Loading...
Loading...
Last updated: October 12, 2026
The data controller is the Athenoir Association (Stichting), registered in Amsterdam, the Netherlands. For data protection inquiries, contact privacy@athenoir.com.
Account data: Name, email address, password (hashed), role, subscription tier.
Artist profiles: Name, nationality, biography, portfolio images, medium, location, education, exhibition history. For unclaimed profiles, only publicly available information is used (Article 14, GDPR).
Transaction data: Purchase details, payment status, shipping information, commission records. Financial details are processed by Stripe and never stored on our servers.
Usage data: Page views, search queries, feature usage (anonymized via analytics).
Consent: Newsletter subscriptions, marketing communications, premium content access.
Contractual necessity: Account management, transaction processing, artist claim workflow.
Legitimate interest: Platform security, fraud prevention, service improvement, preliminary artist profiles from public sources (Article 6(1)(f), GDPR).
We create preliminary artist profiles using publicly available information from gallery websites, exhibition catalogs, and public databases. This processing is based on our legitimate interest in building a comprehensive art platform (Article 6(1)(f), GDPR).
Artists may at any time: claim and edit their profile, request corrections, or request complete deletion by emailing privacy@athenoir.com. Unclaimed profiles are automatically deleted after 90 days.
Artists who opt into the First Look feature consent to their artwork images being sent to an AI language model for aesthetic analysis. This processing is based on explicit, freely given consent (Article 6(1)(a), GDPR). Consent may be withdrawn at any time; withdrawal does not affect the lawfulness of prior processing.
The AI reflection is provided through an Anthropic-compatible model inference gateway (Operayde, gw.operayde.com), acting as a data processor under Article 28 GDPR. Your image is transmitted only for the purpose of generating the requested reflection. We do not make representations about whether the gateway provider uses submitted content for model training — artists should review the applicable processor terms before opting in.
Free First Look, account created by confirming your email. On the homepage you can upload one image without a password. The image and the reading are held on our own servers in a private area that is not publicly reachable, addressed only by a random token stored in a cookie on your device, while you confirm a one-time code sent to the email you provide — this is how we verify the email and create your account; no password is set or needed. If the code is never confirmed, or you choose “Discard now,” the image and reading are deleted, typically within 24 hours. Once confirmed, the work becomes a private draft in your new account: visible only to you, retained until you delete it or your account, and never published unless you explicitly choose to publish it to the gallery. Files pending email confirmation are excluded from backups; saved private drafts are backed up like the rest of your account data. We apply per-device and daily limits to this free service to prevent abuse.
AI-generated reflections are aesthetic observations only. They do not constitute appraisals, valuations, certificates of authenticity, or professional advice of any kind.
We share data with: Stripe (payments), our SMTP provider (email delivery), Cloudflare (CDN/security), and, where artists have opted in, the AI inference gateway described in section 5. We do not sell personal data to third parties. Anonymized, aggregated market data may be provided to research partners.
Account data: retained while account is active, deleted within 30 days of account deletion. Transaction records: retained for 7 years (legal/tax requirements). Unclaimed artist profiles: deleted after 90 days. First Look images and readings pending email confirmation: deleted within 24 hours if never confirmed. Once confirmed, the resulting private draft is retained as ordinary account data (above), not on a separate timer. Analytics data: anonymized after 26 months.
You have the right to: access your data, rectify inaccuracies, erase your data ("right to be forgotten"), restrict processing, data portability, and object to processing. To exercise these rights, email privacy@athenoir.com.
Data may be transferred between our entities in the Netherlands (Stichting) and Abu Dhabi (ADGM LLC) under Standard Contractual Clauses. Server infrastructure is located in the EU (Hetzner, Germany).
We use essential cookies for authentication and session management. Analytics cookies (GA4) are loaded only with your consent. You may manage cookie preferences at any time via the cookie banner.
We implement industry-standard security measures including HTTPS encryption, hashed passwords, rate limiting, and regular security audits. Payment data is handled exclusively by Stripe (PCI DSS Level 1 certified).
We may update this policy periodically. Material changes will be communicated via email or platform notification. Continued use after changes constitutes acceptance.