dispute or report, to complete it and settle support, safety and payment problems: what's needed for that order, message, commission, parcel, review, dispute or report. The members of an artist's store team see what they need to fulfill its orders, such as a buyer's name and address. For a ready-made physical auction, the artist gets the shipping address given with the bid only if that bidder wins and the payment goes through.

We may also share information when the law, a valid legal process, sanctions rules, a payment provider's rules, a safety emergency or stopping fraud requires it, or to protect Artist Alley, the people who use it or the public.

5Your rights and choices

• You can see and change many of your account, store, profile, address and preference details yourself.
• You can ask to correct, export, delete or see your personal information on the official Artist Alley Discord, our preferred support channel, or by email at support@artistalley.org.
• Deleting your account waits until your marketplace obligations are no longer open. It's erased 30 days after you ask unless you sign in to keep it, and staff may wait up to 90 days from your ask while a report about you is open.
• You can turn off messages that aren't essential where the product or the message offers it. Messages about sales, security, the law and your orders may still come.
• Depending on where you live, you may have more privacy rights. We honor the rights that laws such as the GDPR, the UK GDPR, the CCPA and CPRA and similar laws give, where they apply.

6Security and retention

We use technical and organizational safeguards to protect personal information, including access controls, secure session cookies, origin checks on requests that change things, our providers' own security and monitoring. No service can promise perfect security.

Who on our team sees what

Staff see only what their role needs. Moderators read reports and the conversations they're about, never emails, addresses or payment details. Admins and Moderators open any other private conversation only with a reason. Every time staff open a private conversation, someone's contact details or an order's address, it's recorded.

How long we keep it

We keep information as long as needed to provide the service, complete sales, keep records, settle disputes, stop fraud and abuse, answer chargebacks, meet tax and legal duties and enforce our terms. How long depends on the kind of information.

• Order, payment, payout, tax, dispute and chargeback records may be kept for the periods the law, tax, accounting and fraud prevention need.
• Billing details used for tax, the shipping destination, the rules for the buyer's place at the time, import agreements and tax evidence may be kept with order and payment records for legal, tax, accounting, dispute and compliance reasons.
• Messages may be kept for the other person's history, safety, support and disputes, with the sender made anonymous after their account is deleted where that applies.
• Uploaded files may be deleted, kept or made anonymous depending on whether they are still part of orders, listings, reports, disputes, reviews, delivery records or legal duties.
• A live shipping quote keeps a fingerprint of the address it priced, never the address itself.
• A picture removed as illegal is kept locked, out of everyone's sight, for a year from its report, then deleted.
• Security, audit and running logs, the record of what staff opened among them, are kept as needed to find abuse, look into incidents and keep the platform going.
• Proof of agreements and checkout acknowledgements may be kept as long as needed to prove the versions agreed to, age statements, consumer rights agreements and marketplace commitments.

Who can see uploaded files

Media posted for everyone to see, such as listing, gallery, store, profile picture, banner, texture and review pictures, may use public addresses. Private uploads, such as message attachments, buyers' reference pictures, dispute and report evidence, work files, delivered files and digital listing files, are stored privately or given through signed links to the people the product lets see them.

Across borders

Artist Alley is based in the United States. If you use it from elsewhere, your information may be handled and stored in the United States and other countries where our providers work. Where the law asks for safeguards for that, we rely on our providers' terms, contract safeguards and other lawful ways to transfer for that provider and place.

Children

Artist Alley isn't meant for children under 13, and you must be at least 13 to use it. People under 18 may use it only with a parent's or guardian's permission, and only people 18 or older may bid in auctions. If we learn that we have collected personal information from a child under 13, we will take appropriate steps to delete it.

7Changes and contact

We may update this Privacy Policy from time to time. When a change matters, we will give reasonable notice in the product, by email or in another fitting way.

For privacy requests and questions, we prefer the official Artist Alley Discord. Email remains available at support@artistalley.org. Mailing address for legal notices: Artist Alley Org LLC, 732 S 6th St, Ste R, Las Vegas, NV 89101. Copyright notices go to dmca@artistalley.org.