Privacy Policy

What we collect

Your account. An email address and a password. Passwords are hashed by our authentication provider; we never see them.

Your profile. Whatever you choose to put there: handle, display name, pronouns, bio, avatar, links. All of it is optional except the handle, and all of it is public by design, because a portfolio is a public thing.

Your work. The image files you upload, their titles, descriptions, media, tags and the galleries you arrange them into.

Activity needed to run features you use. Saves, follows, feedback threads, process stages, Weekly Universal entries.

How you found us. If you signed up through a link carrying a source tag, such as an invitation shared with a class, we store that tag with your account. We use it only to count which invitations lead to signups and first uploads. It is never shown publicly or shared with anyone.

Billing state. If you subscribe, we store a Stripe customer id, a subscription id, its status and its renewal date. We do not store card numbers. We never receive them.

We do not run advertising trackers, and we do not sell personal data to anyone.

Your real name is not public unless you say so

Artive shows your handle by default. Your display name, which for most people is their real name, appears publicly only if you explicitly turn it on in Settings.

Search never matches on real names. Searching for people matches handles only. This is deliberate: it means somebody who knows your legal name cannot find your account with it.

How your files are stored

Every upload is stored twice, in two different places, on purpose.

The display copy goes into a public bucket. This is what visitors load when they view a public gallery. Anyone with the URL can fetch it. That is what makes a public portfolio public.

The original goes into a private bucket that is not publicly readable at all. The only way to retrieve it is a short-lived signed link, and the storage rules only issue one to the file's owner. If your gallery is private, or you never publish a piece, its original is reachable by you and nobody else.

Both copies are also included in the nightly backups described under "Who else processes your data".

Who else processes your data

Supabase. Database, authentication and file storage. Your account, your work and your originals live here.

Vercel. Hosting. Serves the application and keeps standard request logs.

Stripe. Payments. If you subscribe, Stripe receives your email and your card details directly; the card details never pass through us. Stripe's own privacy policy governs what they do with them.

Anthropic. The AI features. When you generate a daily stART prompt and when an upload is moderated, the relevant input is sent to Anthropic's API. Anthropic's commercial terms do not allow it to train models on what we send or on what it sends back. It deletes this data within 30 days, unless its automated safety systems flag it as breaking its usage policy, in which case it may keep it for up to 2 years, or longer if the law requires.

Resend. Email delivery. Sign-in links, password resets and the emails Artive sends you, such as upload receipts, go out through Resend. It receives your email address and the message.

Sentry. Error reports. When something breaks, a report of the error goes to Sentry so it can be fixed. It is set up not to collect personal data: a report may include an internal account or artwork id, never your email address, your password or your work.

Backblaze. Off-site backups. Every night, a copy of the database and every stored file, originals included, is copied to Backblaze, where it is stored encrypted, so Artive can be restored if something fails. The database copy includes your password only in hashed form, which cannot be read back as your password.

We use these vendors to run the product. We do not send your data anywhere else.

AI features, specifically

Artwork you upload is sent to an automated moderation check before publication.

The daily stART generator sends the mood words you pick, and not your artwork, to generate a prompt.

None of this is used to train a model, by us or by our vendor.

What is public and what is not

Public: your handle, avatar, bio, pronouns and links; galleries you have marked public and the work in them; your follower and following counts.

Private: your email address; galleries you have not published; original files; private feedback threads; your saved board; which artists you follow, as a list.

Follower counts are public but the follower and following lists are visible only to the account they belong to.

Your rights over your data

Access and download. Your work is downloadable from the app at original quality, at any time, on any tier.

Correction. Everything in your profile is editable in Settings.

Deletion. Deleting your account deletes your profile, galleries, artwork and originals. It is permanent.

Questions or requests. privacy@artivegallery.com.

If you are in a jurisdiction with statutory data rights — the UK, the EU, California and others — you have those rights and we will honour them. Write to the address above.

Retention

We keep your account and work for as long as your account exists.

Billing records are kept as long as tax and accounting rules require, which is longer than the account itself.

Deleting your account removes your content from the live system straight away. Copies of it remain in backups, kept with Backblaze and on Artive's own equipment, until those backups expire, normally within 31 days.

Cookies

Artive sets cookies to keep you signed in. That is what they are for.

There are no advertising cookies and no third-party analytics trackers.

Children

Artive is not intended for children under 13, and we do not knowingly collect their data. If you believe a child under 13 has an account, tell us and we will remove it.

Contact

privacy@artivegallery.com