Everyone
Privacy Notice
We collect as little as we can, keep it in London, and never sell it. This notice explains exactly what we do with personal data under UK GDPR and the Data Protection Act 2018.
Draft for review by a qualified solicitor before launch.
01Who we are
Lovalty Ltd, registered in England and Wales, is the controller of your personal data for Lovalty Art. Contact us about privacy at privacy@lovalty.com.
02What we collect
Artists: the email addresses you sign in with, and your sign-in identity from Instagram, Google or Apple if you use one (see Signing in); your legal and display name, date of birth, email, mobile number, seller type and business or VAT details; your profile, artworks and photos; your plan, payout status and sales; the language you'd like emails in; and any thank-you notes you send buyers.
Buyers: your name, email and, if you give it, phone number; what you bought, and whether you added a thank-you for the venue; your browser's language, so we write to you in it; payment confirmation from Stripe. We never receive your full card details.
Guests at private views: if you email us to request an invitation or RSVP, your email and what you tell us.
Visitors: if you tap the heart on a work, a random identifier stored in a cookie so we can remember it. Like any website, our servers receive your IP address; we store it only in hashed form, briefly, to prevent abuse.
We strip location and camera data from every photo you upload before it's stored or shown.
03Signing in with Instagram, Google or Apple
Artists sign in without a password: with a one-time code we email to any address they choose (a university address works), or with Instagram, Google or Apple. Email sign-in uses only that address. You can add several emails and providers to one account and remove them in Profile → Sign-in methods. With a provider, nothing is shared until you approve it on the provider's own screen, and we ask each one for the minimum it offers:
| Provider | What we ask for and receive | What we never receive or do |
|---|---|---|
| The openid, email and profile scopes only: your Google account ID, name, email address (and whether Google has verified it) and profile picture | No access to Gmail, Drive, Calendar, Contacts or any other Google data. We never post or act on your behalf. | |
| Instagram (Meta) | Instagram Login with the instagram_business_basic permission only: your Instagram account ID, username, name and profile picture | No access to your posts, messages, followers, insights or comments. We never post, message or act on your behalf. Instagram Login needs a professional (Creator or Business) account. |
| Apple | Sign in with Apple: your Apple account identifier, an email address (often a private relay address that forwards to you) and your name, which Apple shares only the first time | Nothing else from your Apple account. Emails to a relay address go through Apple's relay. |
How we use it. To create and sign in to your artist account; to pre-fill your name and email during setup (we still confirm your email and phone with a code); and, if you don't upload one, to show your profile picture on your listings, from a copy we store. We link your account to the provider's account ID, never to your email address.
What we keep. The provider's account ID, plus the profile details above as part of your account. We use the access token once, to fetch those details, and then discard it: we hold no ongoing access to your Instagram, Google or Apple account.
Google user data. Lovalty Art's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide sign-in and your account; we don't sell it, use it for advertising, use it to train AI or machine-learning models, or let people read it except with your permission, for security, or where the law requires.
Data from Meta. Data we receive through Instagram Login is used only to sign you in and set up your account, as Meta's Platform Terms require. We don't sell or license it, use it for advertising or profiling, or share it except with the service providers listed below.
Disconnecting and deletion. You can remove Lovalty Art from your Instagram, Google or Apple settings at any time; this stops us receiving anything more. To delete what we hold, see Deleting your data.
04Why we use it, and our lawful bases
We only use personal data where UK GDPR gives us a lawful basis. Here's each purpose and the basis we rely on.
| Purpose | Data | Lawful basis |
|---|---|---|
| Running your studio and listings | Account, profile, artwork details | Contract (Art. 6(1)(b)) |
| Confirming you're 18+ and who you are | Legal name, date of birth, seller type | Contract; legitimate interests in preventing fraud |
| Verifying email and phone | Email, phone, one-time codes | Contract; legitimate interests in account security |
| Selling a work and arranging collection | Buyer name, email, phone; order details | Contract |
| Paying artists and charging fees | Payout status, Stripe account reference, sale amounts | Contract |
| Tax and accounting records | Orders, invoices, payouts, VAT details | Legal obligation (Art. 6(1)(c)) |
| Keeping the service secure | Hashed IP addresses, session records, audit logs | Legitimate interests in security and fraud prevention |
| Remembering the works you love | A random device identifier (hashed) | Legitimate interests; strictly necessary to provide the feature you asked for |
| Passing on an artist's thank-you note, or an invitation request for a private view | Name, email, the message | Legitimate interests in the relationship you started; you can ask us to stop |
| News about new work and events | Email address | Consent (Art. 6(1)(a)) — withdraw any time |
Where we rely on legitimate interests, we've weighed them against your rights: the data is limited, expected in context, and never used for advertising or profiling. You can object at any time.
05What we don't do
- We don't sell or rent personal data.
- We don't run advertising trackers, analytics cookies or cross-site profiling.
- Our emails contain no tracking pixels or tracked links, and our pages and emails load fonts and images only from our own domain.
- We don't use your data, or data from Instagram, Google or Apple, to train AI or machine-learning models.
- We don't make decisions about you based solely on automated processing.
- We don't send marketing unless you've opted in.
07What's public
On a work's page we show the artist's display name, picture, bio, city and any Instagram or website links they add. Buyers' details are never public. Artists see only a buyer's first name and initial.
08International transfers
Our database, files and servers are in London. Where a provider processes data outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum, with additional safeguards where needed.
09How long we keep it
| Data | How long | Why |
|---|---|---|
| Artist account and profile | Life of the account + 30 days | To provide the service and handle closing queries |
| Orders, invoices, payouts | 6 years after the end of the tax year | HMRC record-keeping requirements |
| Verification codes | 10 minutes | They expire; only a keyed hash is ever stored |
| Sign-in sessions | Up to 30 days (14 days if inactive) | Keeping you signed in securely |
| Rate-limit records | Up to 1 day | Preventing abuse |
| Love records | Until you clear them or the work is archived | Remembering what you loved |
| Data from Instagram, Google or Apple | Life of the account; deleted within 30 days of closing it | Signing you in; the access token itself is never kept |
| Email delivery records | 30 days | Which email went to which account and whether it was delivered; never the email's content |
| Thank-you notes | With the order record | So the sale's history is complete |
| Invitation requests and RSVPs | Up to 12 months | Planning future evenings |
| Backups | Up to 14 weeks | Disaster recovery; then overwritten |
10How we protect it
- Encryption in transit (TLS) and at rest, on infrastructure in London.
- Least-privilege access: our app's database access is limited to what it needs; staff access requires multi-factor authentication and is logged.
- Personal details are stored separately from public profile data.
- Verification codes and session tokens are stored only as keyed or one-way hashes.
- Audit logs record administrative actions, and data access is logged.
No system is perfectly secure. If a breach risks your rights, we'll tell you and the ICO as the law requires.
11Your rights
You have the right to access your data, to have it corrected, to have it erased, to restrict or object to how we use it, and to data portability. Where we rely on consent, you can withdraw it at any time.
Artists can download their data or delete their account in the studio under Profile → Privacy; Deleting your data explains each route, including data from Instagram, Google or Apple. Anyone can email privacy@lovalty.com. We respond within one month. Some records, such as sales, must be kept for tax law even after erasure.
12Complaints
Please talk to us first. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk or on 0303 123 1113.
13Children
Artist accounts are for people aged 18 and over. Lovalty Art is not directed at children, and we don't knowingly collect their data.
14Changes to this notice
We'll update this notice when our practices change and show the new version date at the top. Material changes will be flagged in the studio.