Privacy Policy

Who we are

Artycards ("we", "us") is a service run by [TRADER NAME], a sole trader based in the United Kingdom. We are the "data controller" for the personal data described here. You can reach us at [CONTACT EMAIL] or by post at [CONTACT ADDRESS], or through the contact page.

What we collect

• Account details — your name and email, via Google or email sign-in.
• Content you create — cards, messages and, for artists, uploaded artwork and profile details (bio, location, social links).
• Recipient details — if you send a card, the recipient's name and email, so we can deliver it.
• Order and payment records — what you bought, when, and the amount. Card details are handled by our payment provider; we don't see or store your full card number.
• Artist payout details — for artists we pay, bank details (account holder name, sort code and account number), used only to make payouts. These are visible only to you and the Artycards team, never on your public profile.
• Basic usage and security information needed to operate and protect the service.

How we use it, and our lawful basis

Under UK GDPR we rely on the following lawful bases:

• To provide the service — creating, building, sending and delivering cards; running artist galleries, profiles and payouts; managing your account. Basis: performance of a contract with you.
• To vet artists and keep the service safe — reviewing artist applications, preventing fraud and abuse, and keeping accounts secure. Basis: our legitimate interests in running a trustworthy platform.
• To meet our legal duties — keeping order, payment and payout records for tax and accounting. Basis: legal obligation.
• To respond to you — handling messages you send us. Basis: legitimate interests (and performance of a contract where it relates to your order).

How long we keep it

• Account and profile data — while your account is open. You can delete your cards yourself at any time; to delete your whole account, contact us, and we'll remove or anonymise your data within a reasonable period afterwards.
• Order, payment and payout records (including artist bank details) — kept for 6 years after the transaction, as UK tax and accounting law requires.
• Contact messages — kept for as long as needed to deal with your query and a reasonable period after.
• Declined artist applications — kept for a limited period, then deleted.

Where it's stored, and international transfers

Data is stored using Supabase (authentication, database and file storage) and the app is hosted on Vercel. Some of our providers — such as Supabase, Vercel, Google (sign-in) and our email provider — are based outside the UK or may process data internationally. Where personal data leaves the UK or EEA, it is protected by an adequacy decision or by Standard Contractual Clauses / the UK International Data Transfer Addendum.

Who we share it with

We don't sell your data. We share it only with the service providers who help us run Artycards — including Supabase (database, authentication and storage), Vercel (hosting), our email provider (to deliver cards and receipts) and our payment provider (to take payments and pay artists) — each bound by their own data-protection terms, and only ever where the law requires. Artist profile details (name, bio, location, social links and published art) are public by design once you're verified.

Your rights

Subject to applicable law (including UK/EU GDPR), you can:

• ask for a copy of the personal data we hold about you (access);
• have inaccurate data corrected (rectification);
• ask us to delete your data (erasure);
• ask us to restrict or object to certain processing;
• ask for a portable copy of data you gave us (portability);
• withdraw consent, where we rely on it.

To exercise any of these, contact us. You can delete your cards in your account; to delete your whole account, get in touch.

Complaints

If you're unhappy with how we've handled your data, please contact us first so we can put it right. You also have the right to complain to the UK's data-protection regulator, the Information Commissioner's Office, at ico.org.uk.

Children

Artycards isn't aimed at children. You must be 18 or over to create an account or buy a card. If we learn we've collected a child's personal data without appropriate consent, we'll delete it.

Cookies

We use only the storage needed to keep you signed in and remember your cookie choice — see the Cookie Policy.

Changes

We may update this policy; material changes will be reflected here with a new date.