Privacy Policy

Vault Canvas is an artwork management and publishing platform for artists. This policy explains, in plain English, what information we collect, why we collect it, and the rights you have over it. If anything here is unclear, contact hello@vaultcanvas.ai.

When you create an account we collect your name, email address, password (stored as a one-way hash) and basic preferences. We use this information to give you access to your archive, secure your account, and contact you about the service.

Information you add to your artist profile — biography, statement, exhibitions, education, links and profile imagery — is processed so we can render your public portfolio pages and the documents you generate from them.

Artwork records, images, descriptions, dimensions, materials, dates, narratives and supporting files you upload are stored as part of your private archive. We process this data to operate your catalogue, generate certificates and provenance pages, produce mockups and marketing materials, and render any portfolio pages you choose to publish.

You may record collector, buyer or owner details against an artwork — for example, a name, location, sale date or note attached to a provenance entry. We process this data only to maintain your private records and the provenance history of an artwork. We do not market to people whose details you record, and these records are not made public unless you explicitly publish them as part of a provenance page.

We collect basic technical information when you use the platform — IP address, device and browser type, pages viewed, and aggregated engagement events — to operate the service, maintain security, and improve performance. We do not build advertising profiles.

When you contact us at hello@vaultcanvas.ai we keep your message and our reply so we can help you and improve our support. We do not use support messages for marketing.

We process personal data under the following lawful bases: performance of our contract with you (to deliver the service); our legitimate interests (to keep the service secure, prevent abuse, and improve the product); your consent (for optional analytics or marketing emails, where applicable); and legal obligation (where we must retain or disclose information by law).

You choose what to publish. Anything you mark as public — a portfolio page, a QR provenance page, a shareable Certificate of Authenticity — is intended to be visible to anyone with the link, and may be indexed by search engines unless you opt out in the artwork settings. You can unpublish at any time, after which we will stop serving the page (cached copies on third parties may persist for a short period).

Studio AI features generate narrative, descriptive and presentation suggestions from the metadata and imagery you supply. We send only the information needed to produce a suggestion to our AI providers, under contractual terms that prohibit using your content to train their foundation models. You review and approve all AI output before it appears in your archive or on a public page.

We use strictly necessary cookies for login, session security and core platform functionality. We may use lightweight, privacy-respecting analytics where permitted, and only set optional analytics or tracking technologies where you have given consent. We do not use third-party advertising cookies. See the Cookie Policy for detail.

We rely on a small number of trusted providers to host the platform, store files, send transactional email, and power AI features. These providers process data on our instructions under written agreements and appropriate safeguards. We do not sell personal data.

Vault Canvas uses Lovable’s managed email service to deliver transactional messages, including enquiry confirmations, artist notifications and page-report notifications. For this purpose, Lovable may process recipient email addresses, message-delivery metadata and delivery events such as bounces, complaints and unsubscribe requests. Unsubscribe links in new messages may open a Lovable-hosted page governed by Lovable’s privacy notice.

When you request the free Artist Website Audit we collect the website address you submit, the address it finally resolves to after any redirects, the automated homepage findings, your answers to the guided questions, and your name and email address. We use this information to inspect the homepage you submitted, prepare your report, display it to you and email it to you. Your report is private: it is not published and there is no public report address.

Ordinary audit submissions are deleted automatically 90 days after they are submitted. You can ask for an earlier deletion by emailing hello@vaultcanvas.ai from the address you used for the audit. The audit email itself is a service message you asked for and is not treated as marketing.

Marketing permission is separate, optional and unticked by default, and declining it does not prevent delivery of your audit. Where you do give marketing permission, we keep a separate record of your email address, the wording you agreed to, and the date and time, and we retain it for that purpose until you withdraw consent. You can withdraw at any time using the unsubscribe link in any marketing email, or by contacting hello@vaultcanvas.ai.

When you ask to be considered for the private beta we collect your name, email address, the optional website address you provide, and the short note about your practice. We use this only to consider your request and to contact you about it. Submitting a request does not create an account, and requests are stored separately from user accounts, artist records, collector enquiries, website audits and marketing subscribers.

Each request carries a simple administrative status (pending, invited, declined or deleted). Pending and unsuccessful requests are deleted automatically 180 days after submission. An invited request is kept only as long as needed to provision the invitation. You can ask for earlier deletion by emailing hello@vaultcanvas.ai from the address you used.

Marketing permission on that form is separate, optional and unticked by default, and leaving it unticked does not affect your request. Where you do give marketing permission we keep a separate record of your email address, the wording you agreed to, and the date and time. Deleting a beta access request does not delete a valid marketing consent record, and withdrawing marketing consent does not alter your request. You can withdraw at any time using the unsubscribe link in any marketing email, or by contacting hello@vaultcanvas.ai.

We retain account and archive data for as long as your account is active. If you delete your account, we remove your data from active systems within 30 days, subject to limited retention in encrypted backups (typically up to 90 days) and any retention required by law.

You own your archive. You can export your catalogue and supporting files at any time, and you can delete individual records or your entire account from your settings. To request assistance with export or deletion, contact hello@vaultcanvas.ai.

Depending on where you live, you have rights to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw any consent you have given. You can also lodge a complaint with your local data protection authority. To exercise any of these rights, email hello@vaultcanvas.ai and we will respond within a reasonable timeframe.

The platform and some service providers may process data outside your country of residence, including in the United Kingdom, the European Economic Area and the United States. Where data is transferred internationally, we rely on recognised safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses or equivalent mechanisms.

Questions about this policy, or any data rights request, can be sent to hello@vaultcanvas.ai.