Privacy policy
Last updated: April 5, 2026
This Privacy Policy describes how the operator of the Art.industries service, doing business as Art.industries (“we”, “us”, “our”), collects, uses, discloses, and otherwise processes personal information in connection with our websites, applications, and related services (collectively, the “Service”). If you do not agree, do not use the Service.
1. Who we are
Controller (Art.industries account, billing, and platform operations): the operator of the Art.industries service. Contact: support@art.industries. A registered postal address is available on request at the same address.
For personal data processed on behalf of our business customers (for example, a gallery’s contacts and inventory stored in a workspace), the customer is typically the controller and we are the processor. Processing is governed by our agreement with that customer and, where required, a data processing agreement (DPA)—see Terms of use.
2. Personal information we collect
You provide. Account and profile (name, email, workspace name, role, preferences); content you submit (inventory, CRM records, notes, files, images, website and campaign content, viewing-room content); communications to us; billing contact details. Payment card numbers are processed by Stripe; we do not store full card numbers on our servers.
Automatic collection. IP address, approximate location from IP, browser and device type, pages and features used, timestamps, diagnostic logs, cookies and similar technologies (see our Cookie notice); first-party product analytics events stored on our systems; security and anti-abuse signals.
From others. Social or OAuth providers if you connect integrations; payment status from Stripe; email delivery status from SendGrid (bounces, spam reports); first-party open and click tracking on our systems for campaign and offer emails sent through the Service; administrators may invite you to a workspace.
3. How we use personal information
- Provide, operate, secure, maintain, and improve the Service;
- Create and manage accounts and workspaces; authenticate users;
- Process subscriptions and payments;
- Send transactional messages (sign-in codes, security, billing receipts as applicable);
- Support, respond to inquiries, and debug;
- First-party analytics to understand usage and improve the product;
- Comply with law and enforce our terms; protect rights, safety, and property.
Artificial intelligence. Certain features use OpenAI (or similar providers we may add). Your instructions and relevant workspace content you submit may be transmitted to that provider. Do not submit information you are not permitted to share.
4. How we disclose personal information
We disclose personal information to:
- Subprocessors that assist us—see Section 5;
- Your workspace and its authorized users as needed for collaboration;
- Professional advisors under confidentiality;
- Authorities when required by law or to protect rights and safety;
- A successor in a merger, acquisition, or financing, subject to law.
We do not sell personal information for money as a line of business.
5. Subprocessors (typical)
Depending on configuration, we use providers such as:
- Cloud hosting, database, object storage, and CDN (e.g. AWS or equivalent);
- Stripe—subscription and add-on billing for the Service, and where enabled, Connect for seller payouts;
- SendGrid (Twilio)—transactional and campaign email transport, deliverability event webhooks;
- OpenAI—AI-assisted features;
- Optional OAuth providers (e.g. Google, Meta, TikTok) when you enable integrations.
We will publish or provide an updated subprocessor list as required by contract.
6. Legal bases (EEA, UK, Switzerland)
Where GDPR-style laws apply, we rely on contract, legitimate interests (security, service improvement, first-party analytics—balanced against your rights), consent where required (for example optional visitor analytics where a consent banner is shown), and legal obligation as applicable.
7. Retention
We retain personal information as long as needed to provide the Service, comply with law, resolve disputes, and enforce agreements. Backup copies may persist for a limited period after deletion from active systems.
8. Security
We implement technical and organizational measures designed to protect personal information. No system is perfectly secure.
9. International transfers
We may process information in countries where we and our providers operate. Where required, we use appropriate safeguards (such as Standard Contractual Clauses).
10. Your rights and choices
Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, port data, or withdraw consent, and to complain to a supervisory authority. To exercise rights for data we control, contact support@art.industries. If we process data as a processor for a workspace, we may direct you to that workspace’s administrator.
Marketing: use unsubscribe links where provided. Transactional messages may continue.
11. Children
The Service is not directed to children under 16, and we do not knowingly collect their personal information.
12. U.S. state privacy (California and others)
Depending on your U.S. state of residence, you may have additional rights regarding personal information (for example access, deletion, and opt-out of certain “sales” or “sharing” as defined by local law). We do not sell personal information for money. To submit a request, contact support@art.industries. We will not discriminate against you for exercising applicable rights.
13. Changes
We may update this Privacy Policy. We will post the revised version and update the “Last updated” date.