At Artclerk, we take the privacy and security of your collection data seriously. This Privacy Policy describes how we collect, use, share, retain, and protect information when you use our platform. For the processing described here, Artclerk determines the purposes and means of processing and acts as the data controller where applicable.

1. Information We Collect

To provide our collection management services, we collect:

• Account Information: Name, email address, selected language, and organisation details when you register.
• Collection Data: Information about artworks, artists, contacts, and conservation records that you enter into the system.
• Usage Data: Technical logs, IP addresses, and browser information used for system security and performance.
• Registration security signals: When you use our registration form, Cloudflare Turnstile processes limited device and network signals, such as your IP address, TLS fingerprint, user-agent header, and the registration site's origin, to distinguish people from automated traffic. Turnstile does not access, store, or transmit your registration form entries.
• Referral attribution data: If you arrive through a referral link, we may store the referral code in anartclerk_ref cookie for up to 90 days so we can attribute a later registration or purchase to the referring partner.

2. How We Use Information and Our Lawful Bases

We use information to:

• Provide, maintain, secure, and support the Artclerk platform.
• Create and manage your account, process transactions, and send service communications.
• Improve our AI-assisted search and cataloguing capabilities.
• Attribute eligible registrations or purchases to referral partners.
• Meet legal obligations and establish, exercise, or defend legal claims.

Depending on the activity and applicable law, we process information because it is necessary to perform our contract with you or take steps at your request, because we have a legal obligation, or because it is in our legitimate interests and those interests are not overridden by your rights. Those legitimate interests include operating and securing the service, helping a newly registered user get started, and making that first service communication relevant to their organisation.

3. Registration Welcome Email and Personalisation

After account registration, Artclerk sends one welcome email through Resend. This is an account and service-onboarding communication, not a marketing-email subscription. We rely on contractual necessity, where applicable, and our legitimate interests in confirming registration and helping you begin using the service. We do not rely on consent as the lawful basis for this single welcome email.

To make the email more relevant, OpenAI may research publicly available information about the registered organisation and produce one optional personalised sentence. Artclerk sends OpenAI only the organisation name, organisation type, selected language, and the normalised custom email domain. The complete email address and its local part (the text before@) are not sent to OpenAI. This limited personalisation is based on Artclerk's legitimate interest in providing a relevant welcome; the sentence may be omitted and has no effect on your account or access to the service.

Resend receives the recipient's complete email address and the rendered message so it can deliver the welcome email. OpenAI and Resend act as Artclerk's service providers and data processors for these activities, subject to their own documented security, legal, and abuse-prevention requirements.

4. AI and Automated Decisions

AI is used only to help draft the optional sentence described above. It does not make consequential decisions, determine eligibility, decide whether an account may use Artclerk, or carry out solely automated decision-making that produces legal or similarly significant effects.

5. Sharing and Service Providers

Artclerk does not sell your collection data or personal information. We share information with service providers only as needed to operate the platform, as described in this policy, or when required by law. For the welcome flow, those providers includeOpenAI for the limited research and text generation described above andResend for email delivery.

We use Cloudflare Turnstile to protect registration from bots and abuse. Cloudflare processes the registration security signals described above on our behalf to provide this service. Cloudflare may also process those signals as a controller to improve Turnstile's bot-detection capabilities. Details are in Cloudflare'sTurnstile Privacy Addendum.

6. Retention

Artclerk retains finalised welcome-delivery records for 30 days and then deletes or de-identifies them. OpenAI, Resend, and their authorised subprocessors may retain data under their own documented schedules for service security, legal compliance, fraud or abuse monitoring, backups, and dispute resolution. Their retention may therefore differ from Artclerk's 30-day welcome-record period. Cloudflare retains Turnstile signals according to the criteria and periods in its applicable privacy and data-processing terms. OpenAI publishes its API data controls, including applicable abuse-monitoring retention, in itsdata controls documentation, and Resend documents its processing and retention in itsData Processing Addendum. Cloudflare describes Turnstile processing in itsTurnstile Privacy Addendum andData Processing Addendum.

7. International Transfers

Artclerk's service providers and their subprocessors may process information outside your country, including in the United States, where privacy laws may differ. Where applicable law requires a transfer mechanism, safeguards may include an adequacy decision, data processing terms incorporating approved Standard Contractual Clauses, and technical and organisational security measures. You may contact us for more information about safeguards relevant to your data.

8. Data Security

We use technical and organisational measures designed to protect data in transit and at rest, restrict access, isolate customer data, and monitor the service for security and reliability. No method of transmission or storage is completely secure.

9. Your Rights and Choices

Subject to applicable law and its exceptions, you may ask to access, receive a copy of, correct, delete, restrict, or transfer your personal information. You may object to processing based on legitimate interests, including the limited personalisation described above. Where we rely on consent for another activity, you may withdraw it without affecting the lawfulness of earlier processing. We may need to verify your identity and may retain information where the law permits or requires it.

You may also complain to the data protection authority responsible for your location. In Thailand, this is the Office of the Personal Data Protection Committee. We encourage you to contact us first so we can try to resolve your concern.

10. Contact Us

To exercise your rights, object to processing, request deletion, or ask about this Privacy Policy and international-transfer safeguards, contact Artclerk atprivacy@artclerk.net.