Privacy and cookie notice

Who we are

Artcestry is owned and operated by GVOC LTD, registered in England and Wales under company number 15935169. Its registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. GVOC LTD is the data controller for the personal data described in this notice.

You can contact us about anything in this notice at hello@artcestry.org.

What we collect and why

We run our own analytics on our own database. We do not use Google Analytics or any other third-party analytics, advertising or social media tracking.

Anonymous analytics (all visitors, whether you accept or reject)

For every visitor, including visitors who reject, we record basic usage without any identifier:

for each page you view: the page address without any query string, the page title, the domain of the website that referred you (not the full address), any campaign tags in the link you followed (Urchin Tracking Module, or UTM, parameters), an approximate country and a timestamp;
when you use one of our buttons or links (for example to join, to read this notice or to email us): which one, the text shown on it and the page it was on;
when the consent banner is shown and whether you accept or reject;
whether a membership sign-up went through or failed, and why it failed (never your email address).

These records carry no cookie and no identifier, so they do not link one visit to another and we cannot tell who you are from them. They do not include your browser's user-agent string or language. Our records never store your Internet Protocol (IP) address. The approximate country comes from our host, Netlify, and we store only the country.

Lawful basis: our legitimate interest in understanding and improving the site.

Linked analytics (only with your consent)

If you accept, we store an identifier in your browser so we can recognise return visits and see how journeys through the site unfold. The records above are then linked to that identifier and to an identifier for the current visit, and we also keep:

your browser's full user-agent string (which names your browser, its version and your operating system) and your browser language;
your approximate country, the referring domain and the campaign tags of your visits;
when you first and last visited, and when each visit started and was last active.

Lawful basis: consent. If you later reject, we delete these records (see Retention).

Member emails (only if you sign up)

If you become a member, we collect your email address and whether you are an artist, art lover, collector, gallery, museum, auction house or other institution (you choose one when you sign up). We use them to send you Artcestry member emails. The membership form is separate from commenting and its optional newsletter Join button.

By submitting the membership form, you agree to receive one Artcestry member email a week. We use Mailchimp, our email provider, to add you to our member list as soon as your sign-up succeeds. No email confirmation is required. Lawful basis: consent. You can unsubscribe at any time using the link in any member email or by contacting us.

We do not use open or click tracking in our member emails.

Our sign-up service uses your IP address only in memory, to limit repeated sign-up attempts. Neither it nor our analytics service stores or logs your IP address.

Likes (only if you press Like)

When you press Like, we store a record that this browser liked that post: the post, a secret-keyed code worked out from a random token in your browser's likes cookie, never the token itself, and the time. The code is different for each post.

To stop abuse, we use your Internet Protocol (IP) address briefly and store only a secret-keyed code worked out from its normalised form. For Internet Protocol version 6 (IPv6), we use its network part. We keep that code with the type of request, a one-minute window and a count. Our records and logs hold no raw IP address and no raw likes token. These codes are pseudonymous.

Likes need no name, email or account and never subscribe you to anything. Likes work whether you accept or reject analytics.

Lawful basis: our legitimate interest in providing the like feature you ask for and in protecting the site from abuse.

Comments and the optional newsletter Join

When you post a comment, your display name, comment text, post and timestamp are public. Accepted comments appear immediately; we moderate afterwards and may hide or delete them. No account is needed, and giving an email address does not verify your identity. Readers cannot edit or delete their own comments through the site; contact us for removal.

Replies are public comments linked to another comment on the same post. If we remove a comment, other people's replies may remain, with the removed comment's name and text no longer shown.

The email, keyed-code, moderation, erasure, retention and optional Join rules in this notice also cover replies.

Your email address is trimmed and lowercased, kept separately from public comments and never shown or returned by public comment endpoints. We also keep a secret-keyed email code so we can prevent abuse and find and erase older comments after the readable email has expired. The code remains personal data: it is pseudonymous, not a guarantee of anonymity.

Abuse prevention uses temporary keyed Internet Protocol (IP) codes, rate counters, duplicate and retry receipts, and moderator blocks. We store no raw IP address in application records or logs. Comment identity is separate from the likes cookie and analytics identifiers. Commenting works whether you accept or reject analytics.

Lawful basis: our legitimate interest in publishing the comments you ask us to publish, moderating discussion, handling removal requests and protecting the site from abuse.

After an accepted comment, we offer “Commenting joins the family. Become a member?” with a Join the family button and this explanation: “Tap to join the family and receive Artcestry's Thursday email. You can leave at any time. Your comment is already live.”

We use your consent to send the Thursday newsletter. Posting a comment does not give that consent. Neither does posting a reply. Only tapping the Join the family button asks us to subscribe the email used for that comment.

The optional Join uses single opt-in: no confirmation email is required. For an eligible new subscription or an existing subscriber, Mailchimp receives the email, the “Unframed commenter” source tag and a consent note recording the time, source, notice and copy versions, exact consent text and an opaque receipt code. We also keep local consent evidence. We do not send Mailchimp your comment text, display name, IP address or database identity codes, or invent a membership type. If an existing address is unsubscribed, cleaned, pending, transactional, archived or unknown, we do not change that status. A request we cannot confirm is shown as uncertain, not as a successful subscription.

Event suggestions (only if you submit an event)

When you use “Submit an event” on the events page, we store the link, event name, dates, city and country you send, and the time you sent them. We use them only to check the event's own page and, if that page shows the event's name, dates and city, to list the event in the calendar. We publish only what the event page says, never what you typed.

Your email address is optional. We store it only if you tick the box that reads: “Artcestry may email me about this event, for example to check a detail. My email is never published or added to the newsletter, and it is deleted after 90 days.” We use it only to contact you about that event. It is never published, never sent to Mailchimp and never added to the newsletter.

To stop abuse, we use your Internet Protocol (IP) address briefly and store only a secret-keyed code worked out from it, with a count for each hour and each day. We store no raw IP address. The daily calendar check runs on GitHub's servers and reads the link, event name, dates, city and country of recent suggestions; it never reads your email address or the IP code. Suggesting an event works whether you accept or reject analytics.

Lawful basis: our legitimate interest in keeping a complete and accurate events calendar and in protecting the site from abuse. For the optional email, your consent, which you can withdraw at any time by contacting us.

No automated decisions

We use automated spam and rate checks to protect forms and comments. We do not use these checks to profile you or make decisions that have legal or similarly significant effects on you.

Cookies and similar storage

The site sets one cookie, only if you press Like. This is the complete list of what it stores in your browser. Before you make a choice in the consent banner, and after you reject, it can store the record of your choice, the motion setting if you use the pause control, and the likes cookie if you press Like. If JavaScript is turned off, it stores nothing at all; the Like button only appears with JavaScript.

__Secure-unframed_liker (cookie, first-party, HttpOnly, set by our server only when you first press Like): remembers which posts this browser liked so you can undo a like. HttpOnly means that page scripts cannot read or write it. It lasts 180 days from when it is set and is not renewed by reading or liking. It is strictly necessary for the like feature you ask for, so it does not wait for analytics consent, and accepting, rejecting or withdrawing analytics consent does not change it. Clearing it or letting it expire means the site no longer recognises your earlier likes and you cannot undo them, but it does not delete them.
artcestry-consent (browser localStorage, first-party): remembers your choice and the version of this notice it applies to. Kept until you change it or clear your browser. If this notice changes version, the site asks you again.
artcestry-visitor-id (browser localStorage, first-party, set only after you accept): recognises return visits. Kept until you reject or clear your browser.
artcestry-session-id (browser sessionStorage, first-party, set only after you accept): groups a single visit. Cleared when you close the tab.
artcestry-motion-paused (browser localStorage, first-party, set only if you press Pause on the motion control): keeps the page's animation paused on later visits. Removed when you press Play, or when you clear your browser.

Rejecting analytics removes analytics identifiers and linked analytics records, not the likes cookie or your likes.

Our fonts are served from our own site, so loading a page makes no request to Google Fonts.

You can change your choice at any time with Cookie settings, at the foot of every page.

We do not sell your data. We use these service providers, each acting on our instructions:

Netlify, our host, based in the United States. Netlify processes your IP address to deliver the site and to limit repeated requests to it, and the services that receive our analytics events, membership sign-ups, event suggestions and requests to the like feature, including comment requests, run on Netlify's servers in the United States. This is an international transfer, made under the United Kingdom Extension to the European Union-United States Data Privacy Framework, which Netlify's data processing agreement names as the basis for transfers from the United Kingdom.
Amazon Web Services, which hosts the database that holds our own analytics and the like and abuse-prevention records, in London, United Kingdom. It also holds the separate public and private comment records and the event suggestions described above.
Intuit Mailchimp, in the United States, which receives the email address and the member type you choose through the membership form, to store your subscription and send member emails. If you use the optional comment Join, it receives the email and source tag and consent note described above instead of a membership type. This is an international transfer, made under the United Kingdom Extension to the European Union-United States Data Privacy Framework, with which Mailchimp states it complies.

Retention

We keep analytics event records (page views, clicks and banner choices) for up to 14 months. If you accepted, the profile linked to your identifier is kept until 14 months after your last visit. A daily job deletes anything older.

Likes are kept until you undo them. They do not expire under the 14-month analytics rule and are not deleted when a post is removed. Abuse-prevention records become eligible for deletion after 24 hours and are removed by the next successful daily clean-up.

Plaintext commenter email is cleared after 14 calendar months from the comment's creation. The keyed email code stays while the comment remains, so we can find it for an address-based erasure request. That key is removed on comment deletion or erasure; separate receipt and block records have the bounded periods below.
Public names and comment text stay until explicit deletion or erasure. Hiding alone does not delete them. Deletion leaves a structural tombstone: the comment ID, post, time and relationship fields, without your name, text or private sender row.
Comment IP codes are cleared after 30 days. Duplicate and retry receipts become eligible for deletion after 24 hours. Rate counters become eligible for deletion after 24 hours.
Email blocks expire 14 calendar months after the last explicit block action; their IP part expires after 30 days. Expired blocks and duplicate receipts stop affecting requests at their exact expiry, even if clean-up is pending.
Local Join consent evidence is kept for 14 calendar months after the tap, or removed earlier if the comment is deleted or erased. Moderation audit records are kept for 30 days and contain only the action, time, affected count and outcome, with no comment content or sender identity.

Event suggestions, including any email address sent with them, are deleted 90 days after they are sent. Their abuse-prevention counters are deleted after two days. An event that passed the check stays in the calendar as its own page describes it.

Eligible private records are cleared by the next successful daily clean-up. A backlog or failure can delay physical removal; the job reports incomplete work and failures for us to review. The normal purge does not delete public comments, likes, source posts or published pages.

Mailchimp membership and consent evidence are held separately for the newsletter until erasure; unsubscribe stops marketing and retains the suppression information needed to respect that choice. Comment erasure does not automatically erase newsletter records: newsletter erasure is separate and can be requested from us.

Our database, including analytics, likes, comments and abuse-prevention records, is backed up automatically and backups are kept for 7 days, so a record we delete can remain in a backup for up to 7 days before it is gone.

We keep your membership details until you unsubscribe. After you unsubscribe, Mailchimp keeps your email address as an unsubscribed contact, so that you are not emailed again; you can ask us to delete it completely.

You can withdraw consent at any time by choosing Reject in Cookie settings, at the foot of every page. This deletes the identifiers stored in your browser and the analytics records linked to your identifier in our database, and stops linked analytics from then on. Anonymous analytics continues, as it does for every visitor.

Your rights

You have the right to:

access your personal data;
have it rectified;
have it erased;
restrict our processing of it;
object to our processing of it;
data portability, where applicable;
withdraw consent at any time.

Because our anonymous analytics are not linked to you, we cannot identify you from them, so these rights apply to identifiable data, including linked analytics, comment data and membership details. To act on them, contact hello@artcestry.org. For comment erasure, tell us the email used for your comments; we use its keyed code to find matching comments even after the readable email has expired. Tell us separately if you also want newsletter erasure. To raise a concern about a comment, include its link. Where we rely on legitimate interest, you have the right to object.

Complaints

If you have concerns, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.