1. Introduction
MANUAL 2 AI PRIVATE LIMITED (“Artfolio,” “we,” “us,” or “our”) is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Artfolio platform, website, and related services (collectively, the “Service”).
This Privacy Policy applies to all users of the Service, including gallery owners, artists, collectors, team members, and visitors to our website and public Viewing Rooms. It is written to meet India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it, and also describes rights under other laws that may apply to you.
1.1 Who is responsible for your data
- Data a gallery stores about its contacts. When a gallery adds collectors, artists, buyers or other people to Artfolio, the gallery decides why and how that data is used. The gallery is the Data Fiduciary under the DPDP Act, and MANUAL 2 AI PRIVATE LIMITED processes the data on the gallery's behalf as its Data Processor. If you are one of a gallery's contacts, please contact that gallery first; we will help the gallery respond.
- Your Artfolio account and our website. For account, billing, support and website-visitor data, MANUAL 2 AI PRIVATE LIMITED is the Data Fiduciary.
2. Information We Collect
2.1 Information You Provide
- Account Information: Name, email address, password, and organization details when you register for an Account.
- Gallery Profile: Gallery name, address, website URL, and other business details you provide when setting up your gallery workspace.
- Artwork Data: Artwork titles, descriptions, dimensions, media, provenance, pricing, edition information, and images you upload to manage your inventory.
- Contact Data: Information about collectors, institutions, press contacts, and other individuals you add to the CRM, including names, email addresses, phone numbers, mailing addresses, and interaction notes.
- Financial Data: Invoice details, sales records, and payment information associated with transactions processed through the Service.
- Communications: Messages, support requests, and feedback you send to us.
2.2 Information Collected Automatically
- Usage Data: Pages visited, features used, time spent on the Service, clickstream data, and interaction patterns.
- Device Information: Browser type, operating system, device type, screen resolution, and language preferences.
- Log Data: IP addresses, access times, referring URLs, and server log information.
- Viewing Room Analytics: Visitor counts, artwork view statistics, and engagement data for your public and private Viewing Rooms.
2.3 Information from Third Parties
We may receive information about you from third-party services when you interact with integrations connected to your workspace. We only receive the information needed to provide the requested service.
3. How We Use Your Information
We use the information we collect for the following purposes:
- Provide and maintain the Service: Including artwork inventory management, CRM functionality, sales pipeline tracking, invoicing, exhibition management, and Viewing Room hosting.
- AI artwork analysis: Processing artwork images through our AI features to generate medium, style, color, mood, and tag suggestions.
- Communications: Sending transactional emails (account confirmations, password resets, invoice notifications, exhibition invitations) and, with your consent, promotional communications about new features and updates.
- Analytics and improvement: Understanding how the Service is used to improve features, performance, and user experience.
- Security and fraud prevention: Detecting, preventing, and addressing technical issues, abuse, and fraudulent activity.
- Legal compliance: Fulfilling our legal obligations and enforcing our Terms of Service.
- Customer support: Responding to your inquiries, troubleshooting issues, and providing technical assistance.
4. Data Storage & Security
We implement industry-standard security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:
- Encryption of data in transit using TLS 1.2 or higher.
- Encryption of sensitive data at rest using AES-256 encryption.
- Row-level security policies ensuring users can only access data within their own Gallery.
- Role-based permissions that limit what each team member can see and change.
- An audit trail of key actions inside each Gallery.
- Optional two-factor sign-in for every team member.
- Daily automated database backups.
Your database, sign-in, uploaded files and backups are hosted in Mumbai, India (AWS ap-south-1), and the Artfolio app runs on servers in Mumbai. The database runs on infrastructure provided by Supabase in Amazon Web Services (AWS) data centers. A few supporting services listed in Section 5 may process limited data outside India.
While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.
5. Third-Party Services
We use the following third-party service providers to operate and improve the Service. Each provider processes data in accordance with their own privacy policies:
Supabase (Database & Authentication)
We use Supabase for database hosting, user authentication, and file storage. Supabase processes your account information, artwork data, contact records, and uploaded images. Data is stored in Supabase-managed PostgreSQL databases with row-level security enabled.
Resend (Email Service)
We use Resend to deliver transactional and notification emails, including account confirmations, password resets, invoice delivery, exhibition invitations, and team invitations. Resend processes recipient email addresses and email content on our behalf.
Google Gemini and Vertex AI (AI Features)
We use Google's Gemini and Vertex AI services to power AI-assisted features such as artwork analysis, drafting, recommendations, translations and image search. The specific content a feature needs, such as artwork images, catalog metadata or prompt context, is processed on our behalf. Some of this runs automatically while AI is on for a gallery: artwork images are indexed for image search in the background, and a new artwork's images are analysed when it is added. Turning AI off stops both. We limit the data shared to what the feature needs. Artfolio does not use your content to train AI models. These services may process data outside India (Vertex AI image search runs in the United States).
Razorpay and Cashfree (Billing)
We use Razorpay, an Indian payment provider, to take and renew plan subscriptions by card, UPI or bank mandate. We use Cashfree, also Indian, to verify GSTINs and for galleries whose plan was set up through Cashfree. Both process billing contact details and payment information on our behalf.
Sentry (Error Monitoring)
We use Sentry to detect and fix errors. Sentry receives technical details about an error, such as the page, browser and the request that failed. If you accept optional analytics cookies, Sentry may also record a short replay of the screen around an error. Sentry processes data in the United States.
Upstash (Rate Limiting)
We use Upstash to limit how often requests can be made, which protects the Service from abuse. It holds short-lived request counts keyed by IP address and may process data outside India.
Vercel (Hosting, Web Analytics & Speed Insights)
We use Vercel to host and deliver the Service. Vercel also provides privacy-friendly web analytics that help us measure aggregate visits and page views, and optional performance telemetry through Speed Insights when you accept analytics cookies. Vercel may process request metadata, IP-derived location data, browser details, and performance metrics on our behalf to operate and improve the Service.
The full, current list of providers, with where each processes data, is on our sub-processors page. We will update it, and this section, before we add a provider that handles personal data in a materially different way. If your gallery connects an integration such as Mailchimp, Shopify, WooCommerce, Webflow or Razorpay, data moves between Artfolio and your own account with that provider under its terms.
7. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
7.1 Rights Under India's DPDP Act
Under the Digital Personal Data Protection Act, 2023, you have the right to:
- Access information: Get a summary of the personal data held about you, how it is processed, and who it has been shared with.
- Correction and erasure: Have your personal data corrected, completed or updated, and erased when it is no longer needed for the purpose it was collected for, unless the law requires it to be kept (for example, tax invoices).
- Withdraw consent: Where processing is based on your consent, withdraw it as easily as you gave it. Campaign emails sent through Artfolio include an unsubscribe link.
- Grievance redressal: Raise a complaint with our Grievance Officer (see Section 12). If you are not satisfied with our response, you may complain to the Data Protection Board of India.
- Nominate: Nominate another person to exercise these rights for you if you die or become unable to do so.
If your data is held by a gallery that uses Artfolio, the gallery is responsible for answering these requests. Contact the gallery first; we will help it respond.
7.2 Rights Under GDPR (European Economic Area)
If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):
- Right of Access: You may request a copy of the personal data we hold about you.
- Right to Rectification: You may request correction of inaccurate or incomplete personal data.
- Right to Erasure: You may request deletion of your personal data, subject to certain legal exceptions.
- Right to Restrict Processing: You may request that we limit the processing of your personal data in certain circumstances.
- Right to Data Portability: You may request a machine-readable copy of your personal data for transfer to another service.
- Right to Object: You may object to the processing of your personal data for direct marketing or where processing is based on legitimate interests.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.
Our legal bases for processing personal data under the GDPR include: performance of a contract (providing the Service), legitimate interests (improving the Service, security), consent (marketing communications), and compliance with legal obligations.
7.3 Rights Under CCPA (California)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):
- Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the purposes for collection, and the third parties with whom we share your information.
- Right to Delete: You may request that we delete your personal information, subject to certain exceptions.
- Right to Opt Out: You may opt out of the “sale” of your personal information. Artfolio does not sell personal information in the traditional sense, but this right extends to certain types of data sharing.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
To exercise any of these rights, please contact us at privacy@artfolio.ai. We will respond to your request within 30 days, or sooner if the law requires it.
8. Data Retention
We retain your personal data for as long as your Account is active or as needed to provide the Service. Specific retention periods are as follows:
- Account data: Retained for the duration of your active subscription, plus thirty (30) days after account closure to facilitate data export.
- Artwork and inventory data: Retained for the duration of your active subscription and deleted within thirty (30) days of account closure unless you request an earlier or later deletion.
- Audit logs: Retained for a minimum of one (1) year for security and compliance purposes.
- Invoice and financial records: Retained for a minimum of seven (7) years as required by applicable tax and accounting regulations.
- Analytics data: Aggregated and anonymized usage data may be retained indefinitely for product improvement purposes.
- Backup data: Daily backups keep copies of your data for up to 7 days after it is deleted from the primary database.
9. Children's Privacy
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18 years of age. If we become aware that a child under 18 has provided us with personal information, we will take steps to delete such information promptly.
If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us at privacy@artfolio.ai so that we can take the necessary steps to remove that information.
10. Transfers Outside India
Your core data stays in India: Your database, sign-in, uploaded files and backups are hosted in Mumbai, India (AWS ap-south-1), and the Artfolio app runs on servers in Mumbai.
Some supporting services described in Section 5, such as email delivery, error monitoring and certain AI features, may process limited data outside India. We use them only for the purposes described, under contractual safeguards, and not in any country to which the Government of India has restricted transfers under the DPDP Act.
For transfers of personal data from the European Economic Area, we rely on Standard Contractual Clauses approved by the European Commission, or other lawful transfer mechanisms.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the “Last updated” date at the top.
For significant changes that affect how we process your personal data, we will provide additional notice through the Service (such as an in-app notification) or by sending an email to the address associated with your Account at least thirty (30) days before the changes take effect.
We encourage you to review this Privacy Policy periodically for any updates. Your continued use of the Service after changes to this Privacy Policy constitutes your acceptance of the updated policy.
12. Contact and Grievance Officer
If you have any questions about this Privacy Policy or our data practices, or wish to exercise any of your rights or raise a grievance, contact our Grievance Officer:
- Grievance Officer: MANUAL 2 AI PRIVATE LIMITED, privacy@artfolio.ai
- Account and billing help: support@artfolio.ai
- General inquiries: sales@artfolio.ai
- Website: artfolio.ai
We respond to requests within 30 days and resolve grievances within 90 days at most. If you are not satisfied with how we handle a grievance, you may complain to the Data Protection Board of India. If you are in the European Economic Area, you may also lodge a complaint with your local data protection authority.