Your information,
handled with care.

01 / Who is responsible

Data controller

ArtFeatures.com is responsible for the processing described here. Privacy requests can be sent to hello@artfeatures.com.

02 / What we collect

Information you provide

We process account identity and sign-in details, followed and saved content, artist audience campaigns, profile submissions, private contact details, uploaded images and rights information, correspondence, inquiry details, and newsletter subscription records. We also retain limited security records such as hashed network identifiers, sign-in events, and session information.

03 / Why we use it

Purposes and legal grounds

Account information is used to provide collector features such as following artists and to provide the requested artist workspace and editorial review service. When you follow an artist by email, the confirmation link follows that artist and creates a private collector account only if the address is not already registered. Security records support the legitimate interest of protecting accounts and the platform. Inquiry information is used with the sender’s consent to review and, where appropriate, forward a message. Newsletter email addresses and consent evidence are used only after explicit consent and email confirmation; consent can be withdrawn at any time through the unsubscribe link. Certain records may also be retained to meet legal obligations or establish, exercise, or defend legal claims.

04 / Service providers

Where information goes

Authorised ArtFeatures editors can access information needed for editorial and support work. Google Workspace is used for email delivery, and Cloudflare Turnstile helps prevent automated abuse. Technical hosting and storage providers may process information only to operate the service. Artist inquiries are forwarded to the relevant artist or representative only after editorial approval.

05 / Retention

How long we keep it

• Unverified registrations: 14 days.
• Unconfirmed newsletter requests: 14 days.
• Expired verification and password-reset tokens: 7 days.
• Email-follow confirmation requests: unconfirmed requests for no more than 14 days; confirmed records and expired tokens are removed after 7 days.
• Login and public rate-limit records: 30 days.
• Unused private uploads and abandoned drafts: 12 months.
• Withdrawn or rejected submission records: 24 months, then anonymised.
• Inquiry records, including spam and closed, replied, or forwarded inquiries: no automatic expiry.
• Workflow-email content and anonymised account-security history: no automatic expiry.
• Confirmed newsletter subscriptions: until unsubscribe; unsubscribe suppression records have no automatic expiry.
• Published editorial content: until editorial removal or archiving.
• Named audience campaigns and their aggregate daily visit, follow, and new-account totals: until the account is deleted.
• Personal recap snapshots and optional public sharing links: until sharing is disabled or the account is deleted.

“No automatic expiry” does not prevent deletion or redaction where a valid privacy request or legal requirement applies.

06 / Account deletion

Three-month cancellation period

An artist account holder can request deletion in Account Settings. After email confirmation, sign-in is disabled immediately. Final deletion occurs three months later unless the holder uses the emailed cancellation link. Published editorial material may remain as an editorial record, while account-linked private information is removed or reviewed separately.

07 / Your choices

Your data rights

Depending on the circumstances, you may request access, correction, deletion, restriction, objection, or portability, and may withdraw consent without affecting earlier processing. Artist-account holders can download a machine-readable copy of their data from Account Settings. You may also complain to your local data-protection authority.

Contact us about privacy →

08 / Cookies and security

Essential technology

ArtFeatures uses essential cookies for sign-in, form security, and session protection. These are not advertising cookies. Audience measurement—including campaign reporting—is first-party and aggregate only: daily counters contain no cookies, visitor or session identifiers, IP addresses, user agents, referrers, search phrases, or device fingerprints. Do Not Track and Global Privacy Control signals are honoured. Newsletter messages contain no tracking pixels and links are not rewritten for click tracking. Reasonable technical and organisational safeguards are used, but no online service can guarantee absolute security.