Privacy Policy

Introduction

Sepialy is committed to protecting the privacy of its users. This privacy policy explains how we collect, use, and protect your personal data in accordance with the General Data Protection Regulation (GDPR).

Data Controller

Data Collected

• Identity data: Artist name, email address, password (hashed)
• Contact data: Studio address, social media links
• Content data: Artwork photos, descriptions, biography
• Technical data: IP address, browser type, pages visited
• Payment data: Managed by Stripe (we do not store your banking data)

Purpose of Processing

• Account management and authentication
• Service provision (portfolio, certificates, CRM)
• Payment processing and invoicing
• Communication about service updates
• Security and fraud prevention

Legal Basis

• Contract execution: To provide the services you subscribed to
• Consent: For marketing communications (optional)
• Legitimate interest: To improve our services and ensure security

Data Retention

Your data is retained for the duration of your account, then deleted within 30 days after closure. Billing data is kept for 10 years in accordance with legal obligations.

Your Rights

• Right of access: Obtain a copy of your personal data
• Right to rectification: Correct inaccurate data
• Right to erasure: Request deletion of your data
• Right to portability: Receive your data in a structured format
• Right to object: Object to the processing of your data

To exercise your rights, contact us at: contact@sepialy.art

Cookies

We only use essential cookies for the service to function (authentication, preferences). No tracking or advertising cookies are used.

Third-Party Processors

• Stripe: Payment processing (USA, EU-US Data Privacy Framework)
• Bunny.net: Image hosting (Europe)
• Brevo: Transactional email sending (self-hosted, Stalwart SMTP)

Contact

For any questions about your personal data: contact@sepialy.art

You can also file a complaint with the CNIL: www.cnil.fr