What we hold, and what you can do about it.

Your account. An email address, a password we store only as a bcrypt hash, and a display name if you give one. Nothing else is required to sign in, bid, or win a lot.

Your bids. The amount, the lot and the time, plus the identifier of the Stripe authorisation behind it. Card numbers never reach this platform: the card form is Stripe’s own, the details go straight to Stripe, and all we ever hold is their reference to it.

Deliveries. When you win, the name, address and optional phone number you give for that delivery, and the tracking the carrier returns. The address is stored as a snapshot of what you gave at the time. You may also save one address as a default for the next win.

Artists. If you apply to sell, your application — name, medium, location, a short biography and a portfolio link — and, once approved, your payout account status from Stripe. We never see your bank details.

Records of what happened. Notifications sent to you, the money ledger for captures and refunds, and an audit line for every action an administrator takes on an account or a lot.

A lot page is public and it is meant to be a record. If you hold or have held a leading bid, your display name and the amount you bid can appear on that page, to anyone, including search engines, and it stays there after the lot closes. That permanence is the point of the co-ownership record — but it is your name, so it is your call.

You can turn it off. In your account there is a switch that replaces your name with “A collector” everywhere on the public site, retroactively and immediately. Bid amounts stay — the price history is the lot’s record, not yours — but nothing ties them to your name. If you never set a display name, nothing identifying you was ever published in the first place.

The artist you bought from receives your delivery name, address and phone number, because they pack and post the work themselves. Artists here are independent sellers, not our staff. They are told to use the address for that delivery and nothing else; if one contacts you for any other reason, tell us and we will act on it.

Stripe handles every card authorisation, capture and refund, and pays approved artists. EasyPost registers carrier tracking when a lot ships. Shopify runs the print shop and is the merchant of record for anything bought there — we receive only the order totals and which artist to credit, never the shop customer’s details. Our email provider sends the messages the platform owes you. Our host runs the servers and the database.

That is the whole list. We do not sell anything to anyone, we run no advertising, and we have no analytics or tracking product anywhere on this site.

One cookie, named session. It is set when you sign in, it holds a signed token identifying your account, it cannot be read by JavaScript, and it expires after 24 hours or when you sign out. Without it you cannot stay signed in, so there is nothing to consent to and nothing to turn off.

Two things are kept by your browser rather than by us: the shop remembers your cart with an identifier in local storage, and the site remembers that you have already seen the opening animation for the length of the tab session. Clearing your browser data removes both. There are no advertising or analytics cookies.

Delivery details — the address snapshot, the phone number and any message you sent about a delivery — are erased 365 days after that handover finishes. A scheduled job does it; it is not something anyone has to remember.

Your account is kept while it exists. Close it and the personal details go (see below).

Money and the record — captures, refunds, artist credits, bid amounts and the co-ownership record — are kept, because they are accounting records and the provenance of a physical artwork. After an account is closed they carry no name or address, only an internal number.

Everything below is self-serve in your account, not a request you have to send us and wait on:

• A copy of everything we hold about you, downloaded as one JSON file.
• Correct it — display name, email address, password, saved delivery address.
• Stop being named publicly, with the switch described above.
• Close your account. Your email, name, password, saved address and application are erased; the financial and provenance rows that must survive are detached from you first.

If something here does not do what you need, or you want to object to how we use something, get in touch — a person reads it, and we answer within 30 days.

Passwords are hashed with bcrypt and never stored or emailed in the clear. Sessions can be revoked, and changing your password signs out every other device immediately. The site is HTTPS-only. Card data never touches our servers.

We are a small operation, not a bank. If we ever discover a breach affecting your data, we will tell you what happened, what was in it and what we did — by email, to the address on your account.

When this notice changes, the date at the top changes with it. If a change affects what we collect or who receives it, we will tell you on the site before it takes effect rather than editing quietly.