Who we are
ArtScope is operated by ArtScope LLC ("ArtScope", "we", "us"), 1460 W Argyle St, Chicago, IL 60640, United States. We make software that galleries and museums use to publish exhibits, which visitors then browse by scanning a code at the venue.
This policy covers the ArtScope marketing site, the visitor-facing exhibit app, and the gallery-facing app. It explains what we hold about four different groups of people, because what we collect from each is genuinely different: exhibit visitors, gallery and museum staff, artists, and buyers (bidders in a gallery's silent auction among them).
For much of the information in this policy, the gallery or museum decides what is collected and why, and we hold it on their behalf. Where that is the case we say so, because it affects who you should ask about your information. Section 13 explains how to reach either of us.
The short version
The detail matters, but here is the honest summary.
- We record what you look at in an exhibit, and we link those actions together. When you first open an exhibit we generate a random visitor ID, store it in your browser, and attach it to what you do in that exhibit for up to 30 days. Nothing connects you to a different exhibit, a different venue, or any other website. This is described fully in sections 3 and 4.
- You are not asked to sign in, and you are not asked first. Visitor tracking begins when you open the exhibit. See section 13 for how to object or ask for deletion.
- Some exhibits use your camera, and no image ever leaves your phone. Pointing the camera at a piece to identify it runs entirely inside your own browser. Nothing is uploaded, nothing is kept, and we do not use facial recognition anywhere. Section 3.
- When you browse an exhibit, we do not record your IP address, device fingerprint, or location in our databases, and we run no advertising or analytics trackers on our website. Registering to bid in a silent auction is different: to stop fake bids we keep a scrambled form of your IP address and of a random number your phone holds, for 6 months after the auction closes. Section 7.
- We never receive your card number or your PayPal login. You pay with Stripe or PayPal, on their own checkout pages, and the payment goes to the gallery's own account with them. Your name, email and phone number, however, are entered into our form and are held by us. Sections 6 and 7.
- If you bid in a gallery's silent auction, you give us your name, email and phone (the phone is optional only if the auction takes a card up front), we keep every bid you place, and the gallery sees all of it, with automatic warnings about bids that look fake, and can download its winners' details. If the auction takes a card up front, it is saved with Stripe on the gallery's own Stripe account. Other bidders see only your paddle number. Section 7.
- We do not sell personal information and we do not share it for advertising.
- All data is held in the United States, in Amazon Web Services'
us-east-1region.
If you visited an exhibit
You do not create an account to browse an exhibit. You scan a code, the exhibit opens, and you read. Two kinds of information are collected.
Recorded automatically as you browse
These are written as a side effect of using the exhibit. You do not type them in.
- That the exhibit was opened, and which pages of it were viewed
- The first piece you scanned, and each artwork whose details you opened
- What you navigated from, so the gallery can see the path through the show
- Where you began a purchase but did not finish it
- Each piece you add to a cart, whether or not you go on to buy it: whether you added the original, a print the gallery has on hand or a print size made to order, how many, and whether you found the piece in the catalogue or with the camera
- Catalogue downloads
- The language you are reading in, and any language you switch to
- The date and time of each of these, and the visitor ID described in section 4
The language you read in is recorded against your visitor ID. We record it so galleries know which translations their audience actually uses. We recognise that the language a person reads in can indicate their nationality, ethnicity or immigration status. We do not use it for that purpose, we do not combine it with anything else to infer those things, and we do not share it outside the gallery whose exhibit you were viewing.
Information you type in
Only if you choose to. Each of these is optional and none is required to browse an exhibit.
- Guest book — your name, email address, any message you leave, and whether you ticked the box to join the gallery's mailing list
- Enquiry about a piece — your name, email, phone number and message
- Comment on a piece — your name, email and the comment
- Reporting a problem — your name, email and description
- Buying a piece — covered in section 7
- Bidding in a silent auction — also covered in section 7
When you submit one of these, it is delivered to the gallery or museum running the exhibit. They decide what to do with it, and they can reply to you directly. The gallery's guest book screen gathers the email addresses of everyone who signed into a mailing list it can download, and today it includes you whether or not you ticked the box.
The guest book's mailing-list box. Signatures record the tick, but the gallery's mailing list and its download do not look at it yet; signatures from before the box existed are meant to count as agreeing. Whether the list should hold only people who ticked, and what a gallery may do with the others, is not decided. If the product starts honouring the box, the last sentence above changes.
The camera, and what happens to what it sees
Some exhibits let you point your phone's camera at a piece and have the app tell you which one it is. The exhibit asks your browser for camera permission before anything switches on, and you can refuse — the rest of the exhibit works without it. Nothing in the app can turn the camera on without your browser asking you first.
No image from your camera is ever sent to us, to the gallery, or to anyone else. Nothing is uploaded, nothing is recorded, and no photograph is kept — not by us, and not on your phone. The recognition runs inside your own browser: the app downloads the gallery's model to your device and compares the live camera view against it there.
The camera view is examined a few times a second and each frame is discarded immediately. Frames are never written to a file, never placed in storage, and never included in any request to our servers. There is no point at which a picture of you, of the room, or of anything else the camera happened to be pointed at leaves your device.
What is recorded is the answer, not the image: that a visitor with your visitor ID identified a particular artwork, in the same way as if you had tapped that piece from a list. That is the "first piece you scanned" entry in the list above, and it carries no image with it. If you add a piece to a cart from the camera view, the cart entry records only that you were using the camera, also with no image.
The model the app compares against is trained by the gallery, in the gallery's own browser, from photographs they take of their own artworks before the show opens. It is built to recognise paintings and objects, not people. It was never trained on visitors, on faces, or on anything a visitor's camera has seen, and it cannot be — we never receive that footage in the first place.
We do not use facial recognition anywhere in ArtScope, and we do not perform any biometric identification or analysis. If that ever changes, it changes in this policy first.
What we do not collect from visitors
We do not record your IP address, browser user-agent, device fingerprint or geographic location in any of our databases, and we do not attempt to identify you across different exhibits or across different venues. We do not buy information about you from anyone, and we do not add anything to your record from outside sources. If you register to bid in a silent auction, we keep a few more things to stop fake bids, including a scrambled form of your IP address, for 6 months after the auction closes; section 7 lists them.
The visitor ID, in plain terms
This is the part of our system most worth understanding, so we would rather over-explain it than bury it.
The first time you open a given exhibit, we generate a random identifier — not derived from you, your device or your network — and store it in your browser's local storage. For as long as it lasts, every action described in section 3 is recorded with that identifier attached.
The effect is that the gallery can see a single visit as a connected journey rather than as unrelated events: this person scanned this piece, then read about these three others, then added two of them to a cart, then started a purchase, then signed the guest book.
The limits, which are enforced in our code
- It expires after 30 days from your first visit. After that you are a new visitor with a new identifier.
- It is specific to one exhibit. A different exhibit generates a different, unconnected identifier. There is no visitor ID that follows you between shows or between venues. The app does keep other things in your browser, all listed in section 16, and one of them, an Amazon Cognito identifier, is the same across exhibits on your device.
- It is not a cookie and is never transmitted as one. It is stored locally and included in the exhibit's own requests.
- Clearing your browser's site data removes it immediately and permanently. Private or incognito browsing generates a fresh identifier each session.
On its own, the visitor ID is a random string that tells the gallery nothing about who you are. But if you sign the guest book, send an enquiry, leave a comment, or buy a piece, you provide your name and email address — and those are stored alongside the same identifier.
From that moment, the browsing recorded under that identifier, both before and after, is associated with your name and email and can be seen by the gallery. That includes the pieces you added to a cart, including any you did not buy. If that is not what you want, do not submit those forms; or contact us at privacy@artscope.io and we will delete the connection.
Cart events, per visitor or as counts. The gallery's analytics show each "added to cart" event with its visitor ID, as they do for views and purchase attempts, so once a visitor buys or signs the guest book the gallery can see what that named person considered and did not buy. The text above discloses this as it is. Whether galleries should see cart events per visitor at all, or only as totals, is not decided. If it narrows to totals, the journey example and the sentence on cart contents above change.
If you run a gallery or museum
You have an account with us, and this is ordinary business information.
- Account — email address and password, managed through Amazon Cognito. You may instead sign in with Google, Facebook or Amazon, in which case that provider confirms your identity to us and we receive your email address. When you sign up, we send you a welcome email, and our own team is emailed your email address, name, how you signed up and when.
- Organisation — business name and type, website, and your postal address
- Team members — name, email, phone, role, which exhibits each should be notified about, and which alerts each gets (sale emails, sale texts, print orders). Each alert carries the buyer's name, email, phone and reading language, by email and, where texts are on, by text (section 10).
- Payout setup — your Stripe connected-account identifier and its status, and if you connect PayPal, your PayPal merchant identifier, merchant email, business name and account status, so we know you are able to receive funds. We never see your bank details.
- Connecting PayPal — when you start, we send PayPal your gallery's contact email address, only to fill in PayPal's sign-up form for you, along with a reference we generate so PayPal can tell us which gallery finished signing up. You sign up or sign in on PayPal's own pages, and may use a different PayPal account from the one we suggested. Once you have, PayPal tells us the details listed above. Payments made to you through PayPal are made to your own PayPal account: PayPal deducts its processing fee from you, and ArtScope's commission is deducted as a platform fee on each payment.
- Your content — exhibits, artwork records, images, and the artist roster you enter
- Connecting your Squarespace store — if you give us an API key you created in Squarespace, we keep it encrypted with a key-management service until you remove it in ArtScope, and delete our copy ourselves if Squarespace stops accepting it. We also keep your store's Squarespace identifier, name and web address. With the key we copy your products (titles, descriptions, prices, stock and photos) into ArtScope when you ask, and, for exhibits you switch on, read your store's stock and send it stock changes. We send Squarespace no personal information. The permissions we ask you to give the key include reading your store's orders, which hold your website customers' names and addresses; we do not read them.
- Pictures you upload — a photo from a phone or camera can carry details the device wrote into it, such as where and when it was taken and what took it. For JPEG and PNG pictures added in the gallery app since 24 October 2026, we remove those details before the picture is stored, keeping only its colour profile and which way up it goes. Pictures uploaded before then, pictures in other formats, and print files keep whatever they carried; print files are kept exactly as uploaded and reach the print lab that way. Exhibit pictures can be fetched by anyone who has their address, without signing in. That is how the exhibit app shows them, and it is also true before a show is published, although those addresses are not practical to guess.
- Your refund policy and terms of sale — if you write them in ArtScope, every version you save can be read by anyone, without signing in, under an address made from your gallery's name when you first saved one. Each version keeps your gallery's name as it was at the time. Saved versions cannot be changed or deleted, so that a buyer can always see the words that applied to their order. Do not put anyone's personal details in them.
- Ordering prints for yourself — if you order prints of your own pieces or photos, the delivery name and address you enter are kept on the order with your gallery's contact email, and the name and address are sent to the print lab described in section 10. Your email is given to Stripe for the payment, which you make to ArtScope. An order you have not finished, address included, is saved on our servers and in your browser's local storage until you place it or clear it. Photos you upload for prints are kept privately at full resolution.
- Recognition training photographs and the model built from them — if you set up the camera feature described in section 3, the photographs you take of your own pieces and the model trained from them are held in your account's own storage. The training runs in your browser, not on our servers. You can delete an artwork's photographs at any time, and deleting an exhibit deletes its model.
- Support — reports, feedback and correspondence
Information you enter about other people — the artists on your roster, and buyers whose sales you record manually — is covered in sections 6 and 7. You are responsible for having a proper basis to enter it, and for telling those people that you use ArtScope. That includes open-call applicants you save to your Artists list: the copy is made when you choose to save them or move their accepted work into your show, and keeping them on your list afterwards is your decision. If you export your list to a spreadsheet, the file you download is yours to look after; it is outside ArtScope and outside our control.
Your buyer list also holds people you did not enter yourself: buyers who paid through ArtScope, for a piece or a print made to order, and people who started a checkout and did not finish it. It shows which of them agreed to your mailing list (section 7). A buyer list you download is yours to look after in the same way. So is the dispute summary you can copy or download from a sale's receipt, which puts the buyer's name, email and payment details beside your refund policy for you to send to your payment provider. The same goes for the emails we send your team when a PayPal payment is disputed or taken back, which carry the buyer's name, email and delivery address and whether their card's bank confirmed the payment (section 7).
The Squarespace key's order permission. Galleries are asked to give the key "Orders: Read Only", which nothing in ArtScope uses. Whether to keep asking for it is not decided. If it is dropped, the last sentence of the Squarespace item changes.
The key after a gallery leaves. Nothing removes a stored key when a gallery's account closes; only the gallery removing it, or Squarespace refusing it, does. Whether it should go with the rest of the account is not decided, so section 12 does not say.
Using the camera to set up recognition: what you may photograph
To let visitors identify a piece by pointing their phone at it, you photograph your own artworks and train a recognition model from those photographs. That is the only purpose the camera serves on the gallery side, and it comes with conditions.
- Photograph only artworks and objects you have the right to photograph — pieces you own, pieces you hold on consignment or loan, and pieces whose artist or owner has agreed to their inclusion in your exhibit. If a lender's or artist's agreement restricts photography, that restriction applies here too.
- Do not photograph people. Frame the artwork, not the room. Wait until no visitor, colleague or passer-by is in shot, and do not photograph anyone's face, name badge, screen or documents. Recognition is built to identify artworks, and a photograph containing a person adds nothing to it.
- Do not use it to watch anyone. The camera feature must not be used to record, monitor or identify visitors, staff or artists, and ArtScope does not provide a way to do so.
- Do not photograph in places where photography is not permitted — including another venue's premises, or private areas, without permission from whoever controls them.
- Delete what is not needed. If a training photograph captured something it should not have, such as a person in the background, delete that artwork's set of photographs, photograph it again and retrain the model. You can delete an artwork's photographs at any time, and deleting an exhibit deletes its model and the trained weights stored for it.
These photographs and models are your content, held in your account's storage and used only to run recognition for your exhibits. We do not use them for anything else. Our own staff's access to customer content is described in section 14. You are responsible for having the permissions described above; if we learn that the camera feature is being used outside them, we may remove the content and suspend the feature, though we are under no obligation to monitor for this. What a visitor's own camera sees is a separate matter, and never reaches you or us — see section 3.
If you are an artist
Your information can reach us two ways.
You applied to an open call
You submit directly to us without an account: your artist name, legal name, a description of your work, your website and Instagram, your email address and phone number, a note about sharing your details if the call asks for one, and the images you upload. This goes to the gallery running the call so they can review your submission and contact you.
Your images are stored as you uploaded them, including any details your camera or phone wrote into them, such as where and when a photo was taken, and they can be fetched by anyone who has their address. If the gallery accepts your work into a show, the copy it makes for the show has those details removed; your original upload keeps them.
The gallery may also keep your artist name, contact details (email, phone, website and Instagram) and the description you gave (your artist statement) on its own Artists list, which outlasts the call. At present that happens only if the gallery accepts your work. Your legal name, your images and your answers to the call's other questions are not copied to the list. If the gallery already has you on it, only details it is missing are filled in, and its private note on your record may say which call you applied to. From then on, that record is covered by the next subsection.
If the call charges an entry fee, you pay it with Stripe or PayPal, whichever the gallery offers and you choose, on that company's own page. The fee is paid to the gallery's own Stripe or PayPal account. Your card details or PayPal login go to them and never reach us. We keep the amount, any discount code you used, which provider you paid with, that provider's references for the payment, whether it was paid or refunded, and whether it was taken back by a chargeback, and if so when and how the dispute ended. If you paid with PayPal and the payment is disputed or taken back, we read from PayPal the name and email address on the PayPal account that paid (or the name on the card), whether the card's bank confirmed the payment, and PayPal's record of the dispute, and email them to the gallery so that it can respond; we do not keep them. If someone else's PayPal account paid your fee, those are that person's details. Section 7 says more.
A gallery listed you on their roster
Galleries maintain their own artist records, which can include your name, up to three email addresses, phone, website, Instagram, location, address, an "about" text, a status the gallery sets (prospect, represented or alumni), and the gallery's own private notes about working with you. A gallery adds these itself, by typing them in or importing a spreadsheet, or from an open call as described above. We hold this on the gallery's behalf.
A gallery can export its list, private notes included, to a spreadsheet. An exported copy is the gallery's own file, outside ArtScope, and what happens to it is between you and the gallery.
If you want to know what a particular gallery holds about you, ask them first — and contact us at privacy@artscope.io if you would rather we handled it.
If you bought a piece
Bought through ArtScope
Before checkout you give us your name, email address and phone number, and if your order is being shipped, the country it is going to, so that postage can be priced. You do not give us the delivery address itself: you enter it on Stripe's or PayPal's page when you pay (below), and once you have paid we copy the name and address you gave there onto your order. If you chose collection rather than shipping, no address is asked for or stored.
You can pay for several pieces of one exhibit together, up to ten in one payment, and in a group show they may be by different artists. You give your details once, and we keep a copy of them on each piece's order. The gallery sees each piece as its own sale, marked as part of one order. Nothing is collected for a combined purchase beyond what is collected for a single piece.
You then pay with either Stripe or PayPal, on that company's own checkout page. Your card number, expiry date and security code, or your PayPal login, are entered on their page and go to them. They never reach ArtScope, and we have nowhere to put them. If your order is being shipped and you pay with Stripe, Stripe's page also asks for the delivery name and address, in the country you chose, and after you pay we take that name and address from Stripe and keep it on your order. We keep the order: what was bought, the amount and currency, the payment provider's transaction references, the receipt link, and whether it was paid or refunded.
If you pay with PayPal, we send you to PayPal's page, where you sign in to your PayPal account or pay as PayPal allows. We tell PayPal only what you are paying for: each piece's title and artist, the amount, the gallery's name, and our own reference for the order. If you buy prints made to order, that reference also carries the private link to your order's page (described below), and the gallery can see it in its PayPal account. We do not send PayPal your name, email, phone number or address. If your order is being shipped, you choose or add the delivery address in PayPal, and we take that name and address from PayPal and keep it on your order. Otherwise we take nothing from your PayPal account, unless the payment is disputed or taken back (next paragraph). If the address you choose is not in the country the order was priced for, we do not take the payment and do not keep the address; the checkout is closed and you can start again. The payment goes to the gallery's own PayPal account, and PayPal shows the gallery that payment as it does for any PayPal seller, which normally includes the name and email address on your PayPal account. Back on ArtScope we keep PayPal's references for the order and the payment, and for the gallery's PayPal account, so that the sale can be confirmed and, if needed, refunded. What PayPal itself records about you and your payment is governed by PayPal's own privacy statement, not this one.
If a PayPal payment is disputed or taken back, for example because a dispute or chargeback is opened with PayPal or your bank, we read from PayPal the name and email address on the PayPal account that paid (or the name on the card, if you paid by card through PayPal), whether your card's bank confirmed the payment with its security check (3-D Secure), and PayPal's record of the dispute: its reason, amount, stage, response deadline and outcome. We send these by email, with the rest of the sale record and the delivery address, to the gallery's account holder and the members of its team who receive sale emails, so that the gallery can respond to the dispute with PayPal. Team members who receive sale texts get a text with only the amount and what was bought. We do not keep the name, email address or card check result: on the order we keep only that the payment was taken back, and whether the gallery later won or lost it, when, and PayPal's reference for the dispute. We do not respond to disputes for the gallery, and we do not send you a message about one.
"Your card number never reaches us" is true. It is not the same statement as "your details never reach us" — your name, email and phone are typed into our form, and we hold them. Your delivery address is typed into Stripe's or PayPal's page rather than ours, but once you have paid we hold that too. We would rather you know precisely which of those two sentences applies.
The gallery is the seller and the merchant of record: the payment is taken on the gallery's own Stripe or PayPal account. ArtScope is the platform the sale runs on and takes a commission on each sale. If the gallery has written a refund policy in ArtScope, your order records which version of it applied. We keep the sales record for the gallery and for our own accounts, as described in section 12.
We email you about your order, through Amazon SES: one email for each payment, listing what you bought, what you paid, how each item reaches you and, for prints made to order, the name, city and country they are posted to; an email for each parcel when a print is on its way, with the carrier and tracking number; and an email if a print cannot be made, or a piece had already sold to someone else, saying what is refunded. If you chose text receipts, we also send one text for each payment, through Amazon Pinpoint. These emails are translated into the language you were reading in by Amazon Translate. Only our own fixed wording and the gallery's message go to it, never your name, contact details, address or what you bought.
If you bought prints made to order, the emails carry a link to a page about your order: what you ordered, its status and tracking, the city and country it is going to, and your language. It never shows your name, contact details or street address. Anyone who has the link can open the page, so forwarding the email shares it.
If you buy a print made to order, a print lab that works for us makes and posts it. We send the lab the delivery name and address and your phone number, which couriers can need for delivery and customs, but not your email address. The lab may make a print in a different country from the one it is going to. Section 10 says more about the lab.
The gallery's list of its buyers. Besides each sale, the gallery sees its buyers as a list of people, one entry per email address, drawn from all of its sales: pieces and prints made to order bought through ArtScope, and sales it recorded at the desk (next subsection). Each entry shows your name, email address and phone number, what you bought and when, and what you have spent with the gallery after refunds. The list also includes people who started a checkout for a piece and did not finish it, with the details they entered. The gallery can download the list as a spreadsheet; the Excel version includes phone numbers, the CSV version does not. A downloaded file is the gallery's own, outside ArtScope and outside our control. The list is worked out from the sales records each time the gallery opens it; nothing is kept for it separately.
At checkout you are offered a box, "Add me to the gallery's mailing list", which starts unticked; your order records whether you ticked it. The gallery's list marks the buyers who agreed, and the downloaded file lists them on a sheet of their own. A buyer whose orders do not record that agreement is shown as not having agreed.
What a gallery may do with a buyer's details. The downloaded file tells the gallery not to add buyers who did not agree to marketing email, but that is advice in a file, not a rule. Whether a gallery may contact those buyers for anything beyond their purchase is not decided, so this section and section 5 do not say. The answer may differ by country.
Phone numbers on the buyer list. A phone number given for a print made to order is needed for the order and its delivery. The list and the Excel download show it to the gallery for every buyer, and the text above says so. Whether it should be there is not decided.
"Share my info with the artist". Checkout can record one yes or no for this, and a combined purchase copies that one answer onto every piece's order, so in a group show a single choice would cover several artists. Nothing reads the answer today: no buyer details are sent to any artist, and the exhibit app does not yet show the choice. This section therefore says nothing about sharing with artists. What the choice promises, and whether one choice may cover several named artists, is not decided. If the choice is shown to buyers before that, it has no text here behind it.
You bought at the desk and the gallery recorded it
If you paid a gallery by cash, cheque, card on their own terminal, or over the phone, the gallery may record the sale in ArtScope. That record can include your name, email address and phone number, typed in by them, and we may send you a receipt by email if the gallery asks us to.
The same goes if you bid in a gallery's silent auction and their staff registered you at the desk rather than you registering on your phone. The gallery types in your name and, if you gave them, your email address and phone number, and places bids for you. The record notes that the gallery's staff created it. If they entered an email address, you will receive the same auction emails as any other bidder, listed in the next subsection; if they did not, we send you nothing.
You may have never used ArtScope, and this may be the first you have heard of us. We hold this information on behalf of the gallery you bought from or bid with. You can ask us what we hold and ask us to delete it: privacy@artscope.io.
You bid in a silent auction
A gallery can run an exhibit as a silent auction. To bid from your phone you register, giving your name, email address and phone number. The phone number is required if the gallery asks winners to pay after bidding closes, because then there is no card and no email check, and the number is what the gallery has to go on if a bid looks fake, and how it can reach you. If the auction takes a card up front, the phone number is optional. We also keep a copy of the number reduced to its digits, so that it matches however it was typed. We also record the language you were reading the exhibit in, the exhibit page you registered from (so that links in later emails bring you back to it), the paddle number you are given, when you confirmed your email address, and that you agreed to the gallery's auction terms, which version, and when. Your sign-in links are stored only in a scrambled form that cannot be turned back into a working link.
Every bid you place is kept: the piece, the amount and the time, and, if you set a maximum for automatic bidding, that maximum.
Checks against fake bids. When you register on your phone, the exhibit app sends a random number it made for that phone. It is not a fingerprint of your phone and does not describe it. We also receive the internet (IP) address your registration came from. We keep neither as it is: we store only a scrambled form of each, made with a secret key that is generated by our hosting provider and that no one types in or sees. Without that key the scrambled values cannot be turned back into the number or the address, but we hold the key, so we treat them as your information. The key is the same in every auction, so the same phone or network gives the same scrambled value in each one. Today we compare them only within a single auction. Nothing uses the scrambled IP address yet. We use the device value, with the digits of your phone number, for three things: if the gallery blocks a bidder, a new registration in that auction from the same phone number or the same phone is refused, whatever email is used; one phone can register at most three paddles in an auction; and the gallery is told when one number or one phone is behind more than one paddle. We also limit each bidder to ten bids a minute. The scrambled values are not shown on the gallery's auction screens or to other bidders.
We also mark bids and bidders automatically with warnings the gallery sees: a bid much higher than the lowest the piece would take; such a bid as a bidder's first; bids on many pieces within a minute; one phone number or phone behind more than one paddle (shown on each of those paddles); the same email and phone number joining from a second phone; and a name containing a word from a short list that people do not register under. These warnings never refuse a bid. A person at the gallery looks at them and decides what to do, which may be to void a bid or block a bidder.
If the gallery takes a card up front, we ask Stripe to create a customer record for you, holding your name, email and phone, on the gallery's own Stripe account, and you enter your card on Stripe's own page. As with any purchase, your card number, expiry date and security code go to Stripe and never reach us. We keep Stripe's references to the customer record and the saved card, and the card's brand and last four digits so we can show you which card is on file. If the gallery instead asks winners to pay after bidding closes, no card is saved and you pay through a link we email you. Either way, the payment is taken on the gallery's own Stripe account.
We email you about the auction, through Amazon SES: to confirm your address or sign you in on another phone, when your card is saved, when you are outbid, when you win (with the receipt if your card was charged), to ask you to pay and remind you, when you did not win, and if a piece is offered to you because its winner did not pay. These emails are in English. We do not send text messages about auctions.
If the auction does not take a card, the gallery can have us email you a link when you register, to confirm your address. Bidding does not wait for it. If you tap it, the gallery sees that you confirmed your address. Because nothing checks the address first, this email can reach someone whose address another person typed in. If you receive one you did not expect, you can ignore it, or tell the gallery or us.
The gallery sees everything above — your name, email, phone, paddle number and every bid, the automatic warnings on your bids and on you as a bidder, and whether you confirmed your address — and can block a bidder. Its auction screens do not show the scrambled values described above. It can download a results sheet listing each piece's winner by name, email and phone, with the amount and how it was paid; once downloaded, that file is the gallery's own and outside ArtScope. If you pay the gallery some other way and it records that, your name, email and phone are copied onto a manually recorded sale, described in the subsection above.
Other bidders never see your name, email or phone. If the gallery shows bid history, other bidders see the paddle number, amount and time of the most recent 20 bids on a piece. The winning amount may be shown on a piece once bidding has closed. If a piece is offered to the next bidder, that email says only that the winning bidder did not pay, without saying who they are.
After the auction. Once the auction is settled, any card saved for it is removed from the gallery's Stripe account. The card's brand and last four digits stay on your bidder record. The customer record Stripe holds for you on the gallery's account, with your name, email and phone, is not removed. Your bidder record and your bids are not removed either: the gallery cannot delete them, and they stay even if the gallery deletes the exhibit. The checks against fake bids are different: 6 months after the auction closes we remove the scrambled device value, the scrambled IP address, the digits-only copy of your phone number and the warnings. We keep them that long so a gallery can recognise someone who caused trouble before. Sections 12 and 13 say what that means for the rest of your record and how to ask for deletion.
Who answers for bidder data. The gallery decides who may bid, can block them, registers walk-ins and downloads the list; we run registration, keep the records and send the emails. The desk paragraph above applies "on behalf of the gallery" to walk-ins. Whether that is also the position for bidders who register on their phone is not decided, and this subsection does not say.
The Stripe customer record. The card consent says "Your card is kept by Stripe for this auction only", and the card is removed; the customer record is not. Whether it should be deleted after the auction is not decided. If it is, the "After the auction" paragraph changes.
What walk-ins are told. They tick nothing. The auction emails name ArtScope and the gallery but do not link this policy. Whether they should is not decided.
Marketing and newsletter
If you fill in a contact form on our website, we collect what you enter — your email, and optionally your name, organisation, phone, website, message and area of interest — along with which form you used and the web page that referred you. We use this to reply to you and to understand which parts of our site are useful. Our staff may add notes about our conversations with you.
Our newsletter is a separate list with a separate opt-in. Every newsletter email carries a one-click unsubscribe link, and it works without you having to log in or give your address again. Unsubscribing from the newsletter does not delete your enquiry, and vice versa; ask us if you want both removed.
Why we use this information
| Purpose | What it covers |
|---|---|
| Running the exhibit | Showing artwork, translating text on request, delivering catalogues |
| Gallery analytics | Telling a gallery how their show was visited — which pieces drew attention, which languages were used, where visitors stopped |
| Connecting you to the gallery | Delivering your guest book entry, enquiry, comment or report to the venue |
| Open calls and artist records | Delivering open-call submissions to the gallery running the call, taking any entry fee, and holding each gallery's artist list for it, including applicants it saves from its calls |
| Sales | Taking payment, sending receipts, arranging delivery or collection, handling refunds and disputes, and giving the gallery a list of its buyers |
| Silent auctions | Registering bidders, taking and ranking bids, saving and charging a card or sending a payment link, emailing bidders about the auction, checking for fake bids and showing the gallery automatic warnings about them, and giving the gallery its bidder list and results |
| Accounts | Signing gallery staff in, permissions, notifying the right people about a sale |
| Support and safety | Answering questions, investigating reports, preventing abuse of the service |
| Our own marketing | Replying to enquiries and sending the newsletter to people who asked for it |
| Legal and financial | Tax records, accounting, and complying with the law |
Where the law requires a legal basis for processing, we rely on: performance of a contract for accounts, sales, and bidders who register for an auction; legitimate interests for exhibit analytics, security (including the checks against fake bids in silent auctions) and service improvement; consent for the newsletter and for information you volunteer through a form; and legal obligation for financial records. Where a gallery decides the purpose, they determine the basis and we act on their instructions; that includes bidders a gallery registers at its desk.
Where it is held
All ArtScope data is stored in the United States, in Amazon Web Services' Northern
Virginia region (us-east-1). Our providers may process data in other regions in the
course of delivering their service. In particular, a print lab may make and post a print from
outside the United States, and the delivery details for that print then go there too.
If you are outside the United States — including in the United Kingdom, the European Economic Area or Switzerland — using ArtScope means your information is transferred to and stored in the US, which may not offer the same protections as your home country. Galleries and museums that need a data processing agreement with standard contractual clauses should contact privacy@artscope.io.
How long we keep it
We keep information for as long as it serves the purpose it was collected for, then delete it — except where the law requires us to keep it longer.
| Information | Retention | Why |
|---|---|---|
| Exhibit browsing Visits, scans, views, items added to a cart, purchase attempts, downloads, language switches |
24 months | Long enough for a gallery to compare a show against the one before it. Its usefulness falls away quickly after that. |
| Guest book, enquiries, comments, reports | Life of the gallery's account, then 90 days | The gallery holds the relationship with you and decides how long to keep it. They can delete any of these at any time, and we remove what remains after their account closes. |
| Sales and payment records Orders, fulfilment, manually recorded sales, open-call entry fees, payments, and the Stripe and PayPal references on them |
7 years | Tax and accounting law, for the gallery's sale and for our commission on it. These cannot be deleted on request. |
| Gallery accounts and artist rosters | Life of the account, then 90 days | Needed to run the service; removed shortly after the relationship ends. An artist record, including one a gallery saved from an open call, stays until the gallery deletes it or its account closes. |
| A gallery's refund policy and terms of sale Every saved version, with the gallery's name at the time |
Not yet set — see below | Kept so that an older order can still show the words that applied to it. Nothing deletes a version today, including when the gallery's account closes. |
| A gallery's unfinished print order Prints chosen and the delivery address, before the order is placed |
Until placed or cleared | Saved so the gallery can finish it on any device. Nothing removes it on a timer today; once placed, it is a sales record. |
| Enquiries to us and newsletter | 24 months from last contact, or until you unsubscribe | We keep a minimal record of an unsubscribe so we do not email you again by mistake. |
| Open call submissions | Life of the gallery's account, then 90 days | Held for the gallery running the call. Details a gallery saves to its Artists list (section 6) become part of its artist roster and are kept on the roster's terms, not deleted with the submission. |
| Silent auction bidders and bids Registrations, walk-ins entered by a gallery, every bid |
Not yet set — see below | A winning bid that was paid is a sales record and kept as one. A saved card is removed from the gallery's Stripe account once the auction settles. A paid-offline sale the gallery records is kept as a manually recorded sale. |
| Silent auction checks against fake bids Scrambled device value and IP address, digits-only phone number, warnings on bidders and bids |
6 months after the auction closes | Long enough for a gallery to recognise someone who caused trouble at an earlier auction. Removed automatically; your name, email, phone and bids stay on the bidder record above. |
No period is set for auction bidders who did not win, for walk-ins, or for bids, and nothing deletes them today: the gallery cannot, and deleting the exhibit leaves them in place. The Stripe customer record on the gallery's account is not deleted either. Whatever period this row states, the product needs a deletion job to keep it.
Gallery refund policies. Saved versions are built to be permanent, and neither the gallery nor our own staff can delete one in the product. How long they are kept and public, including after a gallery leaves, and whether we will remove one on request (for example, one that names a person), are not decided. The "Gallery accounts" row's 90 days does not apply to them today.
A gallery can delete a guest book entry, enquiry, comment, artist record or manually recorded sale themselves, at any time. It cannot delete auction bidders or bids, or a saved version of its refund policy. Anything else, ask us.
Your rights
Wherever you live, and regardless of whether your local law requires it, you can ask us to:
- Tell you what we hold about you, and give you a copy
- Correct anything wrong
- Delete what we hold, subject to the sales-record exception in section 12
- Stop using it for a particular purpose, including exhibit analytics
- Unsubscribe from any email, using the link in the message or by asking us
Email privacy@artscope.io. We will acknowledge within 7 days and respond within 30 days. There is no charge. We will ask you for enough information to be confident it is your data we are handing over or deleting, and nothing more.
A visitor ID is deliberately not connected to any account or login, so we cannot look you up from your name or email alone unless you also submitted a form. That is a privacy protection, but it makes a request harder to action.
If you gave your name or email in a guest book, enquiry, comment or order, tell us that and roughly when — we can find you and delete the whole connected trail. If you gave nothing, there is no way for us to distinguish your records from any other visitor's, which also means they are not identifiable as yours by us or by the gallery. Clearing your browser's site data ends the collection immediately.
If you are in the EEA or UK, you also have the right to lodge a complaint with your data protection authority. If you are in California, you have the rights to know, delete, correct and opt out of sale or sharing — we do not sell or share personal information as those terms are defined, and we will not discriminate against you for exercising any right.
Where a gallery entered your information, or saved it to its Artists list from an open call, we will action your request and let them know. You may find it faster to contact them directly, and we will tell you who they are if you do not know.
If you bid in a silent auction, ask us rather than the gallery to delete your bidder record and bids: the gallery cannot delete them in ArtScope, so we do it ourselves. A winning bid you paid for is a sales record and falls under the exception in section 12. A copy of what we hold about you as a bidder includes any automatic warnings on you and on your bids (section 7). If you saved a card, the customer record Stripe holds for you is on the gallery's own Stripe account, not ours; ask the gallery, or ask us and we will tell them.
If you paid with Stripe or PayPal, we can delete or hand over what we hold, but not what they hold. Your PayPal account, and PayPal's own record of your payment, are PayPal's, under PayPal's privacy statement; ask PayPal for those. The gallery you paid also has the payment in its own Stripe or PayPal account.
Security and staff access
Data is encrypted in transit and at rest. Gallery accounts are separated so one gallery cannot read another's records. Exhibit pictures and open-call images are the exception, on purpose: anyone who has a picture's address can fetch it (sections 5 and 6). Our public interfaces are write-only for visitor events: even with the exhibit's public credentials, no one can read visitor records back out.
A small number of ArtScope staff can access customer and visitor records in order to run the service, investigate problems and provide support. We keep that group as small as the work allows. Staff access is restricted to what support and operations genuinely require, and misuse of it is a disciplinary matter.
No system is perfectly secure. If a breach affects your information we will notify you and the relevant authorities as the law requires.
Children
ArtScope is not directed to children and we do not knowingly collect personal information from anyone under 13.
We recognise that school groups visit museums and that a child may scan a code at an exhibit. Browsing an exhibit does not require any personal information, and nothing identifiable is collected unless someone chooses to fill in a form. If you believe a child has given us their details, contact privacy@artscope.io and we will delete them promptly. Schools and museums running education programmes should contact us about their specific arrangements.
Cookies and local storage
Our marketing website sets no cookies and stores nothing in your browser. We run no advertising, analytics or tracking scripts on it — no Google Analytics, no advertising pixels, nothing.
The exhibit app sets no cookies either. On every visit it keeps the three items below in your browser's local storage, and a few more only while you are buying something (after the list). It uses no offline database.
- The visitor ID described in section 4. It is stored with the date it was created, which is what the 30 days is counted from, and with a note of whether you have already downloaded the catalogue, so that a second download is not charged to the gallery twice.
- A note that you got past the opening screen — that you were shown the terms and allowed camera access — so the exhibit does not ask you again. It records that the prompt happened. It records nothing about you, and it is not an acceptance of anything: browsing an exhibit does not require you to agree to a contract with us. What the camera does, and what becomes of what it sees, is in section 3.
- An anonymous identifier from Amazon Cognito, written by the AWS software this app is built on. It stands in for the account the app does not have, so that it can make its requests to our servers at all. It is not linked to your name, and it is not written into the records of your visit — nothing a gallery can see is filed under it, which is why it does not join up what you did at one show with what you did at another. Two things are still true of it that are not true of the visitor ID, and we would rather say so plainly: it does not expire on its own, and it is the same value for every exhibit you open on that device.
None of the three is a cookie, none is sent as a header, and none can be read by any other website.
While you are buying. If you add pieces to a cart, the cart is kept in local storage for that exhibit (which pieces and prints, how many, and their titles and pictures) so that it is still there when you come back, with a reference to the checkout you last started there, so that pressing Pay again does not open a second payment. While you are on Stripe's or PayPal's page, the tab you paid from keeps in its session storage what you were paying for and which pieces you have just bought, so that the exhibit can show them as sold when you return; session storage is cleared when the tab closes. The app also notes in session storage that it has just reloaded itself after an update, so that it does not do so twice. None of these holds your name, contact details or address. Clearing your browser's site data removes all of them.
Paying takes you off our site. No Stripe or PayPal script runs on any ArtScope page. When you pay, you are sent to Stripe's or PayPal's own page, and any cookies set there are theirs, under their own policies, not ours.
The gallery app keeps a few things in the browser of the staff member using it. One of them holds personal information: an unfinished print order the gallery is putting together, including its delivery address, removed when the order is placed or cleared (section 5).
Gallery sign-in uses cookies, set by Amazon Cognito, which are necessary to keep staff signed in. Those are set when someone signs in to a gallery account, and never for a visitor browsing an exhibit — if you scanned a code at a show, you have no sign-in with us and we set you no cookie.
What we do not do
- We do not sell personal information, and we do not share it for cross-context behavioural advertising.
- We do not sell or license artists' work.
- We do not run advertising or third-party analytics on our website.
- We do not store card numbers, expiry dates, security codes, bank details or PayPal login details anywhere. For a card saved in a silent auction we keep only its brand and last four digits.
- We do not track visitors across different exhibits, different venues, or other websites. A silent auction bidder's scrambled device value and IP address are the same in every auction, so they could be matched between auctions; today we compare them only within one auction, and if that changes, it changes in this policy first (section 7).
- We do not buy information about you, and we do not enrich your record from outside sources.
- We do not use your information to train machine learning models.
- We do not use facial recognition, and we do not carry out biometric identification or analysis of any kind.
- We do not receive, store or transmit any image from a visitor's camera — see section 3.
Changes
We will update this policy as ArtScope changes. Every version carries the identifier printed under the title, and it changes whenever the substance does — a new category of information, a new recipient, a changed retention period, a changed right. Correcting a typo does not move it. Where you have accepted this policy alongside the Terms of Service, that identifier is what we recorded, so it is always answerable which text you agreed to.
If we make a change that materially affects how we handle information we already hold about you, we will give notice — by email where we have your address, and by a notice in the product — before it takes effect.
Contact us
For any privacy question, or to exercise any right in section 13:
- privacy@artscope.io
- Entity
- ArtScope LLC
- Address
- 1460 W Argyle St
Chicago, IL 60640
United States - Response
- Acknowledged within 7 days, answered within 30
If your information was entered by a gallery or museum, they are the first place to ask — but you are welcome to come to us and we will handle it either way.