Privacy Policy

1. Information We Collect

a. Information You Provide Directly

• Account Information: Name, email address, password, phone number (optional), and profile details when you register.
• Submissions: Artwork images, titles, descriptions, pricing, artist statements, and other submission data.
• Organization Data: Gallery or organization name, address, tax ID (if applicable), and administrator details.
• Payment Information: Billing details processed through Stripe. We do not store complete credit card numbers on our servers.
• Communications: Messages sent through the platform, support requests, and feedback.

b. Information Collected Automatically

• Device & Usage Data: IP address, browser type, operating system, device identifiers, pages visited, and interaction patterns.
• Cookies & Similar Technologies: We use cookies, local storage, and similar technologies for authentication, preferences, and analytics. See Section 6 for details.
• Log Data: Server logs that record requests, errors, and system performance.

c. Information from Third Parties

• Payment Processors: Transaction status and limited account info from Stripe.
• Analytics Providers: Aggregated usage data to help us improve the platform.

2. How We Use Your Information

We use your information to:

• Provide Services: Process submissions, manage accounts, facilitate jury review, and enable artwork sales.
• Process Payments: Handle submission fees, call activation fees, and artwork purchases.
• Communicate: Send confirmations, updates, support responses, and (with consent) promotional messages.
• Improve the Platform: Analyze usage patterns, troubleshoot issues, and develop new features.
• Ensure Security: Detect fraud, prevent abuse, and protect user accounts.
• Comply with Law: Meet legal obligations and respond to lawful requests.

We will never sell your personal information to third parties.

3. How We Share Your Information

We share information only in limited circumstances:

• With Organizations: When you submit to a call, your submission and contact info are shared with that organization.
• With Jurors: Submissions are visible to assigned jurors during review. Blind jury mode hides artist identity.
• Service Providers: We use trusted vendors for hosting (AWS), payments (Stripe), email (AWS SES), and file storage (AWS S3). These providers are contractually bound to protect your data.
• Legal Requirements: We may disclose information if required by law, court order, or to protect rights, safety, or property.
• Business Transfers: In the event of a merger, acquisition, or sale, user data may be transferred. We will notify you of any such change.

4. Data Retention

We retain your data as follows:

• Active Accounts: Data is retained while your account is active.
• Deleted Accounts: Upon account deletion, we remove personal data within 30 days, except where retention is required for legal, tax, or fraud prevention purposes.
• Submissions:Artwork and submission data are retained according to the organizing gallery's policies. You may request deletion from specific calls.
• Transaction Records: Payment and financial records are retained for 7 years for tax and legal compliance.

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS/SSL) and at rest
• Secure authentication with password hashing
• Regular security audits and monitoring
• Access controls limiting employee data access
• PCI-compliant payment processing through Stripe

While we strive to protect your data, no method of transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

6. Cookies & Tracking Technologies

We use cookies and similar technologies for:

• Essential Functions: Authentication, security, and session management.
• Preferences: Remembering your settings and choices.
• Analytics: Understanding how users interact with the platform.

You can control cookies through your browser settings. Disabling essential cookies may affect platform functionality.

7. Your Rights & Choices

Depending on your location, you may have the right to:

• Access: Request a copy of your personal data.
• Correction: Update inaccurate or incomplete information.
• Deletion: Request deletion of your account and data.
• Portability: Receive your data in a structured, machine-readable format.
• Opt-Out: Unsubscribe from marketing communications at any time.
• Restrict Processing: Limit how we use your data in certain circumstances.

To exercise these rights, contact us at email us. We will respond within 30 days (or as required by applicable law).

California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information we collect and share, the right to delete, and the right to opt out of the sale of personal information. We do not sell personal information.

European Residents (GDPR)

If you are in the European Economic Area, you have rights under the General Data Protection Regulation, including those listed above. Our legal basis for processing is typically contract performance, legitimate interests, or your consent. You may lodge a complaint with your local data protection authority.

8. International Data Transfers

Crafted Call is based in the United States. If you access the platform from outside the US, your data will be transferred to and processed in the US. We take appropriate safeguards to protect your data in accordance with this Privacy Policy and applicable laws.

9. Children's Privacy

Crafted Call complies with the Children's Online Privacy Protection Act (COPPA) when collecting personal information from children under 13 years of age. Some events hosted on our platform may be open to minors, including children under 13. In those cases, we implement the following protections:

Information Collected for Minors

When a child under 13 is registered for an event, we collect only the information necessary to facilitate their participation: first name, last name, birth date, age, and any medical notes required for safety. We also collect the parent/guardian's name, email address, and phone number.

Parental/Guardian Consent

Before collecting personal information from a child under 13, we require verifiable parental or guardian consent. During event registration, the parent or guardian must:

• Provide their full name and email address
• Explicitly acknowledge and consent to the collection of their child's information by checking a consent checkbox

We record the date, time, IP address, and consent version for audit purposes.

Guardian Rights

Parents and guardians have the right to:

• Review the personal information collected about their child
• Request deletion of their child's personal information
• Refuse further collection or use of their child's information
• Withdraw consent at any time by contacting us or the event organizer

Data Deletion

To request deletion of a child's data, the parent or guardian may contact the event organizer directly or reach out to us at privacy@craftedcall.com. We will process deletion requests within 30 days and confirm completion to the requesting party.

COPPA Contact

For questions or concerns about our COPPA compliance practices, please contact us at privacy@craftedcall.com.

10. Third-Party Services

Our platform integrates with the following services:

• Stripe - Payment processing (Privacy Policy)
• Amazon Web Services (AWS) - Hosting, storage, email (Privacy Policy)

These services have their own privacy policies. We encourage you to review them.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or prominent notice on the platform at least 30 days before taking effect. Your continued use after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact: