Privacy Policy

This Privacy Policy explains how Primatura ("we," "us," or "our") collects, uses, and protects information in connection with the Primatura platform, all Primatura-powered gallery websites, and Gallery Passport (our cross-gallery collector network, formerly "Primatura Pass," at pass.primatura.com). It applies to three groups of people: gallery operators — businesses and individuals who use Primatura to build and operate gallery websites — gallery visitors — members of the public who browse Primatura-powered gallery websites — and collectors — individuals who create a free Gallery Passport to save works and follow artists across participating galleries. Where provisions apply only to one group, that is indicated. By using the Primatura platform, a Primatura-powered gallery website, or Gallery Passport, you acknowledge the practices described in this policy.

1. Information We Collect

From gallery operators (Primatura account holders):

Account information: When you register, we collect your name, email address, and payment information (processed securely by Stripe; we do not store full card numbers).

Gallery content: Artwork images, titles, descriptions, artist profiles, and other content you upload to your gallery.

Usage data: Pages visited, features used, and general interaction data used to improve the platform.

Technical data: IP address, browser type, and device information collected automatically via standard web server logs and analytics.

From gallery visitors (visitors to Primatura-powered gallery websites):

Contact form submissions: Messages submitted through the gallery website's built-in contact form, including name, email address, optional phone number, and message content. This data is stored and made accessible to the gallery owner through their dashboard.

Like counts: When a visitor clicks the Like button on an artwork page, an anonymous count is incremented in our database. No personal information is collected. See Section 8 for details on browser local storage used to support this feature.

Traffic data: Basic request data (IP address, browser type, pages visited) collected automatically via Cloudflare infrastructure for security and performance purposes. This data is not linked to individual visitor identities.

Aggregate page-view analytics: Counts of page views on Primatura-powered gallery websites are recorded in aggregate so gallery operators can see how their site is performing. No cookies, local storage, device identifiers, or account information are used to track visitors. Sessions are inferred server-side using a short-lived, salted hash of the visitor's truncated IP address and User-Agent string; the salt rotates and is discarded daily, so the same visitor on two different days cannot be correlated. No raw IP address or User-Agent is stored alongside the hash. See Section 3 for details.

From collectors (Gallery Passport account holders):

Account information: Your email address (used for passwordless magic-link sign-in) and, if you choose to provide them, your display name, phone number, and profile photo. A Gallery Passport identity is created the first time you sign in.

Saves, follows, and preferences: The works you save, the artists you follow, the gallery each save or follow originated from, and your notification preferences (instant or daily digest, and which channels you have enabled).

Engagement signals: A per-gallery visit counter and timestamps, works you scan via QR wall labels, and share-button interactions (including a coarse country code derived from your IP address, not a stored IP). These are used to power your Passport and the gallery-facing features described in Section 3a.

Check-in and in-person data: If you check in at a participating gallery (for example, via a front-desk QR code or kiosk at an opening), the information you provide — such as name, email, city, how you heard about the gallery, and works that caught your eye — and, if a gallery's staff record it, private interest notes about works you discussed in person. See Section 3a.

2. How We Use Your Information

• To provide, operate, and improve the Primatura platform
• To process subscription payments and send billing notifications
• To deliver contact form submissions to gallery owners
• To send transactional emails (password resets, account notices)
• To respond to support requests
• To detect and prevent fraud or abuse

We do not sell your personal data to third parties. We do not use your content for advertising purposes.

3. Gallery Visitor Data

When visitors browse your Primatura-powered gallery website, basic usage data may be collected via Cloudflare infrastructure for performance and security purposes.

Contact form submissions. When a visitor submits a contact inquiry through your gallery website, the following information is stored in our database: name, email address, optional phone number, and message content. This data is retained and accessible to the gallery owner and any team members with Editor-level access or above through their Primatura dashboard. It is not shared with other galleries or used for any purpose beyond delivering the inquiry to the gallery's authorized users.

Team member access. Gallery operators may invite team members to access their dashboard. Depending on their assigned role, invited team members may have access to gallery content, visitor contact submissions, order history, and other operational data. Gallery operators are responsible for managing team member access and ensuring that invited members handle any personal data in compliance with applicable privacy laws.

Like counts. When a visitor clicks the Like button on an artwork page, an anonymous like count is incremented in our database. No personal information identifying the visitor is collected or stored in connection with this action. See Section 8 for details on the browser local storage used to support this feature.

Share actions. When a visitor uses the Share button, the action is handled entirely within the visitor's browser — either via the device's native share interface or by copying a URL to clipboard. No data about share actions is transmitted to or stored by Primatura.

Aggregate page-view analytics. Primatura records aggregate page views on gallery websites so operators can see visit counts and popular pages. This processing is strictly necessary to provide the analytics feature of the Services and does not rely on cookies or any persistent identifier stored on the visitor's device. To roughly distinguish unique visits within a single day without identifying any individual, we compute a keyed hash over the visitor's truncated IP address (the network portion only — /24 for IPv4 and /48 for IPv6) together with their User-Agent header. The key used in that hash is a random value that rotates at least once every 24 hours; the previous day's key is deleted and never retained, so hashes generated on different days cannot be linked to the same visitor. Only aggregate counts — not the hashes themselves, raw IP addresses, or User-Agent strings — are retained beyond the rotation window. No personally identifiable information about the visitor is collected, stored, or shared. Because this processing is anonymous, non-persistent, and limited to what is strictly necessary to provide aggregate analytics to the gallery operator, Primatura treats it as strictly necessary processing for the operation of the Services and does not require prior consent under the EU ePrivacy Directive or similar laws.

Visitor data and gallery owners. As a gallery operator, you are the data controller for visitor information collected through your gallery website. You are responsible for handling that data in compliance with applicable privacy laws, including providing appropriate notice to visitors about how their contact information is used.

3a. Gallery Passport and Collector Data

Gallery Passport is a free, passwordless account that lets a collector save works and follow artists across every participating Primatura gallery. This section describes how collector information is handled.

Sign-in. Gallery Passport uses passwordless "magic-link" sign-in: you enter your email, and we send you a one-time sign-in link (delivered through Resend, our email provider). We do not use passwords. Your signed-in session is held in a secure, HTTP-only cookie; see Section 9.

One identity, gallery-scoped visibility. A single Gallery Passport works across all participating galleries, but galleries do not see each other's data about you. A gallery can see only the saves, follows, visits, and interest notes that occurred on or with that gallery. What is shared across the network is your identity — so you can follow a new gallery's artists in one tap — not your activity at other galleries.

New-work notifications. When an artist you follow has new work at a participating gallery, we may email you — either instantly or as a daily digest, according to your preferences. These notes may be drafted by AI in the gallery's own writing style (see Section 5). Every notification email includes a one-click unsubscribe link, and you can change or turn off notifications at any time in your Passport settings. Turning off notifications does not affect essential account emails such as sign-in links.

In-person recognition. Your Passport can carry a personal QR code (including in Apple Wallet or Google Wallet — see Section 4). When you present it at a participating gallery, that gallery's staff can, using the Primatura mobile app, see your display name and the saves, follows, visit history, and any interest notes associated with that gallery — so they can assist you in person. Gallery staff may also record private notes about works you discuss and may save works to your Passport on your behalf. The QR code identifies you to the gallery but does not itself expose your data to anyone who merely scans it; only an authenticated gallery can resolve it, and only to its own gallery-scoped view.

Check-in and guest book. If you check in at a gallery (for example, at an opening), the information you provide is shared with that gallery and may be used to add you to that gallery's own mailing list where you have opted in. In that case, the gallery is the data controller for the information you provide to it, and its own privacy practices and email consent obligations apply. Primatura processes that information on the gallery's behalf to operate the Passport and check-in features.

Deleting your Passport. You may ask us to delete your Gallery Passport and its associated data (saves, follows, visits, interest notes, and profile) at any time by contacting privacy@primatura.com. See Section 7 for how deletion is handled. Information you separately provided to an individual gallery (such as a guest-book entry or that gallery's newsletter subscription) is controlled by that gallery; you can unsubscribe from a gallery's emails using the unsubscribe link in those emails.

No sale of collector data. We do not sell collector personal data, and we do not use it for third-party advertising. A collector's data is used to operate Gallery Passport and to deliver the gallery-facing features described above.

4. Data Sharing

We share data only with the third-party services necessary to operate the platform:

• Stripe — payment processing
• Square — optional point-of-sale integration
• Supabase — database and authentication infrastructure
• Cloudflare — hosting, CDN, and DNS
• Resend — transactional email delivery
• Anthropic — AI processing for artwork analysis, business insights, and social media post generation (see Section 5)
• Prodigi — print-on-demand fulfillment (artwork images and order details transmitted when you enable the Print-on-Demand feature)
• Apple and Google — when a collector chooses to add their Gallery Passport to Apple Wallet or Google Wallet, the pass (display name, member-since date, a saved-works count, and a personal QR code) is delivered to and stored on the collector's device through Apple's or Google's standard wallet infrastructure, subject to Apple's and Google's own privacy terms

Each of these providers has their own privacy policy and data handling practices. We encourage you to review them.

5. Artificial Intelligence and Data Processing

Certain Primatura features use artificial intelligence technology provided by Anthropic. When you use these features, the following data may be transmitted to Anthropic for processing:

• Artwork image analysis: Artwork images and any associated metadata you upload are sent to Anthropic to generate descriptions, tags, and other content suggestions.
• Collection descriptions: Collection title and a list of included works (titles, artist names, media, and years) are sent to Anthropic to generate suggested collection page copy.
• Business insights: Aggregated gallery performance data, traffic statistics, and sales summaries are sent to Anthropic to generate narrative insights displayed in your dashboard.
• Performance trend analysis: Historical snapshots of platform and per-gallery metrics — including subscription counts, catalog sizes, sales volumes, and traffic data — are sent to Anthropic to generate weekly trend reports. This data is aggregated and does not include personally identifiable information about gallery visitors or buyers.
• Gallery performance insights: Your individual gallery's historical performance data is sent to Anthropic to generate personalized recommendations visible in your dashboard.
• Social media post generation: Artwork images and metadata are sent to Anthropic to generate suggested post copy for Facebook and Instagram.
• Gallery Passport notifications: To draft new-work notification emails in a gallery's writing style, a limited set of information may be sent to Anthropic — the gallery's voice profile, the artist and work details being announced, and, so the note can be personalized, the collector's first name or email prefix, the titles of works the collector previously saved at that gallery, and the names of galleries the collector has visited. This is used only to draft the message; it is not used for any other purpose.

We transmit only the data necessary to deliver each specific AI feature. Other than the limited personalization details for Gallery Passport notifications described above, we do not send personally identifiable information about gallery visitors or buyers to Anthropic for AI processing.

Artist content and consent: If you use AI features to analyze artwork created by artists you represent, you are responsible for ensuring you have the right to submit that artwork for AI processing. You should inform artists represented in your gallery that their work may be processed by AI systems as part of the platform's features.

No training on your content: Primatura does not use your gallery content to train AI models. Data transmitted to Anthropic for feature processing is handled in accordance with Anthropic's API data use policies. Anthropic's API terms provide that content submitted via the API is not used to train models by default. For details, see Anthropic's Privacy Policy.

AI features are optional: You may choose not to use AI-powered features. Doing so will not affect your access to any other part of the platform. No content is transmitted to Anthropic unless you actively use an AI-powered feature.

5a. Performance Analytics Data

Primatura automatically collects and stores daily snapshots of platform-level and per-gallery performance metrics as part of delivering insights and trend analysis features. This data includes:

• Subscription status and tier
• Catalog counts (works, artists, exhibitions)
• Sales and order volumes (in aggregate, without buyer identity)
• Email subscriber counts
• Website traffic metrics sourced from Cloudflare infrastructure
• Integration adoption status (e.g. whether Stripe or Square is connected)

This data is retained for up to 12 months and is used to generate the performance dashboards, business insights, and trend reports available in your account. Aggregated and anonymized versions of this data — which cannot be linked back to your individual gallery — may be used internally to understand platform health and improve the Services.

This data collection occurs automatically as part of the Services. You may request deletion of your historical analytics data by contacting us; doing so will affect the availability of trend and insights features that depend on it.

6. Facebook and Instagram (Meta) Data

When you connect a Facebook Page or Instagram Business account, Primatura accesses and stores: the list of Facebook Pages you manage, a Page access token for the Page you select, and the Instagram Business account ID and username linked to that Page. We use this solely to publish posts you create to your own Page and Instagram account. We store this data encrypted at rest and retain it only while your account remains connected. You can revoke access at any time by disconnecting in the dashboard or by removing Primatura from your Facebook account settings; doing so deletes all stored Meta connection data. We do not sell, share, or transfer this data to third parties, and we do not use it for advertising or profiling. For full details and deletion options, see our Data Deletion Policy: https://dashboard.primatura.com/legal/data-deletion.

7. Data Retention

We retain your account data for as long as your account is active. If you cancel your subscription and close your account, we will delete your data within 90 days, except where retention is required by law or for legitimate business purposes such as resolving disputes.

Collectors. We retain your Gallery Passport data for as long as your Passport exists. If you ask us to delete your Passport, we delete your collector profile and the saves, follows, visit records, and interest notes associated with it. Information you separately provided to an individual gallery (such as a guest-book entry or a subscription to that gallery's mailing list) is retained by that gallery under its own retention practices; use the unsubscribe link in a gallery's emails, or contact that gallery, to manage it.

8. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), secure credential storage, and access controls. However, no system is completely secure and we cannot guarantee absolute security.

9. Cookies and Browser Storage

Primatura uses session cookies for authentication. We do not use tracking cookies or third-party advertising cookies. Your browser settings allow you to control or disable cookies, though disabling them may affect platform functionality.

Gallery Passport session cookie. When you sign in to Gallery Passport, we store a secure, HTTP-only, signed session cookie on your device to keep you signed in (by default for 30 days). This cookie is strictly necessary to operate the signed-in Passport experience — it is not used for advertising, profiling, or cross-site tracking. Signing out removes it.

Browser local storage on gallery websites. Primatura-powered gallery websites use browser local storage — a standard browser feature distinct from cookies — in connection with the visitor Like feature. When a visitor clicks the Like button on an artwork page, a small entry is written to that visitor's browser local storage recording which works they have liked on that gallery site. This is used solely to prevent duplicate likes from the same browser and to restore the liked state when the visitor returns. The following applies to this local storage use:

• The entry contains only an identifier for the liked work (gallery slug and work slug). It does not contain any personally identifiable information.
• The entry is stored locally on the visitor's device and is never transmitted to Primatura's servers.
• Primatura cannot read, access, or delete local storage entries on a visitor's device. Visitors can clear this data at any time through their browser settings.
• The like count itself (an anonymous integer) is stored in Primatura's database associated with the artwork, not with any individual visitor.

No other browser local storage or session storage is used on gallery websites beyond what is described here and any storage used by third-party integrations you enable on your gallery (such as Stripe's checkout).

No tracking cookies or device identifiers on gallery websites. Page-view analytics on Primatura-powered gallery websites are implemented entirely server-side and do not set any cookie, local storage entry, session storage entry, or other identifier on the visitor's device. See Section 3 ("Aggregate page-view analytics") for details of the server-side, non-persistent mechanism used.

10. Your Rights

Depending on your location, you may have the right to access, correct, or delete your personal data. To exercise these rights, contact us at privacy@primatura.com. We will respond within 30 days.

11. Children's Privacy

Primatura is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice in your dashboard. Continued use of the Services after changes take effect constitutes acceptance of the revised policy.

13. Contact

Questions or concerns about your privacy? Contact us at privacy@primatura.com.