Privacy Policy

We are the operator of Support Small Blank and are responsible for your personal data. You can contact us at support@supportsmallblank.com.

• Your account: your name, username, email address, and your password, stored only as a one-way hash, never in a readable form. We also record when you agreed to the Terms and this Privacy Policy, and which version. We also record when you made the “no generative AI” pledge at signup, and when you made the declaration on each listing that you made it yourself, without generative AI. We do this to enforce our human-made policy and to handle reports. The pledge record is kept if you delete your account, like the record of agreeing to the Terms, and so are the declarations on sold listings, which stay as part of sales history.
• Your area: an approximate location (a neighbourhood or town, and a point rounded to roughly a kilometre), used to show how far away work is. We don't store a precise address. We also keep the country of that saved location, to choose which currency (euros, pounds or dollars) approximate prices are shown in. A location you type in without an account is used for that in the same way for that visit only and isn't stored.
• Your profile and listings: your photo and bio if you add them, and the artwork you list, with its images, descriptions and prices.
• Activity: offers and counter-offers (a copy of your email address is kept on offers you make, and is never shown to sellers), pickup plans, the private chat messages for accepted sales, notifications, likes, follows, and reviews you write.
• Support messages: if you write to us through the support form, we keep your message, its topic and when you sent it, with your account (or the email address you gave if you weren't logged in) so we can reply. If you were logged in, they are deleted when you delete your account. If you weren't, they are deleted after 12 months. Copies in our email inbox and our email providers' records are not removed automatically, and we'll delete them if you ask.
• Reports: reports you make or that are made about you or your work, including who made them, the reason given and any details. They are deleted after 24 months.
• Technical: your IP address is used briefly to limit abuse (for example repeated login attempts); we don't store it in your account. Our hosting provider (Vercel) keeps server logs, including IP addresses, for a short time to run and secure the service. Logs available to us are kept for no more than 30 days, and Vercel keeps its own records only as long as it needs to. Our hosting provider also works out which country a visit comes from, using the IP address, and passes it to us. We use it only while answering that request, to choose which currency (euros, pounds or dollars) approximate prices are shown in, and we don't store it. We use IP addresses in these ways because we have a legitimate interest in preventing abuse and in showing approximate local prices. Most images are fetched for you by our own servers, but the photos attached to reviews on artist pages load directly from our image hosting provider, which can then see your IP address and browser details, as any website would.

Your listings, username, display name, profile, bio, reviews and approximate area are public. Your email address and password are never shown to other users. Chats are private between the two people in the sale, but we may read them if a sale or user is reported, to look into the problem. When you report someone from a conversation, the recent messages from that conversation are sent to us so we can review it. If someone sends us a copyright notice about a listing, we may pass the notice, including the sender's name and contact details, to the artist so they can reply.

• To run your account and the site you signed up for (listings, offers, chats, pickups, notifications, reviews): because we need to in order to provide the service you asked for.
• To keep the site safe and working (preventing abuse and scams, dealing with reports, fixing errors, security): because we have a legitimate interest in running a safe and reliable service.
• To answer your messages and requests: because it's necessary to help you, and in our legitimate interest in supporting users.
• To meet legal obligations, where they apply.
• Where we ask for your permission, for example if you choose to share your device's location, we rely on your consent, and you can withdraw it at any time.

We don't sell your data and we don't use it for advertising.

We share only what each one needs to do its job. For each, this is what it does, what it gets and where it is based:

• Vercel (hosting; based in the United States): runs the site and its server code. It handles every visit, so it sees IP addresses, browser details and the pages and requests you make, and it processes everything you send to the site. It also works out the country of a visit from its IP address.
• Neon (database; based in the United States, part of Databricks): stores the data described in section 2. Our database is in its London region.
• Cloudinary (image hosting; based in the United States, processing also in the EU, UK, Singapore and Israel): stores and serves the images you upload (your profile photo, listing images and review photos). Review photos load directly from it, so it can see your IP address and browser details when they do.
• Resend (email delivery; based in the United States): sends our emails. It sees your name, your email address and the content of each email. It also carries reports and support messages to our inbox, so it sees what they contain.
• Sentry (error and performance monitoring; based in the United States, with our reports sent to its EU region): when something breaks on the site, a technical error report (what went wrong and where in our code) is sent to it. Occasionally (for about 1 in 20 requests) we also send a performance measurement: how long a page took to load and which parts of our code ran. We don't intend either to contain personal data: they carry no IP address, account details, cookies or form contents, and email addresses, phone numbers and tokens are removed before they leave the site. Reports from your browser go straight to Sentry, so it sees the connection they arrive on, as any website would.
• OpenStreetMap (its Nominatim address search) (location lookup; run by the OpenStreetMap Foundation, based in the United Kingdom): turns a place you type or share into an approximate area. Our servers send it the place text you typed, or the coordinates your device gives us if you choose to use your location. The requests come from our servers, so it sees our server's address, not yours. We keep only the approximate area it returns.
• ImprovMX (email forwarding; based in the United States): forwards email sent to our support address. It gets the content, sender and recipient details of every email sent to that address, so it sees messages you send us there.
• GoDaddy (domain name registration and DNS; based in the United States): looks after our domain name. It gets no visitor data from us beyond normal DNS lookups.

Some of these companies are based outside the UK and the European Economic Area, mainly in the United States, and some process data there. Where personal data is sent outside the UK and the EEA, the transfer is covered by the safeguards each provider offers, such as standard contractual clauses or the UK and EU–US data frameworks. For example, Vercel's data processing terms (atvercel.com/legal/dpa) use standard contractual clauses and the UK addendum.

We use one cookie: a login session cookie, which is necessary to keep you signed in (it lasts up to 7 days, or until you log out). We don't use analytics or advertising cookies. We also use your browser's own storage, which stays on your device, to remember your light or dark theme choice and whether you've already seen the “How it works” card (a “seen” flag). Neither is sent to us.

Your account data is kept until you delete your account. Reports are kept for 24 months and then deleted, whether or not the matter is closed. Support messages from people who weren't logged in (which include the email address they gave us to reply to) are kept for 12 months and then deleted; those from logged-in people are deleted when their account is. The links we email for confirming an email address (good for 24 hours) or resetting a password (good for 1 hour) stop working when they expire, and expired ones are removed from our database routinely. Proof sent to us in a copyright dispute (such as photos and files) is kept only as long as we need it to handle the dispute. Our database backups are kept for a limited time and then overwritten, so deleted data may remain in a backup until then.

Some things are deleted automatically. An account whose email address is never confirmed is deleted 7 days after sign-up (unless it has already listed artwork, made an offer, sent a message, left or received a review, or made a report). Notifications are deleted 7 days after you've read them, or after 60 days if unread, and we keep at most your latest 200.

You have the right to ask for access to the data we hold about you, for correction of anything that's wrong, for deletion of your data, and for an export: a copy you can take elsewhere. You can also object to or ask us to restrict how we use your data in some cases, and withdraw any consent you've given. You can do two of these yourself, on the Account tab in My Studio: “Download my data” gives you a copy of your data as a file, and “Delete account” deletes your account. Deleting removes your images (your profile photo, your listing images and your review photos), your artist statements and your personal profile data (such as your name, username, email address, bio and location), as well as your likes, follows and notifications, and frees your email address. Your listings that were for sale are marked as removed: they disappear from the site, but their text (such as the title and description) stays in our records. We keep some records because other people rely on them, or so that we can deal with problems: listings that were sold, and the sales history they belong to; your chat messages and reviews, shown as “Deleted user”; the notes sent with offers; and reports made by or about you, with the reason and details, until they are deleted after 24 months (see section 7). For anything else, email support@supportsmallblank.com and we'll deal with your request within one month, and usually much sooner.

If you're not happy with how we've handled your data, you can complain to the data protection regulator where you live.

You must be 18 or over to use this site, and we don't knowingly collect data from anyone under 18. If we find that an account belongs to someone under 18, we'll close it and delete the data.

If we change this policy in a way that matters, we'll tell you on the site or by email. Questions: email support@supportsmallblank.com.