Privacy notice

1. Controller and contact

The controller for the development pilot is Edward Stewart / Augyart, Finland. Privacy and sales enquiries can be sent to stewart.eddie@gmail.com. A postal contact address can be provided when needed for an order, legal request or return without publishing a private home address to every visitor.

2. Data we process

• Account information, such as email address, authentication identifiers, display name and access role.
• Artist, artwork, exhibition and profile information supplied for publication.
• Saved works, inquiries, feedback and communications submitted through the service.
• For completed purchases: artwork, amount, order references, payer email, delivery name and delivery address received from PayPal. Augyart does not receive full card or bank credentials.
• Limited technical and security records, plus optional anonymous audience events such as page type and direct/internal/external referrer category.

3. Purposes and legal bases

• To provide accounts, profiles, saved items and requested platform functions: performance of a contract or steps requested before a contract.
• To create, verify and fulfill artwork orders and keep required records: contract and legal obligations.
• To protect the pilot, prevent duplicate or abusive activity and improve reliability: legitimate interests, balanced against user rights.
• To measure anonymous audience interactions: consent. Optional measurement is off until the visitor accepts it.
• To publish artist and artwork material: contract, legitimate interests or consent, depending on the relationship and material.

4. Recipients and access

Data is shared only as needed with service providers supporting hosting, authentication, storage and payments, currently including Vercel, Supabase and PayPal. A completed buyer’s delivery details are restricted to the selling studio’s owners/admins and authorised Augyart owners/admins.

Personal data may be disclosed where law requires it or where necessary to establish, exercise or defend legal claims. It is not sold for advertising.

5. International processing

Some providers may process data outside Finland or the European Economic Area. Where GDPR requires it, Augyart relies on an adequacy decision, approved contractual safeguards or another lawful transfer mechanism supplied by the provider.

6. Retention

Data is kept only for as long as needed for its purpose. Account data is retained while the account remains active; inquiries and unsuccessful checkout records are kept only while needed for follow-up, security and troubleshooting; completed-order and accounting records are retained for statutory accounting, tax and claims periods. Backups expire on their normal secure rotation.

7. Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, portability or object to processing, and may withdraw consent without affecting earlier lawful processing. Identity may need to be verified before a request is fulfilled.

You may complain to the Office of the Data Protection Ombudsman in Finland or another competent EEA supervisory authority.

8. Security and updates

Augyart uses role-based access, private storage, encrypted connections and payment-provider checkout. No online system can promise absolute security. Material privacy changes will be dated and presented before they affect a new purpose or consent choice.