Privacy Policy

At a glance

We use personal information to provide your account, manage artwork submissions and programmes, publish material through the choices and processes explained to you, respond to enquiries and keep the service secure.

• Uploading a work does not, by itself, make private submissions or review materials public.
• Optional newsletters, analytics and external media have separate preferences.
• You can contact us about your information or exercise your privacy rights using the details below.

1. Who we are and how to contact us

AI-ARTS.ORG is operated by Empirical Cultures Ltd. For the operation of AI-ARTS accounts, platform administration, security and our own community communications, Empirical Cultures Ltd is the data controller. This means it decides why and how personal information is used for those activities.

Empirical Cultures develops cultural technology and supports the infrastructure behind AI-ARTS.ORG. This policy covers the AI-ARTS public website at ai-arts.org and the platform at platform.ai-arts.org, including visitors, artists, subscribers, organisation members, applicants, reviewers and people who contact us.

In this policy, “we”, “us” and “our” refer to Empirical Cultures Ltd in its role operating AI-ARTS.ORG. An organisation running its own competition or programme may have separate responsibilities, explained in section 4.

Empirical Cultures' wider research activities do not themselves authorise separate use of your personal information. If we introduce another purpose for using your information, we will explain that purpose and its legal basis before the new use begins, and request consent where required.

2. Information we handle

• Accounts: name, email address, account and authentication identifiers, sign-in records, security information and records of acceptance of the Terms.
• Profiles and organisations: biography, links, images, organisation details, membership, roles, applications and approval records.
• Artworks and programmes: uploaded media, descriptions, process information, submissions, review decisions, gallery placements, publication records and rights information. These may contain personal information about you or other people.
• Communications: enquiries, support correspondence, submission and review messages, newsletter preferences, and records of consent or withdrawal.
• Technical information: IP addresses, device and browser information, timestamps, security checks, service and audit logs, and cookie or other privacy preferences.

We receive information directly from you, through your use of the service, from the sign-in provider you choose, or from an organisation managing a programme in which you participate. Existing artist, artwork and subscription records may also come from the previous AI-ARTS website and its associated mailing list. A migration does not, by itself, create new marketing consent.

3. Why we use information and our legal grounds

Accepting our Terms is not blanket consent to newsletters, analytics or unrelated uses of your information. Where we rely on consent, you can withdraw it without affecting the lawfulness of earlier processing.

Email communications

We distinguish messages needed to provide a service you have requested, such as account security, submission confirmations and review outcomes, from optional newsletters and promotional announcements.

You can manage optional email preferences in Notification preferences. You can also unsubscribe from promotional emails using the link in those messages, without signing in, or by contacting us. Declining promotional emails does not prevent necessary account, security or service messages.

If you subscribed through the previous website, we may ask you to confirm your preferences when you return. Previous withdrawals remain respected unless you actively subscribe again. We retain the limited preference records needed to honour your choices.

4. Publication and organisation responsibilities

Profiles and artwork information become public through the relevant publication settings or programme process. Drafts, private uploads and review materials remain restricted to people authorised to access them for the relevant purpose.

When you submit to a competition or programme run by another organisation, its authorised organisers and reviewers may receive the information needed to assess and administer your submission. That organisation may be a separate controller for its programme and should explain its use of your information in its own privacy notice.

Where Empirical Cultures Ltd handles programme information solely on an organisation's instructions, its role for that processing is that of a processor. Its separate responsibilities for operating and securing the wider platform remain as described above. Any different allocation of responsibilities will be explained for the relevant programme.

5. Service providers and disclosures

We use providers to deliver the platform. Depending on the features used, these include:

• Supabase for authentication, database and storage services.
• Vercel for hosting and application delivery.
• Cloudflare for security challenges, network and media infrastructure.
• Google for optional Google sign-in.
• Google/YouTube when an authorised organisation publishes video or you choose to load a YouTube embed.
• Google Analytics after you opt into Analytics. Measurement is limited to visits and page use; we do not send names, email addresses, artist slugs, artwork content or form values to Google Analytics.
• Email delivery, monitoring and support providers where used to deliver those services.

Providers acting on our behalf must process information for the agreed service under applicable data-processing and security requirements. Other providers may have their own responsibilities for information they collect when you use their services.

We may also disclose information when required by law, to protect people or legal rights, or as part of an organisational change with appropriate protections. We do not sell personal information or use it for advertising that tracks you across unrelated services.

Public artwork ratings

To prevent repeated anonymous artwork ratings, AI-ARTS uses the network address supplied by our hosting provider only on the server. We do not store or log that raw address. We convert it into a rating-specific daily protected value and keep that value for no more than 48 hours. Non-identifying rating totals are retained so the public average and count remain accurate.

These limits are approximate: shared networks can affect the limit, and changes of network address can affect its operation. Cloudflare Turnstile also helps protect the service. Other technical and security processing is described in sections 2, 3 and 5.

6. International processing

Our providers may process personal information outside the United Kingdom or the country where you live, including through hosting, support or subcontracted services.

Where a transfer is restricted under applicable data-protection law, it must be covered by a recognised transfer mechanism. This may be an adequacy decision recognising the protection provided in the destination country, appropriate contractual safeguards, or another permitted legal mechanism.

Contractual safeguards can include the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses. Where EU data-protection law applies, the corresponding EU transfer requirements also apply. The protection required depends on the destination, the recipient and the processing involved.

You can request further information about the protections applying to your information, including a copy of relevant safeguards where applicable, by contacting us using the details in section 1.

7. How long we keep information

We keep personal information only for as long as needed for the purposes described in this policy or to meet legal requirements. The period depends on whether an account or programme remains active, the nature and sensitivity of the information, publication choices, unresolved enquiries or disputes, security needs and backup arrangements.

Account closure or a removal request may not require immediate deletion of every record. Limited records may still be needed for legal obligations, security, disputes or to honour communication preferences. Copies in backups are removed through the applicable backup cycle. The separate 48-hour limit for protected rating values is described in section 5.

8. Your choices and rights

Depending on the applicable law and the legal ground for processing, you may ask to access or correct your personal information, request deletion or restricted use, receive a portable copy of certain information, or withdraw consent.

You can object to our use of your personal information for direct marketing at any time. You may also object to processing based on legitimate interests, taking account of your circumstances.

Use Notification preferences to manage optional emails, or the unsubscribe link in promotional messages. Cookie choices can be changed using the website's Cookie settings control. Browser Global Privacy Control signals are honoured for optional analytics and external media.

For other requests, use our contact form or email contact@empirical.org.uk. We may need to verify your identity or clarify your request. Please send only the information needed to explain it.

You can complain to the UK Information Commissioner's Office or, where applicable, the data-protection authority in your country. You do not have to contact us first, although we welcome the opportunity to resolve a concern.

9. Security, children and policy changes

We use appropriate technical and organisational measures, including access restrictions, role-based permissions and security monitoring, to protect personal information. No online service can guarantee complete security.

The service is not directed at children, and we do not knowingly invite children to create accounts independently. Please contact us if you believe a child's information has been provided inappropriately.

We update this policy when our services or use of information change. The date of the latest update appears at the top. We will bring material changes to your attention as appropriate and obtain a fresh choice where required.