Privacy Policy

1. Who we are

Artelier Business is operated by Artgence, Paris, France. It acts as the data controller for the personal data of its users processed through Artelier Business (the "Service").

Contact for privacy matters: support@artelierbusiness.com

2. What data we collect

We collect the following categories of personal data:

• Account data: email address, name, role (artist, manager, admin), and authentication credentials.
• Artist profile data: biographical text, artist statement, exhibitions, education, awards, residencies, publications, themes, materials, languages, country, city, headshot, and CV.
• Artwork data: titles, descriptions, dimensions, year, medium, series, tags, pricing, availability, and uploaded images.
• Opportunity data: titles, organizations, deadlines, locations, requirements, and notes about residencies, grants, exhibitions, and similar career opportunities.
• Application data: project proposals, project subtitles, pull quotes, selected artworks, submission status, submission method, recipient, and reference numbers.
• Brand kit data: studio name, logo, brand colors, fonts, and contact details used to render application packages.
• Communication data: invitation emails sent through the platform and the messages they contain.
• Usage and log data: IP address, browser type, device type, pages visited, actions performed, and timestamps.
• Payment data: when payment features are active, billing data is collected and processed by Stripe; Artelier Business receives only transaction status and metadata, not full card information.

3. Why we collect it: legal bases under GDPR

We process your data on the following legal bases under Article 6 of the GDPR:

• Contract performance (Art. 6(1)(b)): creating and maintaining your account, generating application packages, processing payments, and providing the core Service.
• Legitimate interest (Art. 6(1)(f)): security, fraud prevention, analytics for service improvement, and aggregate usage analysis.
• Consent (Art. 6(1)(a)): optional features such as marketing communications and non-essential cookies.
• Legal obligation (Art. 6(1)(c)): retention of financial records and compliance with applicable tax, accounting, and reporting laws.

4. Who we share it with: third-party processors

We share data only with the processors below, each for the purpose stated. We do not sell personal data and we do not share it for advertising.

Hosting and the platform the Service runs on

• Base44, Inc. (USA): application hosting, the database, file storage and the server functions. All Service data is stored in the Base44 environment, in the United States. Base44 acts as our processor under its Data Processing Agreement (base44.com/dpa).
• Base44's own sub-processors, as Base44 lists them: MongoDB (data storage, USA), Render (servers, USA), Supabase (stored files, USA), SendGrid (e-mail, USA), Google Cloud (analytics, USA), Datadog (logs, USA), OpenAI and Anthropic (AI requests, USA), and Wix.com Ltd. (Base44's parent company, Israel, for "providing and improving the services").

Services the Service calls for a specific task

• Stripe (USA): subscription payments. Card data is collected directly by Stripe and never reaches Artelier Business.
• Resend (USA): the e-mails the Service sends (sign-in codes, invoices, notifications).
• PDFShift (France): turning documents into PDF files. PDFShift keeps no document after the conversion.
• Shippo (USA) and DHL: shipping rates and labels, with the addresses needed for the shipment, when you use shipping.
• Brave Search (USA): finding open calls for artists. The searches contain an artist's medium, themes and city, never a name or a contact detail.
• Meta (WhatsApp): messages, when you connect WhatsApp to the Service.
• Google: your Gmail and Calendar, only when you connect them yourself.
• Wix: a gallery's own Wix website, only when the gallery links it to the Service.
• CurrencyFreaks: exchange rates. No personal data is sent.

4a. AI and your data

• Artelier Business does not train AI models on your data and does not sell it.
• AI features (for example drafting a text, or reading an invoice you upload) send only the content needed for that request, at the moment you use the feature, to the AI providers Base44 uses.
• Our host's terms. Base44's Terms of Service allow it to use customer data to train and improve AI models. Base44 has told us in writing that this applies on every plan except its Enterprise plan, with no setting to opt out. Its Data Processing Agreement limits its use of personal data to providing the service, unless the data is fully anonymised or aggregated. We have asked Base44 to confirm in writing how this applies to the personal data in the Service, and we will update this section with its answer.
• What we do about it. Sensitive information is encrypted before it is stored, so that what is stored is unreadable to anyone reading the database, including for any such use. Bank details are stored encrypted since 30 October 2026; collectors' contact details and the sales history follow, account by account. Encrypted information is opened only by the Service, for the person allowed to see it, at the moment they open it.

5. International transfers

Some of our processors operate outside the European Economic Area, including in the United States. When data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) or equivalent safeguards approved under Article 46 of the GDPR to ensure your data remains protected to a standard equivalent to EU law.

6. How long we keep your data

• Your account, profile, works, applications and documents: while your account is open. When you ask to delete your account, it is closed and hidden at once and deleted 14 days later; until then you can keep it, and everything comes back as it was.
• Invoices and accounting records you issued: 10 years, archived and sealed (Code de commerce, article L123-22; Livre des procédures fiscales, article L102 B as amended in 2026). No one can open them in the app. Each is erased on 31 December of its year plus 10.
• Your Artelier Business subscription bills: 10 years, as our own accounting records.
• Records of support access to your account: 12 months.
• Downloads you prepare: 7 days.
• Files you uploaded (images, CVs, receipts, contracts): removed within 30 days of the deletion. Until then a file stays reachable only at its own unguessable address.
• Encrypted backups: up to 12 months. If we ever restore a backup, we apply every deletion again before the data is used.
• Our hosting provider keeps deleted records in its history for up to 30 days, and a closed sign-in for up to 30 days, before erasing them.

We archive rather than destroy as far as the law allows, but no further. The law asks us, and the businesses that use Artelier Business, to keep accounting records for 10 years, so those are archived and sealed. Your other personal data is erased when your account is deleted: the GDPR (article 17) does not allow us to keep it archived without a legal reason.

7. Downloading your data, deleting your account

Downloading your data. In Settings, Your data, you can download everything Artelier Business holds about you: your profile, works and images, sales, invoices, certificates, contacts, applications, documents you uploaded and your account history. You get one ZIP file with a readable summary, shown to you before you download, data files (JSON and CSV) and your files. It does not contain the buyers of sales made by a gallery or a manager, because that information belongs to the seller, nor security codes that would let someone into your account.

Deleting your account. In Settings, Your data, you can delete your account. We show you what will be deleted and what will be kept before you confirm. Your account is then closed and hidden: your public pages go offline and no one else is told. For 14 days nothing is deleted, and you can keep your account by signing in. On the 14th day we delete your profile, works, contacts, applications, documents, files and history. Then:

• Records that belong to another business stay with it, complete, without your e-mail address or your access. For example, a gallery keeps its records of the sales of your works it made, with their invoices and certificates, and your name stays on the works you made, as their author.
• Invoices and accounting records you issued are archived and sealed for 10 years, exactly as they were, because French law asks a seller to keep them that long. No one can open them in the app. You can ask for a copy, for a tax check, by writing to support@artelierbusiness.com from your former address.
• Certificates of authenticity that collectors hold stay verifiable, showing the work, its author and "Private collection" in place of any private owner.

8. If a business on Artelier Business holds your data

Galleries, managers and artists use Artelier Business to run their business. For the records they keep about their buyers, collectors and contacts, each of them is the data controller and Artelier Business acts on their instructions. If one of them holds your details, you can ask to see or erase them through our request form or at support@artelierbusiness.com. We confirm your e-mail address, pass your request to each business holding your data, and you get an answer within one month. An invoice issued to you cannot be erased before the end of its legal retention period. You can complain to the CNIL (cnil.fr).

9. Your rights under GDPR

As a data subject, you have the following rights, which you can exercise free of charge:

• Right of access (Art. 15): obtain a copy of the personal data we hold about you.
• Right to rectification (Art. 16): correct inaccurate or incomplete data. Most fields can be edited directly within the Service.
• Right to erasure (Art. 17): request deletion of your data, subject to legal retention obligations.
• Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interest.
• Right to restriction (Art. 18): request that we limit how we process your data.
• Right to withdraw consent: where processing is based on consent, you can withdraw it at any time without affecting prior lawful processing.
• Right to lodge a complaint: with the French data protection authority (CNIL) at cnil.fr, or with the supervisory authority in your country of residence.

To exercise any of these rights, use Settings, Your data, or contact support@artelierbusiness.com. We answer within one month.

10. Cookies and similar technologies

We use a small number of cookies and similar browser storage technologies (localStorage, sessionStorage, IndexedDB), grouped into two categories:

• Strictly Necessary: session management, authentication, security, and recording your cookie banner choice. Required for the Service to function and cannot be disabled.
• Functional: remember your language preference, your referral code at sign-up, your last tab within a session, and a local cache of your inventory for offline use. Set only after you accept the cookie banner.

We do not use third-party advertising, social media trackers, or third-party analytics cookies. For a complete list of every cookie and localStorage item we use, with their names, purposes, durations and who sets them, see our Cookie Policy.

You can manage cookies through your browser settings. Disabling essential cookies will prevent the Service from functioning correctly, including sign-in.

11. Children's privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you become aware that a minor has provided personal data to us, please contact us and we will take steps to delete that data.

12. Security

We implement reasonable technical and organizational measures to protect your personal data, including encryption in transit (HTTPS), encryption at rest by our host, encryption of bank details by the Service itself (and, account by account, of collectors' contact details and the sales history), role-based access controls, and regular security reviews. No system is perfectly secure, however, and we cannot guarantee absolute security.

13. Changes to this policy

We may update this Privacy Policy from time to time. The "last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated to active users by email or through an in-app notice at least 30 days before they take effect.

14. Contact

For questions about this Privacy Policy, requests to exercise your rights, or general data protection inquiries, contact us at:

Artgence, Paris, France
support@artelierbusiness.com