Privacy policy

1. Who processes the data

The controller of personal data is the operator of BeyondFrames, OÜ Küberloome (registry code 14206225, address Kolde tn 6/1, Tabasalu, Harku Parish, 76901 Harju County, Estonia). For anything about your data, write to info@beyondframes.art.

The platform, database, images and voice chat server run on a server of Zone Media OÜ in Estonia. Data is not transferred outside the European Economic Area, except push notifications, which travel through your browser's notification service (see below).

2. What we collect

• Account: email, name, account type (creator or collector), your password only as a hash (the password itself is never stored and nobody can see it), settings (such as the theme) and who may write to you.
• Artist profile, if you fill it in: role, location, year you started, biography, portrait and works (image, title, year, medium, size, description, availability and price).
• The Studio House: works shared from the studio, notes, follows, private messages, blocks, reports to the operator, events, invitations and attendance, shared canvases, favourite votes in challenges and notifications.
• Auctions: auctions you run, bids (amount and time), auctions you watch, the winner and the final price.
• Enquiries about works: name, email, message and the work, and the conversation that follows. Someone without an account gets a private link to the conversation.
• Push notifications, if you turn them on: your device's notification address and its encryption keys.
• Voice chat: audio travels between participants through our own server and is not recorded. While you are in a room, others see your name and portrait.
• Statistics for artists: daily totals (profile views, works opened, auction views). Nothing is stored about the viewer and bots are not counted.
• Technical data: server logs (IP address, time, the address opened and the browser) for security and finding faults. To limit repeated login attempts and enquiries, IP addresses are kept briefly in the server's memory only.

Location, camera and other metadata (EXIF, XMP) is removed from uploaded images before they are published.

3. Why and on what basis

• To provide the service you signed up for: account, profile, the Studio House, messages, enquiries and auctions.
• Legitimate interest: security, preventing abuse and moderation, backups and statistics for artists about their own page.
• Consent: push notifications. You can withdraw consent at any time by turning notifications off.
• Legal obligation, where the law requires us to keep or disclose data.

4. Who can see what

• Everyone: approved artist profiles and works, and auctions. On an auction the amounts and times of bids are public, but bidders are anonymous (“Bidder 1”, “Bidder 2” and so on).
• Signed-in members: the Studio House, meaning members' doors, community works, notes and events. Invitation-only events are visible to those invited. Collectors are not shown in the member list.
• Only those involved: private messages and enquiries. The artist sees the name and email of the person enquiring. When an auction ends, the winner and the artist see each other's name and email.
• The operator approves profiles, shared works and auctions, and sees reports and the content reported. As the server administrator the operator has technical access to the database but does not read private messages without a reason.
• Service providers: Zone Media OÜ (server). Push notifications travel through your browser's notification service (such as Google, Apple or Mozilla); their content is encrypted. Email to info@beyondframes.art goes through our email provider.

Data is never sold or shared for advertising.

5. Cookies and what is stored on your device

• A login cookie (valid for 30 days) and an operator cookie (12 hours). They are needed for the platform to work and do not require consent.
• Your browser keeps your settings: theme, frame colour, motion and other preferences, studio level, the unfinished work in the studio and your place in the Studio House corridor (for that tab only). They never leave your device.
• The platform's app (service worker) keeps public pages on your device so the site works on a weak connection.

There are no tracking or advertising cookies.

6. How long we keep data

• Your account and everything linked to it: until you delete the account. Deleting it removes your profile, works, images, messages, notes, bids, auctions and everything else you created. If you won an auction, the auction stays with the artist without your name.
• Enquiries: until the artist's account is deleted or until you ask us to delete them.
• Server logs: up to 14 days.
• Backups: the database, images and settings are backed up every night. The server keeps the last 14 nights and 8 weeks, the operator's computer up to 90 days. Deleted data disappears from backups as they expire.
• Push subscription: until you turn notifications off or the notification service invalidates it.

7. Your rights

• To see your data and get a copy of it in a machine-readable format.
• To correct your data. You can change most of it yourself in your account settings.
• To delete your account and data: “Delete account” in your account settings.
• To restrict processing or object to processing based on legitimate interest.
• To withdraw consent (push notifications).

Write to info@beyondframes.art and we will reply within a month. If you believe your rights have been violated, you can contact the Estonian Data Protection Inspectorate (www.aki.ee).

8. Age

You must be at least 13 to create an account, and at least 18 to bid on or run an auction.

9. Changes

If this policy changes materially, we will let you know on the platform. The current version is always on this page.