Privacy Policy

Information We Collect

We collect information you provide directly to us, such as when you create an account, apply to become an artist, or make a purchase:

• Account information: name, email address, and password
• Artist profile data: biography, location, portfolio images, and social links
• Transaction data: purchase history, shipping addresses, and payment method details (processed by Stripe — we do not store raw card numbers)
• Communications: messages you send to us or through the platform

We also collect limited data automatically when you use the platform, including IP address, browser type, pages visited, and session duration, for security and analytics purposes.

When you send a message through an artist’s contact form, we also record the IP address the message was sent from. We use it solely to prevent abuse — such as spam and evasion of rate limits — and we automatically delete it 30 days after the message is sent.

Third-Party Services

We use the following third-party services, each with their own privacy policies:

• Stripe: Payment processing. Stripe collects and processes payment information directly. See Stripe’s Privacy Policy.
• PostHog: Product analytics. We use PostHog to understand how the platform is used, and only after you opt in. How your activity is identified is described under “Cookies and Analytics” below. See PostHog’s Privacy Policy.
• Sentry: Error and performance monitoring across our website and our backend services. Sentry may process technical data — such as browser type, IP address, and error context — to help us diagnose and fix problems. See Sentry’s Privacy Policy.
• Postmark: Transactional email delivery. We use Postmark to send account, application, and notification emails. See Postmark’s Privacy Policy.
• Amazon Web Services (AWS): Infrastructure hosting and content delivery. Your data is stored on AWS servers in the United States, and artwork images are served through the Amazon CloudFront content delivery network (CDN). See AWS’s Privacy Policy.
• Vercel: Frontend hosting and CDN delivery. See Vercel’s Privacy Policy.

We do not sell your personal information to any third party.

Cookies and Analytics

We use a small number of cookies and similar technologies. How we treat them depends on whether they are strictly necessary or analytics-related:

• Session and authentication cookies: Required to sign you in and keep you signed in. These are always active because the platform cannot function without them.
• Analytics: Off by default. We use PostHog to understand how the platform is used, but analytics remain disabled until you opt in.

Analytics is opt-in. Before you make a choice, PostHog runs in a memory-only mode that writes no analytics cookies or browser storage and keeps no identifier between page loads. When you accept analytics from our consent banner, we enable usage tracking and allow PostHog to store its identifier in your browser (in localStorage and cookies) so your activity can be measured across pages.

If you are signed in when analytics is enabled, your usage events are linked to your account so we can understand your experience across visits. If you are not signed in, your activity is tied only to a random device identifier and is not connected to your identity.

Your choice is revocable. If you decline, or later withdraw consent, we stop collecting analytics events. If you had been signed in and identified for analytics, we also reset that analytics identity on your device. Declining analytics does not affect the required session and authentication cookies described above.

Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with our services. Specifically:

• Account data is retained for the duration of your account and for up to 90 days after deletion
• Transaction records are retained for 7 years for tax and legal compliance
• Analytics data is retained for 12 months, after which it is aggregated or deleted
• Communications with support are retained for 2 years

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that we correct inaccurate or incomplete data
• Deletion: Request that we delete your personal data. We execute a deletion once any outstanding legal and financial obligations have cleared, and certain records are exempt from erasure, as described below.
• Portability: Request an export of your data in a machine-readable format
• Objection: Object to certain types of processing, including direct marketing

Account deletion and data export are available on request by emailing us at the address below — there is no self-service option today. Once we execute a deletion, we remove or anonymize your personal data within 90 days of execution.

Some records are exempt from erasure and are retained even after an account is deleted:

• Transaction and payment records, kept for 7 years to meet our tax and legal obligations.
• Records preserved under a legal hold — including evidence related to a DMCA takedown notice — which we retain to establish, exercise, or defend legal claims (the legal basis is GDPR Article 17(3)(e); the equivalent basis under California law is Civil Code §1798.105(d)(1)). The retention period for DMCA takedown evidence is being finalized in legal review.

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

Contact Us

If you have questions about this privacy policy or how we handle your data, please contact us:

We may update this policy from time to time. When we do, we will update the “last updated” date at the top of this page and, where the changes are material, notify you by email or a notice on the platform.