Privacy Policy

At a glance

AI-ARTS uses personal information to provide accounts, creative and organisation workflows, publication choices, support and a secure service. We do not make private drafts or review materials public unless an authorised publication workflow does so.

• Optional analytics and external media depend on your privacy choices.
• You can ask about your information or exercise applicable rights through the contact route.
• The final controller legal name, legal form, address, registration details, named privacy contact and DPO position are pending legal approval and will be added before Production publication.

1. Scope and contact

This notice explains personal information handled through AI-ARTS, a platform supported by the Empirical Cultures framework. It covers visitors, artists, organisation members, applicants, reviewers and people who contact the service.

Privacy requests and questions can be submitted through the contact route. Please do not include more personal information than is needed to explain the request.

2. Information we handle

• Account and authentication: email address, name, authentication identifiers, identity-provider details, sign-in events, security state and Terms acceptance evidence.
• Profiles and organisations: artist profile, biography, links, images, organisation details, membership, roles, workspace applications and approval records.
• Creative and programme activity: works, media, captions, submissions, open-call responses, review decisions, gallery placements, publication records and rights information.
• Communications: contact-form content and support, safety, rights or takedown correspondence.
• Technical and security data: IP address, timestamps, request and device information, audit events, security challenge results, service logs and consent choices.

Information usually comes from you, an organisation workspace you participate in, an authentication provider you choose, or technical operation of the service. Some artist and programme records may originate in a documented legacy AI-ARTS import.

3. Purposes and legal grounds

We do not use agreement to the Terms as blanket privacy consent. Where consent is the legal ground, it is specific and can be withdrawn without affecting earlier lawful processing.

4. Publication and organisation roles

Profile or work information is public only where the relevant publication workflow makes it public. Drafts, private uploads and review materials remain restricted by account, workspace and role controls.

An arts organisation may determine why and how it handles applicant or reviewer information in its own programme. Its own notice and programme terms may therefore also apply. AI-ARTS will identify responsibilities in the relevant workflow where the allocation differs.

5. Service providers and disclosures

Information may be processed by:

• Supabase for authentication, database and storage services;
• Vercel for hosting and application delivery;
• Cloudflare for security challenges, network and media infrastructure, subject to Cloudflare's Turnstile Privacy Addendum;
• Google for optional Google sign-in;
• Google/YouTube when an authorised organisation publishes video or you choose to load a YouTube embed; and
• Google Analytics only after you opt into Analytics, for limited measurement of visits and page use without names, email addresses, artist slugs, artwork content or form values; and
• email delivery, monitoring or support providers only when those integrations are configured for the service.

We may also disclose information where required by law, to protect people or rights, or as part of a properly governed organisational change. AI-ARTS does not currently sell personal information or run cross-context behavioural advertising.

6. International processing

Some providers may process information outside the country where you live. Before a transfer requiring safeguards is approved, the operator will identify and document the applicable transfer mechanism, destination and any additional safeguards. The final transfer mechanism and safeguards will be confirmed before Production publication.

7. Retention

Information is kept only as long as needed for the purpose collected, account and programme commitments, security and dispute records, legal duties, or resilient backup cycles. Criteria include whether an account or programme is active, whether content is published, the sensitivity of the information and any unresolved claim or preservation duty. Deletion from backups may follow the normal protected backup cycle.

8. Your choices and rights

Depending on applicable law, you may ask for access, correction, deletion, restriction, portability or an explanation of processing; object to processing based on legitimate interests; withdraw consent; or complain to a data-protection authority. UK users may complain to the Information Commissioner’s Office.

We may need to verify identity and clarify scope. A request can be made through the contact route. Cookie choices can be changed at any time through the footer’s Cookie settings link. Browser Global Privacy Control signals are honoured for optional analytics and external media.

9. Security, children and changes

AI-ARTS uses appropriate technical and organisational safeguards, including role-based access, security monitoring and measures intended to prevent abuse. No internet service can promise absolute security.

The service is not presented as child-directed and we do not knowingly invite children to create accounts independently. Contact us if you believe a child’s information has been supplied inappropriately.

Material notice changes receive a new version and effective date. Where a change requires a fresh choice, the service will ask again rather than assuming agreement.