Privacy policy

Art.Industries helps art businesses manage records, relationships, publishing, and sales. This policy explains how mutant devices LLC, a Delaware limited liability company in the United States (Art.Industries, “we”, “us”), handles personal information across our website, applications, support, and related services. It also explains when a workspace customer is responsible for your information.

1. Who is responsible for your information

Our own operations. We are responsible as controller for personal information used to run Art.Industries accounts, subscriptions, support, security, and our own product and website analytics. Contact support@art.industries. Our registered-agent details appear in our Terms.

A customer's workspace and audience. A gallery, artist, institution, or other customer decides which contacts and records to add, who can access them, what to publish, and whom to contact. For information we handle on that customer's behalf, the customer is generally the controller and we act as its processor. This includes information submitted to a customer's site, viewing room, mailing list, application, or checkout. The customer's privacy notice explains its purposes and choices. Our platform responsibilities remain separate from the customer's responsibilities for its records and audiences.

If your request concerns a customer relationship, contact that business first. If you cannot identify it, send us the relevant website or message so we can help route your request without disclosing private workspace data.

2. Information the service handles

• Accounts and collaboration: names, email addresses, authentication records, workspace membership, roles, preferences, invitations, and activity associated with an account.
• Workspace records: contact details, correspondence and notes, collection and inventory records, photographs and files, transaction documents, and content prepared for websites, rooms, applications, and emails. Customers supply this information directly, through imports, or through features they publish.
• Transactions and requests: billing and delivery details, orders, invoices, payment status, inquiries, subscriptions, applications, and related records. Stripe processes payment details through its payment interfaces; we receive the payment identifiers and transaction information needed for the relevant feature.
• Support and assisted work: messages, attachments, source files, and instructions you provide when requesting help or an assisted import.
• Technical and usage information: IP addresses, browser and device information, referring pages, requested pages, interaction events, timestamps, error reports, and session or device identifiers.

Information can come from you, the workspace that invited or recorded you, other authorized workspace users, public forms, and payment or email-delivery events. A business contact or an identifiable person in an artwork record is still personal information. Include only information you are entitled to provide and that the task needs.

3. What we use information for

We use information to authenticate users, operate workspaces and requested features, deliver files and published content, administer subscriptions, handle payments and support, detect abuse, investigate failures, and meet legal obligations. Customer instructions determine the use of customer-controlled records, including publication and email delivery.

We also use first-party usage information to understand which pages and features people use and improve the service. A random visitor identifier can be linked to an account after sign-in; it should not be understood as anonymous data. Customer sites and rooms can record visits and content interactions. Emails and shared offers can record delivery, opens, and link clicks. The Cookie notice explains the distinction between operational storage, basic measurement, and additional visitor analytics.

Where European data-protection law applies, relevant legal bases include performing a contract with you, legitimate interests in administering business relationships and protecting the service, legal duties such as accounting and responding to lawful requests, and consent for activities that require it. A contract with your employer is not itself a contract with you. Legitimate interests do not override applicable consent requirements or your rights. A workspace customer must identify its own legal bases for its contacts and communications.

4. Providers, workspace access, and publication

We use Amazon Web Services (AWS) to host the service, store and deliver files and published content; Amazon Simple Email Service (SES) to transport account and customer emails and return delivery events; and Stripe to process platform payments and payments through supported commerce features. These providers receive information needed for their functions. Stripe also has its own responsibilities for payment processing under its privacy notice. Provider processing is distinct from publishing your content.

Some marketing and account pages load typefaces through Google Fonts, which involves a browser connection to Google to retrieve those assets. Where Google Ads measurement is configured, the page can also send advertising attribution and conversion information to Google. These browser services are separate from our first-party product measurement. See the Cookie notice for the technologies and available controls.

Authorized workspace users can access records according to their permissions. Publishing a page, sharing a room, sending a message, or exporting a file makes selected information available to the audience you choose. Public content can be copied or indexed outside the service; removing it here does not retrieve copies others already hold. A customer's own links or embedded external content can also take visitors to services with separate privacy practices.

We may disclose information where necessary to respond to a valid legal requirement, investigate abuse, protect legal rights, obtain professional advice, or carry out a business transfer, subject to applicable law. Contact us for information about the providers and processing arrangements relevant to your workspace.

5. Retention, deletion, and security

Retention depends on the information and its purpose: the customer's instructions, whether an account or service remains active, outstanding transactions, security investigations, legal claims, and required financial or other records. Archiving a record, cancelling renewal, and deleting an account are different actions. None should be assumed to erase every related record immediately. Backups, transaction records, and copies already exported or received by another person can have separate retention requirements.

Contact us about deletion or the retention of a particular category. We may need to retain information for a lawful purpose even when a related service ends. Authentication, access permissions, and secured file-delivery mechanisms help protect information, but no service can guarantee that every loss or unauthorized access will be prevented. Report suspected account misuse promptly; do not send passwords or full payment-card details to support.

6. International processing

Art.Industries is operated by a United States company. Our infrastructure and providers can process information in the United States and other countries, which may have different data-protection laws from your country. A hosting location does not establish the location of every support or provider activity. Contact us for details of the locations and contractual arrangements relevant to your workspace, including any international-transfer safeguards that apply.

7. Your rights and choices

Depending on applicable law, you may be entitled to access or correct information, request deletion or a portable copy, restrict or object to processing, withdraw consent, and exercise rights concerning automated decisions. Where local law provides an appeal or authorized-agent process, you may use it. Withdrawal does not change the lawfulness of processing carried out before it. Some rights have legal exceptions, including required recordkeeping and the rights of other people.

For information we control, email support@art.industries with enough context to identify your request. We may ask for proportionate identity or authority verification; do not send identity documents unless requested. For customer-controlled information, we assist the responsible customer rather than changing its records without authority. You may complain to the relevant data-protection regulator without first contacting us. Exercising an applicable privacy right does not remove your protections against unlawful discrimination.

Use the unsubscribe or preference link in a marketing message to change the relevant subscriptions. An unsubscribe does not erase transaction records or stop necessary account, security, or service messages. Browser and visitor analytics choices are described in the Cookie notice.

8. Children and sensitive information

Art.Industries workspace tools are designed for professional use, rather than for children. Customers control the audiences and content of their own sites, events, and forms. If you believe a child has provided information inappropriately, contact the relevant customer or us. Do not use the service to collect sensitive information without the permissions, protections, and lawful basis the circumstances require.

9. Questions and changes

Send privacy questions to support@art.industries. Include the relevant workspace, website, or message where possible, without adding unnecessary personal information. We will update this policy when our practices change and identify the revised date. Where law requires additional notice or a new choice, an update to this page does not replace that requirement.