Data Processing Addendum

When you store your gallery's data in Artfolio, you are trusting us to process it carefully and only as you direct. This is a plain-language summary of our Data Processing Addendum (DPA). To request the full, signable DPA, email privacy@artfolio.ai.

Roles

For the personal data inside your account (your contacts, collectors, artists and team), your gallery is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (the “data controller” in GDPR terms). Manual 2 AI Private Limited is your Data Processor: we process that data on your behalf and on your instructions, not for our own purposes.

Scope and purpose

We process your data only to provide and support the Artfolio service: running the platform, delivering the features you use, keeping it secure, and helping you when you ask. We do not sell your data, and we do not train AI models on your private content.

Where your data is hosted

Your database, sign-in, uploaded files and backups are hosted in Mumbai, India (AWS ap-south-1), and the Artfolio app runs on servers in Mumbai.

Confidentiality and security safeguards

Everyone with access to customer data is bound by confidentiality obligations. We apply reasonable security safeguards, including encryption in transit and at rest, per-gallery isolation enforced by row-level security in the database, role-based permissions, optional two-factor sign-in, an audit trail of key actions, and daily backups. See our security overview.

Personal data breaches

If we become aware of a personal data breach affecting your gallery's data, we will tell you without undue delay and give you the information we have, so you can meet your own duty to inform the Data Protection Board of India and the people affected.

Sub-processors

We use a small set of third-party services to deliver Artfolio, each for a specific purpose under contractual safeguards. The current list, with each provider's role and where it processes data, is at /legal/sub-processors/. We notify customers of material changes.

Helping you answer people's requests

When someone asks your gallery to see, correct or erase their personal data, or withdraws their consent, we help you respond. Artfolio lets you edit and export contact records and stops campaign emails to people who unsubscribe; for anything the product doesn't yet do in a click, email privacy@artfolio.ai and we will assist.

Transfers outside India

Your core data stays in Mumbai. Some supporting services, such as email delivery, error monitoring and certain AI features, may process limited data outside India. Each is listed with its location on the sub-processors page.

Deletion, return and export

You can export your data at any time while your account is active. When your account ends, you may ask us to return or delete your data, and we will delete it within a reasonable period, except where the law requires us to keep it.