Privacy Policy

Trace Studio 22 LLC, trading as Trace, is the data controller for the information described here. That means we decide what is collected and why, and we are the ones you can hold to account for it.

You can reach us about anything on this page through our contact page, which lists a dedicated route for privacy and data requests.

Trace is registered in Tbilisi, Georgia. Georgian data protection law applies to us directly, and because we offer the platform to people in the UK, EU and EEA, the UK GDPR and EU GDPR apply to us as well.

[TO CONFIRM: the registered address; and an EU representative under GDPR Article 27 — as a controller established outside the EU that offers services to people inside it, appointing one is a requirement, not an option.]

When you create an account:

• —your name and username — shown publicly on your profile
• —your email address — used to sign you in and contact you
• —your country — used for tax, payments and legal compliance
• —your phone number — optional, and only used for account security if you give it
• —your password — stored only as a cryptographic hash, never in readable form

When you use Trace: the work you list, the posts, comments and messages you write, the communities and exhibitions you join, who you follow, and what you collect. Most of this is content you are deliberately publishing.

If you sell work: the details needed to pay you and to meet tax and anti-fraud obligations, plus shipping addresses for the works you send.

Automatically: your IP address, browser and device type, and basic logs of pages loaded and errors hit. We use these to keep the service working and to investigate abuse.

If you fill in the optional practice details at signup — portfolio link, social handles, mediums, vision statement — those are published on your profile.

We do not sell your personal data. We do not share it with advertisers or data brokers. There is no advertising on Trace, so there is no ad profile of you to build.

We do not use your personal data or your artwork to train machine-learning models.

We never see or store your full card number or bank credentials. Payments are handled by a regulated payment provider that collects those details directly.

[TO CONFIRM: which payment provider and which hosting provider, so both can be named here.]

If you are in the UK, EU or EEA, the GDPR requires us to have a lawful basis for each use. Ours are:

• —Performing our contract with you — running your account, showing your work, processing sales and payouts
• —Legal obligation — tax records, anti-money-laundering checks, responding to lawful requests
• —Legitimate interests — keeping the platform secure, investigating fraud and abuse, and fixing faults; we balance these against your rights and use the least data that works
• —Consent — for anything optional, such as marketing email. You can withdraw consent at any time, and doing so is as easy as giving it

Trace uses cookies strictly necessary to keep you signed in and to keep the platform secure. We do not use advertising or cross-site tracking cookies.

The app also stores some things in your own browser rather than on our servers — which communities you have joined, posts you have saved, drafts, and interface preferences. That data stays on your device, is not transmitted to us, and disappears when you clear your browser storage.

Anything you publish — your profile, listings, posts, comments in public communities — is visible to other people on Trace, and public profiles may be visible to anyone on the internet. Posts in closed or invite-only groups are shown only to that group's members.

Owning a work is different. Every artwork keeps a public record of its history, but you decide how you appear in it, separately for each piece you own: by name, as "Private collection" with your city, or as "Private collection" alone. Private is the default — you are never named publicly unless you choose to be — and you can change it at any time. The record of the sale stays intact and verified either way; only whether it carries your name changes.

To be clear about what that setting does and does not do: it controls what other people see. Trace itself always knows who owns a piece, because we cannot ship a work, release an escrowed payment, settle a dispute or meet anti-money-laundering and tax obligations without knowing. That knowledge is also what makes an anonymous entry worth anything — "Private collection" means we verified the sale and chose not to publish the name, rather than that nobody knows. We treat owner identity as sensitive, restrict who inside Trace can see it, and use it only for those purposes.

Behind the scenes we share data with service providers who process it only on our instructions and under contract: our hosting provider, our payment processor, our email provider, and shipping carriers for works being delivered.

We may disclose data where the law compels us to, or where it is necessary to protect someone's safety. If we ever receive a government request for your data, we will tell you unless we are legally forbidden from doing so.

If Trace is ever acquired, your data may transfer to the buyer — who would remain bound by this policy until you are told otherwise and given a chance to leave.

Account and profile data is kept while your account is open. When you close it, your profile and content are removed from public view immediately and deleted within 30 days.

Some records outlive that: transaction and tax records are kept for the period the law requires (typically 6–7 years), and records of serious violations are kept long enough to stop banned accounts simply being recreated.

Backups are overwritten on a rolling cycle, so deleted content can persist in backups for a short period after deletion.

Wherever you live, you can ask us to:

• —show you what we hold about you
• —correct anything wrong
• —delete your data
• —give you a copy in a portable format
• —stop or limit a particular use, including anything based on legitimate interests

We will respond within 30 days and will not charge you or make your experience worse for asking. If you think we have handled your data badly you can complain to a regulator — your national data protection authority if you are in the UK, EU or EEA, or the Personal Data Protection Service of Georgia, which supervises us directly. We would rather you came to us first.

Trace is available internationally, so your data may be processed in a country other than your own. We are established in Georgia, which the European Commission has not issued an adequacy decision for — so where personal data moves from the UK, EU or EEA to us or to our providers, we rely on Standard Contractual Clauses (and the UK Addendum) to protect it.

You can ask us for a copy of the safeguards we have in place for any particular transfer.

[TO CONFIRM: the countries data is actually processed in, once hosting and payment providers are chosen.]

Trace is not for under-16s, and selling work requires you to be 18. We do not knowingly collect data from children. If you believe a child has an account here, tell us and we will remove it.

If we change how we use your data in a way that materially affects you, we will tell you by email and on the platform at least 30 days before it takes effect — not quietly update this page.

[TO CONFIRM: a privacy contact address for questions and data requests.]