Privacy Policy
Last updated: 30 August 2026
1. Who We Are
Art Licence Studio Ltd ("ALS", "we", "us" or "our") operates Art Licence Studio and is the controller
for the core Platform processing described here. We are registered in England and Wales, Company No. 16440129,
with registered office at 5 Brayford Square, London, E1 0SG, United Kingdom.
Contact privacy@artlicencestudio.co.uk for privacy questions or rights requests. You may complain to the
Information Commissioner's Office at https://ico.org.uk/. We do not publish an unverified ICO registration
number or claim a named Data Protection Officer.
2. Scope and Accounts
This policy covers the website, unified personal account, public profiles, marketplace, Feed, briefs, projects,
messages, comments, reactions, reports, licence records, payment and Artist-settlement evidence, and any other
function ALS expressly enables. "Artist", "buyer", "commissioner" and "collaborator" describe activities of
one account, not separate account products. The initial public paid release is for verified adults aged 18 or
over in the United Kingdom or United States. It does not support a child or guardian-managed account.
When ALS expressly enables checkout, the paid products covered by this policy are a one-off non-exclusive digital
static-2D or approved self-contained GLB Artwork Licence, the unified ALS Pro membership, and a governed
Buyer-funded digital-art commission described in the Terms. Each new paid licence or commission uses exactly one
supported launch pair, GB/GBP or US/USD, from price through receipt; ALS does not use Adaptive Pricing, convert a
GBP base into USD or aggregate currencies. A governed commission can include a Commission Order, funded stages,
delivery and acceptance evidence, disputes, refunds and delivery-gated Artist-net transfers through Stripe Connect.
Exclusive licences, physical artwork, printing, physical manufacture or 3D
printing, non-GLB 3D formats, print-on-demand, Direct Debit, ImagePress credits and other excluded money products
remain outside that paid release. No payment, subscription or settlement record is created for a flow while its
server-owned checkout gate remains closed.
3. Information We Process
Depending on the functions you use, we process:
• Account and authentication data: name, email, authentication identifiers, password-related security records,
passkey and multifactor status, login events, account state and public handle.
• Identity, age and authority data: date of birth, country, verification status and result, provider reference,
checks and evidence needed to establish age, identity, fraud or sanctions risk, and authority to act for a Buyer,
Artist, company, agency, team or client. ALS does not need to keep a provider’s copy of an identity document
where the verified result and reference are sufficient.
• Public profile and community data: display name, avatar, biography, links, public artwork records, previews,
medium and category data, Feed posts, public project or brief updates, comments, reactions, follows and reports.
• Artwork and rights data: private source files; approved static posters and reduced public previews; private
self-contained GLB sources; format, integrity, compatibility, moderation and security-scan metadata; authorship,
copyright, AI-involvement, third-party-rights and restriction disclosures; fingerprints and licence eligibility
evidence.
• Project and communications data: briefs, proposals, project membership, participant authority, messages,
approvals, change requests, uploads, governance and delivery records. For a governed commission this also includes
the Commission Order, represented principal or payer authority, funding state, stage amounts, acceptance conditions,
licence scope, delivery and acceptance events, dispute state and transfer-release conditions. Deliberately published
updates are public; participant-only workspaces and messages are private to authorised participants.
• Order, membership and licence data: Buyer and licensee identity, Artist, artwork and licence terms, ALS Pro
plan, market, bound GBP or USD currency and billing interval where selected, Order Summary or Commission Order,
the directly stated price, charge, settlement and receipt amounts in that one currency, stages, tax line, consent and
policy versions, delivery and acceptance evidence, Order Confirmation, Licence Certificate, QR/verifier record,
cancellation, refund, complaint and dispute evidence.
• Payment data: payment-provider customer, session, payment, refund, dispute and payout references; payment
method type, card brand and last four digits where returned; status, amount, currency, timestamps and fraud or
risk signals. For Stripe Connect this can include a connected-account reference, onboarding and identity status,
capability and requirement state, transfer and reversal references, negative-balance state and payout references.
Full card or bank credentials are entered in the payment provider’s interface and are not stored by ALS.
• Payment-operations audit data: an opaque operator identifier, action type and reason, authority and internal
waiver hashes, short-lived execution-window timestamps, strong-authentication and trusted-origin result,
idempotency and replay result, provider-response validation, reconciliation outcome, kill-switch or recovery
evidence and review receipts. We do not publish this evidence or include operator contact details, customer
communications, full provider payloads or payment credentials in the launch evidence bundle.
• Artist settlement and reporting data: legal and trading identity, address, date of birth, tax identification number
where required, payment account or payout-provider reference, Artist status, transaction and stage counts and
amounts, ALS fees, refunds, reserves, recovery, net settlement, transfer and payout status and information required
for HMRC digital-platform or other legally required reporting and seller statements.
• Safety, support and compliance data: user and affected-person reports, support correspondence, moderation,
fraud and security signals, legal requests, policy acceptance and evidence needed to investigate misuse or meet
our duties. The affected-person report route uses a strictly necessary HttpOnly, Secure, SameSite=Lax cookie
named als_safety_reporter containing a random opaque browser token for up to 90 days; the database stores only
its HMAC, not the raw token, name or email address.
• Device and usage data: IP address, browser, device, timestamps, route requests, diagnostics, security events
and cookie-choice records. Optional analytics is processed only when configured and permitted by your choice.
• Optional AI beta data: a prompt and limited context a specifically entitled user chooses to send to Studio
Mentor. Studio Mentor is a private beta guidance tool, not an account, payment or moderation authority.
4. Why We Process It and Our Lawful Bases
We process data to create and secure accounts; verify eligibility and authority; publish selected public
content; operate projects, governed commissions and communications; conclude, deliver and evidence licences;
take payment and instruct eligible Artist-net transfers; prevent fraud and abuse; investigate reports and disputes;
control and audit payment operations; provide support; maintain accounting records;
and comply with tax, digital-platform reporting, sanctions, consumer, online-safety, data-protection and other legal
duties.
The lawful basis is contract where processing is needed to provide an account or transaction requested by you;
legal obligation for accounting, tax, reporting, consumer, safety or lawful-request records; and our legitimate
interests in securing and operating the service, preventing fraud, resolving disputes and protecting rights, balanced
against your interests. We use consent only where the law or product requires it, including optional storage,
marketing, optional AI processing or immediate digital supply. Accepting the Terms is not consent to optional
analytics, marketing or AI.
Where ALS records payment-operations audit data, the purpose is to prevent unauthorised money movement,
demonstrate transaction-specific authority, investigate incidents and reconcile provider and Platform records. The
lawful basis is contract where the record is needed to perform or remedy a transaction, legal obligation where an
accounting, tax, reporting or lawful-request duty applies, and our legitimate interests in secure payment operations,
fraud prevention, dispute resolution and accountability where those interests are not overridden by your rights.
5. Public Information and Search
Canonical profiles at /u/<handle>, approved public artwork and 3D preview records, deliberately public Feed
posts, briefs, project updates, comments, reactions and other public contributions can be viewed without an
account. They may be indexed by search engines, cached, linked to or copied by other people. Removing content
from ALS does not guarantee immediate removal from search-engine or third-party caches.
Private messages, governed project records, protected source files, identity evidence, orders, settlement records
and participant-only evidence are not intended to be public. Check the audience shown before publishing.
6. Payment, Identity and Payout Providers
Stripe is the required provider for paid digital Artwork Licence checkout, governed commission funding,
ALS Pro checkout and billing, identity verification and Stripe Connect Artist onboarding, transfer and payout
functions where those flows are enabled by the server. ALS sends Stripe the minimum order or Commission Order,
customer, connected-account, checkout, billing interval, stage, consent-version and idempotency information
needed for the selected flow and receives the payment, subscription, refund, dispute, identity, capability,
requirement, transfer, reversal, negative-balance, payout and risk references needed to operate and evidence it.
ALS sends Artist identity, verification, payout and tax information only to the identity, payment or reporting
provider needed for that function. Stripe and other applicable providers process some data under their own legal
duties and privacy information. ALS does not store full card or online-banking credentials.
Payment, payout and identity data is kept private and is not used to rank public profiles or target advertising.
A payment or verification provider can refuse or review a transaction under its legal and risk controls. ALS uses
the verified provider result with its own contract, rights, fraud and policy evidence; a provider result does not by
itself make an ALS moderation or licensing decision.
Supabase is the source-controlled core provider for authentication, database and storage functions. Resend is not
described as an enabled paid-release email processor unless a separate production-email evidence gate enables it;
repository code or a historical integration alone is not enough. The public sub-processor page explains which
provider boundaries are source-controlled and which still require external transfer, DPA and production evidence.
7. Seller and Tax Reporting
ALS may be required to identify Artists, verify seller information, keep transaction and fee aggregates, report
specified information to HMRC or another competent authority, and provide a copy of reportable information to
the Artist. This can include name, address, date of birth, tax identification number, payout-account identifier,
the number of relevant transactions, consideration paid or credited, ALS fees and any tax withheld. We collect
only the fields required for the applicable reporting period and give the Artist a route to correct inaccurate data.
We can restrict settlement where legally required information is missing or cannot be verified. We do not publish
seller tax or payout data. We do not promise that using ALS removes a Buyer’s or Artist’s own tax duties.
8. Recipients and International Transfers
We disclose data only where needed to an enabled hosting, authentication, database, storage, security, bot
prevention, monitoring, email, identity, payment, payout, professional-adviser or support provider; an authorised
project or commission participant, limited to information appropriate to that person’s role; a payment party;
HMRC, law enforcement, a court or regulator where required; or a buyer of the business subject to confidentiality
and lawful process.
Before a provider handles personal data outside the UK, ALS must use an applicable adequacy regulation,
UK International Data Transfer Agreement or Addendum, or another lawful safeguard, and complete any required
transfer risk assessment. Contact privacy@artlicencestudio.co.uk for information about the safeguard relevant to
your data. We do not claim that every provider stores data in one country.
We do not sell personal data to third-party marketers. We do not send all account content or uploaded artwork to
Studio Mentor or use it to train a third-party generative model merely because you have an ALS account.
9. Retention
We keep data only for the purpose and period that applies:
• account, profile and private workspace data is kept while the account or workspace is active, then deleted or
anonymised after closure unless another rule below requires it;
• public content is removed from ALS following a valid deletion or withdrawal request, subject to issued rights,
other users’ evidence, legal holds and search-engine or third-party caches;
• order, Commission Order, funded-stage, delivery, acceptance, licence, subscription billing, Stripe payment,
transfer, reversal, settlement, refund, dispute, accounting and seller-reporting evidence is normally kept for six
years after the end of the financial year in which the transaction completed;
• payment-operations audit evidence tied to a transaction follows the applicable transaction, dispute, accounting
or legal-claims period; evidence that is only operational or security-related is kept for the documented risk and
review period, then deleted or anonymised;
• an issued Licence Certificate, its operative terms and minimum verification evidence can be kept while the
licence remains capable of being exercised or disputed;
• security, fraud, moderation and complaint evidence is kept only for the documented risk, appeal, limitation or
legal period; and
• private ZIP-import preview objects expire no later than 24 hours after the import run starts and are removed on
consumption, cancellation or expiry through a retryable cleanup process; each preview link remains valid for no
more than one hour;
• an ordinary public support-contact submission is kept for no more than 24 months after receipt, then its contact
details and message content are minimised. The minimal retention receipt is deleted 90 days later. A documented
legal hold can pause this schedule until the hold is expressly released; and
• identity document images remain with the verification provider under its disclosed schedule where ALS only
needs the verified result and reference.
You can schedule account deletion with a 30-day cancellation period. The request does not cancel or change a
Commission Order. After that period, final closure and destructive deletion pause if you are the Buyer, client,
commissioner or Artist on a non-terminal commission, or if a related commission payment is unsettled. Closure can
continue after the work is completed; the order is cancelled and its payment consequences are settled; a dispute
is resolved; or the remaining responsibilities and records are validly transferred through a recorded ALS process.
The request does not itself cancel ALS Pro. ALS requires future renewal to be cancelled before accepting the
deletion schedule, while preserving any paid entitlement until its recorded period end. Once deletion is pending,
ALS prevents the account from starting a new subscription checkout, Artwork Licence purchase or governed
commission payment obligation unless the deletion request is cancelled first.
During that pause, ALS keeps only the account linkage and shared Commission Order, project, delivery, rights,
payment, dispute and audit evidence needed to perform or resolve the transaction, protect the other participants
and meet legal duties. Access remains restricted, identifying information is minimised where possible, and data is
deleted or anonymised when the applicable purpose and retention period end.
A legal hold, investigation, court order or statutory rule can require longer retention. ALS records the reason and
removes or anonymises data when it ends. Backups expire on their controlled schedule and are not restored merely
to reintroduce deleted live data.
10. Security and Automated Decisions
ALS uses role-based access, encryption in transit, restricted credentials, audit records and other technical and
organisational controls intended to protect personal data. No online service can guarantee absolute security. Tell
security@artlicencestudio.co.uk if you suspect a compromise.
Payment administration may be performed by one named operator under a documented, time-limited internal waiver
where an independent second operator is unavailable. The waiver is limited to that staffing separation. It does not
relax access control, strong authentication, trusted-origin checks, short-lived execution gates, transaction-specific
authority, audit records, provider validation, reconciliation, kill switches, customer rights or a separate live-smoke
approval. Operator identity is represented by an opaque identifier in launch evidence, and access to underlying
records is restricted to the people and providers who need it.
Automated signals can help block obvious abuse, score payment or account risk, organise moderation and enforce
rate or eligibility controls. Studio Mentor has no enforcement authority. Where a decision produces a legal or
similarly significant effect and applicable law gives you a right to human intervention, explanation or challenge,
contact support@artlicencestudio.co.uk. ALS does not claim that every signal is a solely automated legal decision.
11. Cookies and Authentication Providers
Essential storage supports authentication, security, affected-person report deduplication and cookie choices.
Optional functional, analytics or marketing storage follows the cookie choice you make. The Cookie Policy lists
the current names, purposes and retention. Cookie choice is separate from legal acceptance.
Email and password authentication is supported. Where a configured provider is shown, you can choose Google,
Facebook or LinkedIn OIDC. The selected provider sends the identifiers and profile fields needed to authenticate,
such as name, email and avatar. Availability can differ by environment.
12. Your Rights
Depending on UK data-protection law and the circumstances, you may have rights to access, correct, erase,
restrict or object to processing, receive portable data, withdraw consent, and ask for human review of an eligible
automated decision. You can complain to the ICO. Contact privacy@artlicencestudio.co.uk. We may verify your
identity and may keep information where a legal exception applies.
YOUR RIGHT TO OBJECT: where we rely on legitimate interests, you can object for reasons relating to your
situation. You can object to direct marketing at any time. We will stop unless we demonstrate compelling grounds
that override your interests or need the processing for legal claims.
If you live in a US state whose privacy law applies to ALS and your information, you may also have applicable
rights to know, access, correct, delete or obtain a portable copy of personal information, and to opt out of an
applicable sale, targeted-advertising use or qualifying profiling. ALS does not sell personal information for money.
We will not discriminate against you for using an applicable privacy right. Contact
privacy@artlicencestudio.co.uk; we may verify the request and will provide any appeal route required by applicable
state law. These statements do not claim that every state law applies to every request.
13. Changes
We publish material changes with a new version and date. Where renewed acceptance or consent is required,
the dedicated flow records it; the cookie banner does not accept legal terms. A material change does not
retrospectively change an issued Licence Certificate.
14. Contact
Privacy and data rights: privacy@artlicencestudio.co.uk
Legal correspondence: legal@artlicencestudio.co.uk
Support and complaints: support@artlicencestudio.co.uk
Art Licence Studio Ltd · Company No. 16440129 · Registered in England and Wales
Registered office: 5 Brayford Square, London, E1 0SG, United Kingdom
