Privacy Policy

1. Age Requirement

ArtLair is intended for users who are 18 years of age or older, consistent with our Terms of Service. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a user under 18, we will delete that account and associated data.

2. Information We Collect

We collect the following categories of information:

• Account information: username, email address, and passwords.
• Uploaded content: images and associated metadata you submit (title, description, tags, category, content rating, AI-disclosure flag).
• Discord account information (optional): if you choose to link or sign in with Discord, we receive your Discord user ID, username, and the email address associated with your Discord account.
• Technical and log data: IP address, used for login rate-limiting and abuse/spam prevention, and to process Cloudflare Turnstile captcha verification (see Section 5).
• Account access history: each time you register or log in (including via Discord or "Remember me" auto-login), we record the date/time, the IP address, and browser/device (user agent) used to access your account.
• Communications: information you submit through the contact form (name, email, subject, message) or in support tickets.
• Marketplace transaction data: records of your marketplace purchases and sales, including item IDs, sale prices in Points, transaction timestamps, and buyer/seller user IDs. This data is used to maintain your wallet balance, earnings balance, and transaction history.
• Withdrawal and banking details: when you request a withdrawal of your marketplace earnings, we collect the banking information you provide (account holder name, bank name, account number or IBAN, routing number or sort code, SWIFT/BIC code, bank country, and bank address). This information is used solely for processing your withdrawal requests via bank transfer.
• Account security codes: temporary verification codes or tokens (e.g. for password changes, email changes, or data export requests) sent to your email, stored only in hashed form and automatically expired after a short period.
• Cookies: session cookies required to keep you logged in (see Section 4).

3. How We Use Your Information

We use collected information to: operate and improve the platform, authenticate your account, send account-related emails, provide customer support, respond to reports and content moderation issues, enforce our Terms of Service, prevent abuse and spam, and maintain platform security. We also use marketplace transaction data to calculate your wallet balance and earnings, enforce the 7-day holding period on each sale before earnings become available for withdrawal, apply the platform fee to withdrawals, and process bank transfer payouts.

4. Cookies

We use session cookies to maintain your login state. These cookies are essential for the platform to function and cannot be disabled while using the service. We do not use third-party advertising or tracking cookies.

5. Third-Party Services

We share limited data with the following third parties, solely to operate the platform:

• Cloudflare Turnstile: used to verify you're not a bot on registration and certain forms. Your IP address is sent to Cloudflare as part of this verification.
• Discord: if you link or sign in with Discord, we exchange an authorization code with Discord's servers to retrieve your Discord ID, username, and email.
• Stripe: used to process Point purchases (when you top up your wallet). When you initiate a payment, Stripe receives your payment details (card number, billing information, etc.) directly through its secure checkout — we do not see or store your full card number. We receive a confirmation from Stripe that the payment succeeded, along with the amount paid, the currency, and a Stripe session/transaction identifier. Stripe's processing is governed by Stripe's Privacy Policy.
• Our email provider (SMTP): used to deliver account, verification, and notification emails.

We do not sell your personal information. We do not share it with other third parties except as required by law, to respond to legal process, or to protect the rights, property, or safety of our users or the platform.

6. Data Storage & Security

Your data is stored on secure servers. We take reasonable technical and organizational measures to protect your data, but no method of transmission or storage over the internet is 100% secure, and we cannot guarantee absolute security. Banking details you provide for withdrawals are stored in our database and access is restricted to authorized personnel involved in processing withdrawal requests.

7. Data Retention

We retain account and content data for as long as your account is active. Rate-limiting IP logs used only to throttle repeated login attempts are retained for a short period (typically no more than 30 days) and then purged automatically. Your account access history (the login/registration events described in Section 2, including IP address and timestamp) is retained for as long as your account is active, is visible to you and to platform administrators, and is included if you request a copy of your data (see Section 9). Marketplace transaction records and earnings holding logs are retained for as long as your account is active to maintain accurate balance calculations and withdrawal history. If you delete your account, we delete your personal data, including access history and banking details, within a reasonable period, except where we are required to retain certain records for legal, security, tax, or content-moderation purposes (for example, records related to a content report, Terms of Service violation, or financial audit).

8. Financial & Payment Data

We process two distinct types of financial data on the platform:

• Point purchases (wallet top-ups): processed by Stripe. We do not store your full card numbers or banking credentials — Stripe handles payment processing directly through its secure checkout. We store a record of the transaction (amount, Points credited, Stripe session ID, and timestamp) for accounting and to prevent duplicate crediting.
• Withdrawal banking details: when you withdraw your marketplace earnings, you provide banking details (account holder name, bank name, account number or IBAN, routing number, SWIFT/BIC, bank country, and bank address). These details are stored in our database and used only to process your bank transfer. We do not share your banking details with any third party except as required by law or to complete the transfer through our banking infrastructure.

Your earnings balance, holding period status, and transaction history (including the Earnings Holding Log that tracks each sale's 7-day countdown) are stored as part of your account data and are visible to you on your Withdraw Earnings page and to authorized platform administrators.

9. Your Rights

Depending on where you live, you may have the right to:

• Request access to the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Request a copy of your data in a portable format
• Object to or restrict certain processing of your data

You can request a copy of your account information — including your uploaded content, comments, and account access history (login/registration timestamps and IP addresses) — delivered to you as a PDF by email, at any time from your Account Settings page under "Your Data." For your security, we'll first email you a one-time verification code to confirm the request before sending anything. For anything else — corrections, deletion, or other requests — contact us. If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local data protection authority. If you are a California resident, you have rights under the CCPA/CPRA, including the right to know, delete, and correct your personal information; we do not sell personal information.

10. Email Communications

We send emails regarding account verification, password resets, and security-related account activity. These are necessary for the service to function and cannot be opted out of. We do not send marketing emails.

11. Content Reports & Legal Compliance

Reported content is reviewed by our staff. Where content is found to be illegal, including content depicting the sexual exploitation of minors, we remove it and report it to the relevant authorities (including, where applicable, the National Center for Missing & Exploited Children) as required by law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a prominent notice on the platform. The "Last updated" date above reflects the most recent revision.

13. Contact

For privacy-related questions or to exercise your data rights, please contact us. You may also review our Terms of Service.