Privacy Policy | ARTISAN

1. Who we are

ARTISAN (“ARTISAN”, “we”, “us”) is an online marketplace at artasin.in where independent artists list original artwork for sale and accept custom commissions. The site is operated as a sole proprietorship by Aniruddha Wankhade.

For any privacy question, data request, or complaint, contact our Grievance Officer at support@artasin.in. We aim to acknowledge requests within 72 hours and resolve them within 30 days.

[PLACEHOLDER — add your business address and Grievance Officer name here. Indian e-commerce and IT rules require both to be published.]

2. What we collect

We only collect what the marketplace actually needs to work.

Information you give us

Account details — your first and last name, email address, and password. Passwords are stored only as a bcrypt hash; we never store or see your actual password.
Google Sign-In — if you sign in with Google, we receive your Google account ID, name, and verified email address. We do not receive your Google password, contacts, or any other Google data.
Shipping details — the name, postal address, and any phone number you enter at checkout, so an artist can ship your purchase.
Artist profile — if you sell on ARTISAN: your display name, studio URL, bio, discipline, location, and website.
Listings and uploads — artwork titles, descriptions, prices, and images you upload.
Commission briefs — the requirements, budget, timeline, and any reference images you submit with a commission request.
Messages and meetings — messages you exchange with an artist or buyer on a commission thread, and meeting times you schedule.
Reviews — the star rating and any written comment you leave after a delivered order. Reviews are public and display your first name and last initial.

Information we generate

Order records — what was bought, from whom, for how much, the platform commission and artist payout, order status, and any dispute or refund.
Server logs — our hosting provider records standard technical data such as IP address, browser type, and requested pages for security and reliability purposes.

What we do not collect

We do not run advertising or analytics trackers. There is no Google Analytics, no advertising pixel, and no third-party behavioural tracking on this site.
We do not collect payment card numbers. When card payments are enabled, they will be handled entirely by a PCI-compliant payment processor and card details will never reach our servers.
We do not sell, rent, or trade your personal data to anyone, ever.

3. Cookies

We use only strictly necessary cookies. We do not use advertising, analytics, or cross-site tracking cookies, so there is no cookie banner to click through.

artisan_session — keeps you signed in. It is an HttpOnly, SameSite=Lax cookie holding a signed session token, and expires after 7 days.
g_oauth_state and g_oauth_redirect — set only while you are signing in with Google, to protect against cross-site request forgery and to return you to the right page. Both expire after 10 minutes and are deleted as soon as sign-in completes.

4. Why we use your data

To create and secure your account, and to keep you signed in.
To list, display, and sell artwork, and to run the commission workflow.
To process orders — which means sharing your shipping details with the artist fulfilling your order, and sharing your name with a buyer when you sell to them.
To send transactional email you would expect: order confirmations, shipping and delivery updates, commission quotes and status changes, dispute outcomes, and artist verification decisions. These are service messages, not marketing. We do not send marketing email.
To verify artists before their work goes on sale, as a trust and safety measure.
To investigate disputes, prevent fraud and abuse, and comply with legal obligations.

5. Who we share it with

We share personal data only with the service providers that make the marketplace function, and only to the extent each one needs:

Other users— buyers’ shipping and contact details are shared with the artist fulfilling their order; artists’ public profile, listings, and reviews are visible to everyone.
Vercel — website and application hosting.
Neon — the managed PostgreSQL database where account, order, and listing data is stored.
Cloudinary — storage and delivery of uploaded artwork and reference images.
Resend (which delivers via Amazon SES) — sending the transactional emails described above.
Google — only if you choose to sign in with Google.
Payment processor — when card payments are enabled, a PCI-compliant processor will handle the transaction directly.

We may also disclose data where we are legally required to, or where it is necessary to establish, exercise, or defend a legal claim.

6. Where your data is stored

Our database and hosting are located outside India (primarily in the United States), and our email provider delivers through infrastructure in the Asia-Pacific region. By using ARTISAN you understand that your personal data is transferred to and stored on servers outside India. We choose established providers that maintain appropriate technical and organisational safeguards.

7. How long we keep it

Account data — for as long as your account exists. If you ask us to delete your account, we remove your personal data within 30 days.
Order and transaction records — retained after account deletion where we are required to keep them for tax, accounting, or legal purposes.
Reviews — remain published after account deletion, but are anonymised.
OAuth cookies — minutes. Session cookies — 7 days.

8. Your rights

Under India’s Digital Personal Data Protection Act, 2023, and comparable laws elsewhere, you have the right to:

Access the personal data we hold about you and know who we have shared it with.
Correct or complete inaccurate or incomplete data.
Request erasure of your data, subject to the retention rules above.
Withdraw consent at any time, including by deleting your account.
Nominate another person to exercise your rights in the event of death or incapacity.
Raise a grievance with us, and escalate to the Data Protection Board of India if you are not satisfied with our response.

To exercise any of these, email support@artasin.in from the address on your account.

9. Security

The site is served over HTTPS. Passwords are hashed with bcrypt, sessions are signed JSON Web Tokens held in HttpOnly cookies that JavaScript cannot read, and access to studio, order, and admin pages is checked both at the edge and again against the database on every request. No system is perfectly secure, but we take these measures seriously and will notify affected users and the relevant authority if a breach puts your data at risk.

10. Children

ARTISAN is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

If we change this policy we will update the date at the top of this page, and for significant changes we will notify you by email or with a notice on the site.