Privacy Policy

1. Information we collect

Depending on how you use the marketplace, we may collect:

• Account and profile data: name, email address, phone number, password hash, role (for example customer or artist), profile and listing content you submit, and preferences you set in your account.
• Transaction and order data: items purchased or sold, order status, fulfillment details, messages related to orders, and internal identifiers we associate with Stripe payments and Connect accounts.
• Contact and support inquiries: information you provide when you contact us or submit forms, including attachments you choose to send.
• Technical and usage data: IP address, approximate location derived from IP, browser type, device characteristics, pages viewed, referring URLs, timestamps, and diagnostic logs that help us operate and secure the site. We may also store product or page interaction history (for example, recently viewed items) where that feature is enabled.
• Cookies and similar technologies: session cookies or tokens that keep you signed in, remember preferences, and protect against abuse. You can control cookies through your browser; disabling essential cookies may limit certain features such as staying logged in.
• Human verification (Cloudflare Turnstile): on certain public forms — for example, creating an account, signing in, requesting a password reset, or submitting the support contact form while signed out — we may load Cloudflare Turnstile. Turnstile helps distinguish real visitors from automated abuse. It may process technical signals (such as device and network information) to run the check. Cloudflare processes this data as described in its Privacy Policy.

We do not store full payment card numbers, card security codes, or bank account numbers on our own servers. That information is collected and processed by Stripe as described below.

2. How Stripe uses information

We use Stripe, Inc. and its affiliates ("Stripe") to process payments, prevent fraud, and—where applicable—onboard and pay Artists through Stripe Connect. When you pay or receive payouts, Stripe receives personal and financial information directly from you (or your device), such as payment method details, billing information, identity verification documents for Connect accounts, device and network data for fraud prevention, and transaction records.

Stripe acts as an independent controller or processor (depending on the processing activity and region) for the data it collects. Stripe's use of that information is governed by Stripe's agreements with you and by Stripe's Privacy Policy. We encourage you to read Stripe's policy to understand how Stripe handles international transfers, retention, and your privacy rights for payment data.

3. How we use information

We use the information above to:

• Provide, operate, and improve Plentitude Art Market.
• Process and fulfill orders, coordinate pickup or delivery, and communicate about transactions.
• Authenticate accounts, detect fraud and abuse, and maintain security — including through human-verification checks (such as Cloudflare Turnstile) on selected forms where we deploy them.
• Send service-related messages (for example, order confirmations and account notices).
• Send marketing or newsletter messages when you have opted in or where permitted by law; you can opt out using the unsubscribe link or by contacting us.
• Comply with legal obligations, enforce our terms, and defend our rights.

4. How we share information

We share personal information only as needed to run the marketplace:

• Stripe receives payment, payout, and verification data as described in Section 2.
• Email delivery: we may use Resend (or a comparable provider) to send transactional and optional marketing email. That provider processes recipient addresses and message metadata on our instructions.
• File storage: listing images, downloadable files, and similar assets may be stored in Amazon S3 or another S3-compatible object store configured for our environment. The provider processes files and related metadata for hosting and delivery.
• Cloudflare: we use Cloudflare Turnstile on some forms for abuse prevention, as described in Section 1. Cloudflare may process limited technical data needed to operate the challenge.
• Service providers: we may engage vendors for hosting, analytics, customer support tooling, or security monitoring. They may access information only to perform services for us and are bound by appropriate confidentiality and security obligations.
• Legal and safety: we may disclose information if required by law, court order, or governmental request, or when we believe disclosure is necessary to protect the rights, property, or safety of Plentitude, our users, or the public.
• Business transfers: information may be transferred as part of a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.

We do not sell your personal information for money as that term is commonly defined in U.S. state privacy laws.

5. Retention

We retain personal information for as long as your account is active, as needed to provide services, and as necessary to comply with tax, accounting, and legal obligations (for example, retaining order records for a period after a transaction). When retention is no longer required, we delete or de-identify information where feasible.

6. Security

We use administrative, technical, and organizational measures designed to protect personal information, including encryption in transit (HTTPS) for our website and APIs. No method of transmission or storage is completely secure; we cannot guarantee absolute security, especially for factors outside our control such as your device or third-party services.

7. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or export certain personal information, or to object to or restrict certain processing. You may also have the right to lodge a complaint with a supervisory authority. To submit a request, contact us through Support & Resources and choose Privacy Request (or the closest matching category) where available. We will verify your request as permitted by law and respond within the timeframe applicable to your jurisdiction.

For payment-specific questions or rights relating to card or bank data processed by Stripe, you may also contact Stripe as described in Stripe's Privacy Policy.

8. Children

Our marketplace is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us so we can delete it.

9. International users

We are based in the United States. If you access the site from another country, your information may be processed in the United States and in other locations where we or our service providers operate. Those locations may have data protection laws that differ from your home country. Stripe may also process data in accordance with its global operations as described in Stripe's documentation and privacy policy.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date. Where changes are material and we are required to notify you, we will provide notice as required by law (for example, by email or a prominent notice on the site).

11. Contact

For questions about this Privacy Policy or our data practices, contact us through Support & Resources.