Privacy Policy

1) Overview & Applicability

This Policy explains how Artovio Inc. (“Artovio”, “we”, “us”) processes personal information for our websites, apps, and marketplace services (“Services”). If you do not agree, please discontinue use. We may update this Policy; the date above reflects the latest version. Our registered/mailing address is: 18 King Street East, Suite 1400, Toronto, ON, Canada.

2) Data We Collect

• Identifiers & Account: name, email, username, hashed password, settings/preferences.
• Security Telemetry: IP address and related metadata at login and when artists accept platform terms (for evidencing consent and account security).
• Transaction Data: orders, amounts, fulfillment details; limited payment metadata (we do not store full card numbers).
• Buyer Jurisdiction (Pickup Orders): for in-person pickup orders, the country/region you enter in your shipping details and, as a corroborating signal, an approximate country/region derived from your IP address. We use this solely to determine whether mandatory distance-selling consumer-protection rules (e.g., Quebec, EU, UK) require the order to be placed as a "reserve & pay on pickup" order rather than a prepaid online sale — see our Terms & Conditions and Return Policy for details.
• Communications: messages you send to us (e.g., support).
• Usage Signals: device/browser info, logs created by our systems and service providers.

Please avoid submitting sensitive data we do not request. Do not upload others’ personal information without permission.

3) Why We Use Data (Legal Bases)

• Provide the Services / Contract: create/manage accounts, process orders, provide support.
• Security & Fraud Prevention (Legitimate Interests / Legal Obligations): protect accounts, detect/prevent abuse and unauthorized access, enforce our terms, maintain audit evidence (including IP at login and artist terms acceptance).
• Compliance: tax/accounting and other legal or regulatory requirements, including determining whether a pickup order must be routed as a no-prepayment reservation to honor mandatory consumer withdrawal rights in your jurisdiction.
• Consent (if used): optional communications or features that require it; consent can be withdrawn at any time.

4) Marketplace Roles (Buyers & Artists)

Artovio typically acts as the controller of buyer and artist account data. Artists may act as independent controllers for information they collect directly from buyers (e.g., custom commissions) and must comply with applicable law for their own processing.

5) Sources of Data

• You: account setup, orders, uploads, messages.
• Automatically: cookies/SDKs, logs, device/browser signals.
• Service Providers: payment, hosting, security, and similar operational partners.

6) Cookies & Similar Technologies

We use necessary cookies/SDKs to run the Services and remember certain preferences. Where required by law, we obtain consent for non-essential cookies. You can control cookies via your browser settings and our interfaces where available.

7) Security & Network Logs (IP Addresses)

We collect and retain IP addresses and related network metadata in server/CDN/WAF/application logs to protect the Services (e.g., detect/mitigate fraud and abuse, rate-limit requests, investigate incidents, enforce our terms). For artists, we also keep consent evidence (including IP and timestamp) for acceptance of terms. Where feasible, we apply data minimization and access controls.

8) Payments, Payouts & Identity Verification

Payments, payouts, and (where required) identity verification are handled by a certified third-party payment and identity provider under its own terms and privacy notices. We do not store full card numbers. Providers may act as independent controllers for certain activities (e.g., fraud/AML) and as processors for others.

9) Sharing with Service Providers

We share personal information with service providers that support our operations (e.g., hosting, payments, security, email/SMS, customer support) under agreements requiring confidentiality and appropriate safeguards. We may also disclose information as required by law or to protect rights and safety.

Google reCAPTCHA: our contact and other public-facing forms use Google reCAPTCHA to help prevent spam and abuse. Google may process technical/usage data (e.g., IP address, device and browser signals) for this purpose under its own Privacy Policy and Terms of Service.

AI-assisted listing tools: when an artist chooses to use an optional AI-assisted listing feature (e.g., generating a suggested product description or an edited product image), the uploaded artwork image and listing details are sent to a third-party AI provider solely to produce that suggestion. The provider processes this data under its own applicable terms and privacy policy. We do not use this content to train our own or any third-party AI/machine-learning models without separate, explicit opt-in consent.

10) International Transfers

We may transfer personal information to other countries. Where required, we implement appropriate legal mechanisms (e.g., contractual safeguards/adequacy) for such transfers.

11) Retention

We keep personal information only for as long as necessary to provide the Services, meet legal/regulatory obligations (including security, fraud prevention, tax/accounting, and consent record-keeping), resolve disputes, and enforce agreements.

Contact form submissions (e.g., name, email, message, and consent evidence) are automatically deleted no later than 3 years after submission. You may request earlier deletion at any time — see Section 19.

12) Security Measures

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls, monitoring, and vulnerability management. No method is 100% secure; please use a secure connection and unique credentials.

13) Automated Tools & Profiling

We may use automated tools to help detect spam, fraud, or policy violations, and to personalize certain experiences where permitted by law. We do not rely solely on automated decisions producing legal or similarly significant effects where prohibited.

AI-assisted listing tools: optional artist-facing tools (e.g., generating suggested product descriptions or edited product images) send the uploaded artwork image and listing details to third-party AI providers solely to produce that suggestion, at the artist's request. These providers process the content under their own applicable terms and privacy policies. We do not use artist or buyer content, including artwork images, to train our own or third-party AI/machine-learning models without separate, explicit opt-in consent from the content owner.

14) Do Not Sell/Share & Global Signals

We currently do not sell or share personal information for cross-context behavioral advertising. If this changes, we will provide an opt-out mechanism and, where required by law, honor recognized universal/“global” privacy signals for such activities.

15) User-Generated Content (Public Areas)

Content you post (e.g., listings, reviews) may be public. Do not include personal information you prefer to keep private in public areas.

16) Third-Party Links

Our Services may link to external sites. Their privacy practices are governed by their own policies; we are not responsible for them.

17) Lawful Requests & Compliance

We may access, preserve, and disclose information when we believe in good faith it is necessary to comply with applicable law, lawful requests, or legal process; to protect users, our Services, or others; to enforce our terms; or to respond to security or integrity issues.

18) Marketing Communications

We may send transactional messages related to your account or orders. Marketing communications (if used) are sent with consent or as otherwise permitted by law. You can opt out by contacting us.

19) Your Rights & How to Contact Us

Depending on your location, you may have some or all of the following rights over your personal information, subject to applicable law and verification of your identity:

• Access: request a copy of the personal information we hold about you.
• Rectification / Correction: ask us to correct inaccurate or incomplete information.
• Erasure / Deletion: ask us to delete your personal information in certain circumstances.
• Restriction: ask us to temporarily restrict processing while a dispute is resolved.
• Data Portability: where processing is based on consent or contract and is carried out by automated means, receive your personal information in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller (GDPR / UK GDPR right).
• Object: object to processing based on our legitimate interests, including for direct marketing where applicable.
• Withdraw Consent: where we process your data on the basis of consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Non-Discrimination: you will not be penalized or receive a degraded service for exercising any privacy right.

California residents (CCPA/CPRA): you additionally have the right to know, delete, correct, limit the use of sensitive personal information, and opt out of the sale or sharing of personal information for cross-context behavioral advertising. We currently do not sell or share personal information for that purpose (see Section 14).

To exercise any right or raise a privacy question, contact us at privacy@artovio.com or via our contact page, or by mail at 18 King Street East, Suite 1400, Toronto, ON, Canada. We will respond within 30 days of receiving a verifiable request, or within any shorter period required by applicable law.

If you are in the EU or UK, you may lodge a complaint with your local data protection supervisory authority. Depending on your location, you may also have the right to contact your local privacy regulator.

20) Children

The Services are not directed to children under 13 (or the age defined by local law). If you believe we collected such data, contact us so we can address it.

21) Changes to this Policy

We may update this Policy to reflect operational, legal, or regulatory changes. We will post updates here with an updated date and provide additional notice where required.