Privacy Policy

Last updated: 16 October 2026. Information on the processing of personal data pursuant to Art. 13 of the General Data Protection Regulation (GDPR).

1. Controller

The controller for data processing on this website within the meaning of the GDPR is:

Sylvan James Smit
Sonnenallee 162
12059 Berlin
Germany
Email: contact@artexchange.app

2. Hosting and delivery

This website is hosted by Render Services, Inc. (525 Brannan Street, Suite 300, San Francisco, CA 94107, USA) in a data centre in Frankfurt am Main, Germany. Render processes the technical data arising when the site is accessed (see section 3) on our behalf, on servers within the European Union. The legal basis is our legitimate interest in the secure and reliable operation of the website (Art. 6 (1)(f) GDPR).

The provider is established in the United States. Even though processing takes place on servers in the EU, access from a third country cannot be entirely excluded. For such cases the transfer is based on the European Commission's Standard Contractual Clauses (Art. 46 (2)(c) GDPR).

Every request to this website first passes through Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA), which answers for the site's domain name, encrypts the connection, and turns away attacks before a request reaches our host. Because it is Cloudflare that encrypts the connection, it handles everything a request carries, not only its technical data (see section 3): the session cookie (section 5), every form you submit, and every artwork you upload. It processes all of this on our behalf, in its data centres around the world, usually the one nearest you. The legal basis is the same legitimate interest (Art. 6 (1)(f) GDPR).

Cloudflare is certified under the EU-U.S. Data Privacy Framework, on which transfers to the United States are based (Art. 45 GDPR). Transfers to other countries are based on the European Commission's Standard Contractual Clauses (Art. 46 (2)(c) GDPR).

Email to the address in section 1 is received and stored for us by Fastmail Pty Ltd (PO Box 234, Collins St West, Victoria 8007, Australia), on servers that include servers in the United States. A message reaches Fastmail with everything in it: your name and email address, and whatever you write, such as details of a purchase, a cancellation or a refund. The legal basis is performance of our contract with you where you write about it (Art. 6 (1)(b) GDPR), and otherwise our legitimate interest in answering you (Art. 6 (1)(f) GDPR). Transfers to Australia and the United States are based on the European Commission's Standard Contractual Clauses (Art. 46 (2)(c) GDPR), which Fastmail's data processing agreement incorporates.

3. Access data and logs

When you open a page, your browser sends what every browser sends: its IP address, the address of the page and the time, and usually an identifier for the browser and operating system (user agent) and the page you came from (referrer). Cloudflare (section 2) processes this to deliver the page and to recognise and block attacks.

Our own server records less. For each request it logs the time, the address requested, the size of anything sent with it, the status of the response and how long it took, but not your IP address and not your browser. Render, our host (section 2), may also keep its own record of the requests reaching our server, including the IP address Cloudflare passes on with each one.

Some entries also name an artist, by handle or decentralised identifier (DID). To show a portfolio or a studio, our server fetches the artist's records from their Personal Data Server (PDS, see section 4), and its log of those requests names the artist, whoever is viewing the page. Entries also name you when you sign in, when you make a change in your studio or on your account page, when you start, cancel or resume a subscription or ask for a refund, and when Paddle notifies us of a change to your subscription or of a refund.

This data is processed solely to keep the website running and to defend it against attacks. The legal basis is Art. 6 (1)(f) GDPR. It is not combined with other data sources and is not evaluated for advertising.

4. Images and video on portfolio pages

Photos on portfolio pages are delivered from this website, through Cloudflare (section 2). When a page needs a photo, our server fetches the original from the Personal Data Server (PDS) of the artist concerned and passes it on without keeping it, and Cloudflare makes a copy at the size and in the format your browser can use. Cloudflare keeps the original and its copies in its cache for up to one day. Your browser therefore does not contact the artist's PDS for these photos, and your request is processed as described in section 3. The legal basis is Art. 6 (1)(f) GDPR: our legitimate interest in pages that load quickly on any connection.

Videos, photos in a format we do not resize (such as SVG or TIFF), and in the studio your own photos, are loaded directly from the artist's PDS. Your IP address is then transmitted to the operator of that PDS, because this is technically necessary in order to deliver the media. Which provider hosts a given PDS is decided by the artist, not by us. The legal basis is Art. 6 (1)(f) GDPR.

5. Cookies and analytics

This website sets one cookie, and only after you sign in: ax_session. It contains a random token that names a session held on our server — never a credential, and nothing that can be decoded. It is set with the HttpOnly, Secure and SameSite=Lax attributes, so no script can read it and it is not sent with cross-site subrequests. Signing out deletes it.

This cookie is strictly necessary in order to provide a service you have expressly requested, so it requires no consent under § 25 (2) TDDDG. We set no other cookies, and use no advertising services.

To learn how many people visit this website and which pages they read, we use Plausible Analytics, provided by Plausible Insights OÜ (Västriku tn 2, 50403 Tartu, Estonia), which processes the data on our behalf under a data processing agreement and stores it in the European Union.

It counts the public pages only: the home page, pricing, sign-in, these legal pages, and every portfolio and project. Your studio, your account page and the page you return to after a checkout load nothing from Plausible, and a visit to them is never counted.

On a counted page your browser loads Plausible's script from plausible.io. For each page you view, it sends Plausible the page's address, the address of the page that linked to it, how long the page stayed open and how far down it you scrolled. Plausible also receives your IP address and your browser's user agent, as any server you connect to does. From them it derives your approximate location (country, region and city) and your browser, operating system and type of device, and, combined with a random key it deletes every 24 hours, a daily count of unique visitors. It stores neither your IP address nor your user agent, sets no cookie and keeps no identifier on your device, so it cannot recognise you on another day or on another website.

A portfolio's address names its artist, so these statistics include how often each portfolio is viewed and where its visitors came from. The legal basis is our legitimate interest in knowing how the website is used, so that we can improve it (Art. 6 (1)(f) GDPR). You can object at any time (section 10).

6. Signing in with your ATProto identity

Signing in uses the AT Protocol's OAuth flow against your own PDS. When a session is created we store, on our server: your decentralised identifier (DID), your handle for display, the addresses of your PDS and of the service that signs you in, timestamps, and the credentials that keep the session alive (a refresh token and a private key), held under a hash of your session token. The legal basis is performance of our contract with you (Art. 6 (1)(b) GDPR). Signing out deletes the session record.

Your artwork and portfolio records are stored in your own PDS, and this site reads and writes them there on your instruction. Our server keeps no copy of them. The only copies we cause to be made are the photos described in section 4, which Cloudflare keeps for up to one day so that portfolios load quickly.

7. Payments

Subscriptions are handled by Paddle.com Market Ltd (Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom) as Merchant of Record. Paddle is the seller of record and an independent controller for the payment data it collects: name, billing address, email address and payment details are entered on Paddle's checkout and are processed under Paddle's privacy policy. We never see or store your card details.

On the /checkout page — and on no other page — your browser loads Paddle.js from cdn.paddle.com, which transmits your IP address to Paddle. This is technically necessary to display the checkout you asked for (Art. 6 (1)(b) GDPR).

Before that page loads, and before you enter anything on it, our server opens the checkout with Paddle and gives it your DID, and Paddle's identifier for you if you have subscribed before, so that the payment can be matched to your account. The legal basis is Art. 6 (1)(b) GDPR.

So that we know whether your studio is open, we keep a subscription record on our own server: your DID, Paddle's identifiers for you and for your subscription, your plan (monthly or annual), the subscription's status, and the relevant dates, including any cancellation you have scheduled. It contains no payment details. If you ask for a refund from your account page, we also keep that request: when you made it, the reason you gave if you gave one, and how it was settled. The legal basis is Art. 6 (1)(b) GDPR.

8. Storage periods

Our server's logs are kept only as long as our host retains them for operational security. Session records are deleted when you sign out, when we next try to use a session your PDS has already ended, and in any case 365 days after you signed in, or after you last made a change through ArtExchange if that was more recent. Cloudflare keeps the photos it delivers, and the copies it makes of them, for up to one day. Plausible keeps the statistics it derives, which identify no visitor, for as long as we use it, and deletes the key behind its daily count after 24 hours. Subscription records and refund requests are kept while you have a subscription, and afterwards until you ask us to delete them (section 10). So is the record created when you open a checkout and do not complete it, even though no subscription follows. Emails you send us stay in our mailbox until we delete them, or you ask us to. Paddle keeps transaction records under its own policy, including the retention periods tax law imposes on it as seller.

9. Encryption

This website uses TLS encryption for security. You can recognise an encrypted connection by the “https://” in your browser's address bar.

10. Your rights

Under the GDPR you have the right to:

An informal message to the email address above is enough to exercise any of them.

11. Right to lodge a complaint

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR (Art. 77 GDPR).