Privacy Policy

Account data

When you create an account we store your email address and authentication details with Supabase, our authentication and database provider. We use this to sign you in and to associate your published galleries with your account.

Billing

Payments are processed by our payment provider. Your payment details are entered with and held by them — we never see or store your card information. We receive only your subscription status and the data needed to keep your account active.

Sign-up progress and email updates

While you set up your gallery space we record how far you got (address, name, plan, or checkout), when you opened a checkout and for which plan. If you tell us why you stopped, we keep your answer and any note you add. If you tick “Email me OpenVGAL news”, we record that permission and its date, and may send you one note if your sign-up doesn’t go through. We also add your email address to our mailing list at Kit (kit.com), which sends our product news. We never tick it for you. Kit’s unsubscribe link stops the news. To withdraw the permission entirely, untick the box, use the unsubscribe link in our sign-up note, or contacting us. This data is kept as long as your account and is deleted with it.

Visit counts

We count visits to the site with Umami, which we host ourselves, and the gallery builder on /create counts finished builds the same way: anonymously, with no cookies, and the data stays on our own server.

Galleries on Studio plans count visits, rooms reached, artworks opened and likes as daily totals for the artist. We use the site that sent you and your country to add to those totals and store neither against you. If you like a work, your browser remembers that on your device so the button stays lit and you can undo it.

Where you came from

When you arrive from a link or an ad, we note the campaign label, the name of the site that sent you and the page you landed on. The note stays in your browser for up to 30 days. If you create an account, it is sent to us once and linked to your account, so we know which campaigns bring artists to OpenVGal. There is no tracking ID and no cookie, and the note is deleted when your account is deleted.

Showcase submissions

When you submit a gallery to the showcase, it is stored in a Google Sheet, and only the display name and gallery address are ever published.

Artist contact forms

Messages sent through an artist’s contact form are emailed to that artist and not stored by OpenVGal.

Gallery files

The artwork and gallery files you upload are stored on Cloudflare R2 and served from there. We keep encrypted nightly backups on Backblaze B2 (separate infrastructure) so your work can be restored after a failure.

Retention and deletion

If your subscription ends or lapses, your files are kept for 30 days and then permanently deleted. When that deletion happens — or when you ask us to erase your data — your backup copies on Backblaze B2 are purged within 24 hours, so nothing you’ve asked us to remove lingers in backups. Your account record — email, display name and address — is kept for a further 90 days so you can reactivate on the same address; on day 120 it is erased along with your sign-in.

One record survives that erasure: the entry we write to our account-event log at the moment your files are deleted, holding your email address, display name and a reference to the cancelled subscription. We keep it for billing audit and support — it is not erased with the account. It restores nothing and is no longer attached to a live account.

Deleting on request is a different path, and the difference matters. You can ask us to delete your account and data at any time; that runs immediately, with no 30- or 90-day window, and it writes no such log entry. What it does not undo is billing history already recorded: if you have ever been charged, the payment records our payment provider sent us stay in the same audit log, detached from your account and still containing the customer details in those payments. We keep those for tax and accounting obligations. Invoices themselves live with the provider under their own retention.