Privacy policy

The data controller is the company whose registered particulars are published on the legal information page. We are not required to appoint a data protection officer and have not appointed one; privacy questions are handled by the same people who answer support, at support@artgalleryclothing.shop.

This policy is written under the UK GDPR and the Data Protection Act 2018. If you are in the EEA the EU GDPR also applies to you, and if you are in California the CCPA gives you the additional rights described in section 9.

Account

Your email address, a hashed password or a sign-in token, and the dates your account was created and last used.

Readings

The photographs you upload, the fibre content and colour depth read from them, the sentence you wrote about what you were washing the item with, and the reading produced.

Subscription

Which plan you are on, when it renews, your billing country for VAT purposes, and the last four digits, card type and expiry date of the card on file. We never receive or store your full card number.

Technical

Your IP address, browser and operating system, and the pages you requested, held in server logs. These exist so we can find faults and detect abuse.

Analytics

Aggregate page-view counts, and only if you accepted analytics storage in the cookie notice. If you rejected it, or ignored it, no analytics storage is set and no analytics data is collected. See the cookies page.

We do not collect special category data, we do not build profiles of you, and we do not make any automated decision that produces a legal or similarly significant effect on you. A reading about laundry is not such a decision.

Photographs are the most sensitive thing you give us, because a photograph of a garment is taken in your home. So:

• They are sent to the model provider for the sole purpose of reading fibre content and colour depth, under a contract that prohibits training on them and requires their deletion after processing.
• On the free plan they are deleted from our storage within 24 hours of the reading being produced.
• On a paid plan they are kept alongside the garment record so that a later wash starts from what you already know, until you delete the record or close your account.
• They are never used to train a model, ours or anyone else’s.
• If a photograph you upload happens to show a person, tell us and we will delete it immediately. Better still, do not upload one — the reading needs the label and the cloth, nothing else.

Contract

Providing the service you signed up for: producing readings, keeping your records, running your subscription. Article 6(1)(b).

Legitimate interests

Keeping the service secure and available, investigating faults, preventing abuse, and improving the risk table. Article 6(1)(f). We have assessed that these do not override your interests because the data involved is minimal and the processing is what a user would expect.

Consent

Analytics storage, and marketing email if you ever ask for it. You can withdraw consent at any time and it is as easy to withdraw as it was to give. Article 6(1)(a).

Legal obligation

Keeping records of transactions for tax and accounting purposes. Article 6(1)(c).

Photographs, free plan

24 hours from the reading being produced.

Photographs, paid plan

Until you delete the record or close your account.

Readings and garment records

Until you delete them or close your account.

Account

Until you close it. A closed account is deleted from live systems immediately and purged from backups within 30 days.

Transaction records

Six years from the end of the relevant financial year, because tax law requires it. This survives account closure and cannot be deleted on request.

Server logs

30 days, then deleted.

We use a small number of processors, each under a written contract:

• A cloud hosting and database provider, which stores your account, your readings and your photographs.
• A model provider, which receives photographs solely to read fibre content and colour depth, and is contractually prohibited from training on them or retaining them after processing.
• A payment processor, which receives your card details directly from your browser and tells us only whether a payment succeeded.
• An email provider, which sends account and billing emails.

We do not sell personal data, and we have never sold personal data. We do not share it for cross-context behavioural advertising. We will disclose data if we are legally required to, and we will tell you if we are permitted to.

The current list of processors, with their names and locations, is available on request from support@artgalleryclothing.shop.

Some of our processors operate outside the United Kingdom. Where personal data is transferred out of the UK, we rely on one of the following:

• UK adequacy regulations, where the destination country has been found to provide an adequate level of protection; or
• the International Data Transfer Agreement (IDTA) issued by the Information Commissioner; or
• the UK Addendum to the EU Standard Contractual Clauses, where the processor is already using those clauses.

In every case we carry out a transfer risk assessment before the transfer begins. You can ask us for a copy of the relevant safeguard and we will provide it.

Traffic to and from this site is encrypted in transit. Data is encrypted at rest. Access to production data is limited to the people who need it, protected by two-factor authentication, and logged. Passwords are stored as hashes and cannot be read by us.

If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner within 72 hours and tell you without undue delay where the risk is high.

Under the UK GDPR you have the right to:

• be told what we hold about you, and get a copy of it;
• have inaccurate data corrected;
• have data erased, where we have no overriding reason to keep it;
• restrict how we process it while a dispute is resolved;
• receive the data you gave us in a portable format, or have it sent to another provider;
• object to processing based on legitimate interests, including a general objection at any time;
• withdraw consent where consent is the basis.

Most of these you can exercise yourself from your account page without asking us: export your data, delete a record, delete your account. Anything else, write to support@artgalleryclothing.shop. We respond within one month and there is no charge.

If you are in California, you additionally have the rights to know, to delete, to correct, to opt out of sale or sharing, and not to be discriminated against for exercising them. We do not sell or share personal data as those terms are defined in the CCPA, so there is nothing to opt out of, but the request route is the same address.

If you are unhappy with how we have handled your personal data, tell us first and we will try to fix it. You do not have to, and it does not affect your right to complain elsewhere.

You have the right to lodge a complaint with the Information Commissioner’s Office, the UK supervisory authority for data protection. You can do that at ico.org.uk, or by calling their helpline on 0303 123 1113, or by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

If you are in the EEA, you may also complain to the supervisory authority in the country you live or work in.

This service is for adults and you must be 18 or over to use it. We do not knowingly collect personal data from children. If we learn that an account belongs to someone under 18, we close it and delete the data. If you believe a child has given us data, write to us and we will remove it.

If we change this policy in a way that affects how we use data you have already given us, we will email you before the change takes effect. Other changes take effect when published, and the date at the top of this page changes.