Privacy Policy

The data controller for personal data collected through ArtyDrop is the Publisher of the service (the independent photographer operating the platform). To exercise your rights, contact us using the details in the Legal Notice.

We collect the following data:

• Account data (photographers): email address, full name, public profile information (bio, social links).
• Payment data: handled exclusively by Stripe. ArtyDrop never stores any banking details.
• Gallery viewing data: visit timestamp, device type (mobile/desktop), IP address (anonymized after processing).
• Browsing data: technical cookies needed for the service to work (session, authentication).

Your data is used to:

• Provide the photo gallery delivery service
• Manage photographer accounts and subscriptions
• Generate anonymous viewing statistics (for photographers)
• Keep the service secure and stable
• Meet our legal obligations

• Contract performance: for data needed to provide the service.
• Legitimate interest: for gallery-viewing statistics.
• Legal obligation: for retaining certain billing records.

• Account data: kept for as long as the account is active, then deleted within 30 days of a deletion request.
• Galleries and photos: deleted once the gallery expires, or after 90 days of inactivity on a deleted account.
• Viewing data: kept for 12 months.
• Billing data: 10 years (French legal requirement).

ArtyDrop relies on the following subprocessors, each bound by GDPR-compliant safeguards:

• Supabase (database and authentication): USA/EU, DPA available
• Cloudflare R2 (file storage): USA/EU, DPA available
• Stripe (payments): USA/EU, DPA available
• Vercel (hosting): USA, DPA available

Under the GDPR, you have the right to:

• Access: obtain a copy of your data
• Rectification: correct inaccurate data
• Erasure: request that your data be deleted
• Portability: receive your data in a structured format
• Object: object to certain uses of your data

To exercise these rights, contact us using the details in the Legal Notice. You can also file a complaint with CNIL, the French data protection authority (cnil.fr).

ArtyDrop uses two kinds of storage on your device:

• Strictly necessary (no consent required): session and authentication, so you can stay logged in and access galleries you're entitled to. The service can't function without these.
• Analytics (only with your consent, via the cookie banner): anonymous, cookieless usage statistics (Vercel Analytics) to understand how the site is used. No persistent identifier, no cross-site tracking, and it's never active until you accept.

We never use advertising or third-party tracking cookies. You can change your choice at any time via the "Cookie preferences" link in the footer.

We use appropriate technical and organizational measures to protect your data: encryption in transit (HTTPS), secure password storage (hashing), and restricted access to sensitive data.