Privacy Policy

This Privacy Policy explains how Artisans Paradise LLC ("Artisans Paradise," "we," "us," or "our") collects, uses, shares, and protects information about you when you use the Artisans Paradise website, live-selling platform, and related services (the "Service"). Artisans Paradise LLC is the controller responsible for your personal information. We are based in and operate the Service from the United States and serve users globally. By using the Service, you agree to this Policy, which should be read together with our Terms of Service.

Where local law gives you specific rights or requires specific disclosures — for example in the European Economic Area ("EEA"), the United Kingdom, Switzerland, California and other U.S. states, Canada, Brazil, and Australia — the region-specific sections below apply to you and, where they conflict with the general terms, control.

1. Information We Collect

• Account data: name, email address, password (stored only as a secure hash), date of birth (to verify you are 18+), and account role (buyer / seller / admin).
• Profile and seller data: display name, shop name, bio, profile and portfolio photos, social links, craft category, and — for Sellers — business, tax, banking, and identity-verification information collected and verified directly by our payment processor (see Payment Information). We do not receive or store government IDs, full bank numbers, or Social Security / tax identification numbers ourselves.
• Contact and shipping data: shipping recipient name, phone number, and any postal addresses you save.
• Payment data: handled by our payment processor (Stripe). We receive and store only limited identifiers (such as customer and payment-method tokens and the last four digits / card brand). We never receive or store full card numbers.
• Marketplace activity: bids, orders, purchases, listings, saved items, follows, reviews, ratings, and messages.
• Live streaming and chat: video and audio you broadcast, stream recordings, viewer counts, and chat messages. Anything you say, show, or type in a public stream or chat is visible to other participants.
• Communications and preferences: notification, push, and email preferences, marketing opt-ins, and support correspondence.
• Device and usage data: IP address, approximate location derived from IP (city / country level — we do not collect precise GPS geolocation), browser and device information, pages viewed, referring pages, timestamps, and error/diagnostic reports.
• Cookies and similar technologies: as described in Section 8.

2. How We Collect Information

We collect information directly from you (when you register, build a profile, list items, bid, buy, stream, review, or contact us); automatically (through cookies and server logs as you use the Service); and from third parties, such as our payment processor during Seller onboarding, identity, tax, and bank verification, and our shipping and fraud-prevention providers.

3. How We Use Your Information

• To operate the marketplace — create accounts, authenticate you, list and display items, run auctions and live streams, and process orders.
• To process payments, holds, payouts, refunds, and chargebacks, and to detect, investigate, and prevent fraud, abuse, and security incidents.
• To arrange shipping and provide tracking, and to enable Buyer–Seller fulfillment.
• To send transactional messages (order, bid, and account notifications) and, with your consent where required, marketing messages you can opt out of at any time.
• To provide customer support, moderate content, and enforce our Terms and policies.
• To operate, improve, personalize, and secure the Service, including through aggregated or de-identified analytics.
• To comply with legal, tax, and regulatory obligations (for example, Seller earnings reporting such as IRS Form 1099-K where applicable) and to respond to lawful requests, disputes, and intellectual-property claims.

4. Legal Bases for Processing (EEA / UK / Switzerland)

If you are in the EEA, the UK, or Switzerland, we process your personal information only where we have a legal basis to do so under the GDPR / UK GDPR:

• Performance of a contract — to create and operate your account and complete the sales, bids, payments, and fulfillment you request.
• Legitimate interests — to secure the Service, prevent fraud and abuse, moderate content, understand how the Service is used, and communicate about it, provided those interests are not overridden by your rights.
• Consent — for optional cookies, certain marketing, and any processing that specifically asks for your consent; you may withdraw consent at any time without affecting prior processing.
• Legal obligation — to meet tax, accounting, and other legal requirements and to respond to lawful requests.
• Vital interests / public interest — in rare cases, to protect someone's safety.

5. How We Share Information

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising (as those terms are defined under California and other U.S. state laws). We disclose personal information only as described here:

• Between Buyers and Sellers — to complete a sale, a Seller receives the information needed to fulfill and ship an order (such as the Buyer's shipping name, address, and phone), and Buyers see Seller shop and public profile information. Please treat other users' information responsibly.
• Service providers (processors) who handle data on our behalf, under contract and only on our instructions, including:
  • Stripe — payments, Connect payout onboarding, and identity / tax / bank verification.
  • Mux — live video ingest, playback, and recording.
  • LiveKit — browser-based (WebRTC) stream ingestion.
  • Ably — real-time bid, auction, and chat delivery.
  • Amazon Web Services (S3) — image and media storage (United States).
  • Railway — application hosting and database.
  • EasyPost — shipping-label generation and tracking.
  • SendGrid (Twilio) — transactional and opt-in marketing email.
  • Sentry — error monitoring and diagnostics.
  • Upstash — rate limiting and abuse prevention.
  We maintain a current list of sub-processors and will provide it on request; we require each to protect your information and use it only to provide services to us.
• Legal and safety — to comply with law, enforce our Terms, respond to legal process, or protect the rights, property, or safety of our users, the public, or us.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction; we will require the recipient to honor this Policy or provide notice and choices as required by law.
• Aggregated or de-identified information — which cannot reasonably be used to identify you — for any purpose.
• With your direction or consent — for anything else.

6. Payment Information

Payment card and Seller banking / identity details are collected and processed directly by Stripe, a PCI-DSS-compliant payment provider, subject to Stripe's own privacy terms. We use tokens to charge, hold, refund, and pay out, but we do not store your full card number, bank number, or government identifiers on our systems.

7. Cookies and Tracking Technologies

We use cookies and similar technologies in three categories:

• Essential (for example, your login session, security / CSRF tokens, and cart) — required for the Service to function; these do not need consent.
• Analytics — help us understand and improve how the Service is used. Off by default; used only where you opt in.
• Marketing — would support future advertising / retargeting. Off by default; used only where you opt in. We do not currently run advertising trackers.

On your first visit you can Accept, Reject, or Customize optional cookies, and you can change your choices any time via the Cookie preferences link in the footer. Because we do not sell or share your personal information, there is currently nothing for a Global Privacy Control (GPC) signal to opt you out of; if this ever changes, we will treat GPC as a valid opt-out as required by law. Because there is no common standard for "Do Not Track," we do not respond to DNT signals.

8. International Data Transfers

We operate the Service from the United States, and our processors may store and process information in the United States and in other countries where they or their sub-processors operate. If you access the Service from outside the United States, your information will be transferred to and processed in countries whose data-protection laws may differ from those of your country.

Where we transfer personal information out of the EEA, the UK, or Switzerland to a country that has not been recognized as providing an adequate level of protection, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum / IDTA and the Swiss addendum, as applicable), or another lawful transfer mechanism. You may request a copy of the relevant safeguards using the contact details below.

9. Data Retention

We keep personal information only as long as necessary for the purposes described in this Policy, then delete or de-identify it. Retention periods depend on the type of data and legal requirements:

• Account data — while your account is active, and for a limited period after closure to handle refunds, disputes, and legal obligations.
• Order and payment records — retained as long as required for tax, accounting, and legal compliance (generally up to seven years).
• Stream recordings — retained for a limited period unless a Seller elects to keep them longer.
• Chat messages — retained until the associated stream is deleted or for a limited period after it ends.
• Security and admin audit logs — retained for compliance and abuse-prevention purposes.

10. Data Security

We use administrative, technical, and organizational safeguards designed to protect your information, including encryption in transit (HTTPS/TLS), hashed passwords, tokenized payments, and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately.

11. Your Privacy Rights and Choices

Depending on where you live, you may have some or all of the following rights over your personal information. We honor these rights as required by applicable law and will not discriminate against you for exercising them.

11.1 Rights available to everyone

• Access a copy of your information and update or correct your profile and account details.
• Close your account and request deletion of your information (subject to records we must keep by law).
• Opt out of marketing email at any time using the unsubscribe link or your email preferences, and manage push and cookie preferences.

11.2 EEA, UK, and Switzerland (GDPR / UK GDPR)

You have the right to: access; rectification; erasure ("right to be forgotten"); restriction of processing; data portability; object to processing based on legitimate interests or to direct marketing; and withdraw consent at any time. You also have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office). We would, however, appreciate the chance to address your concerns first.

11.3 California (CCPA / CPRA)

In the past 12 months we have collected the following categories of personal information: identifiers (name, email, IP); customer records (contact and shipping details); commercial information (orders, bids, purchases); internet / network activity (usage and device data); audio / visual information (stream video, audio, photos you upload); professional or business information (Seller shop and business details); geolocation (approximate, from IP); and inferences drawn to personalize and secure the Service. Certain account credentials are treated as sensitive personal information; we use these only to provide and secure the Service and do not use them to infer characteristics.

We collect these from the sources in Section 2 and use and disclose them for the purposes in Sections 3 and 5. California residents have the right to: know / access, correct, delete, and opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information. We do not sell or share personal information and do not use sensitive personal information for any purpose that would trigger a right to limit. You may use an authorized agent to submit requests, and California's "Shine the Light" law lets residents request information about disclosures for third parties' direct marketing (we do not make such disclosures). We honor GPC as described in Section 7.

11.4 Other U.S. states

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as they take effect) have rights to access, correct, delete, and obtain a portable copy of their information, and to opt out of targeted advertising, sale, and certain profiling. Because we do not sell personal information or use it for targeted advertising, those opt-outs have no effect today, but you may still exercise your access, correction, deletion, and portability rights. Where required, you may appeal a decision on your request by replying to our response.

11.5 Canada, Brazil, Australia, and other regions

If you are in Canada (PIPEDA), Brazil (LGPD), Australia (Privacy Act), or another jurisdiction with data-protection rights, you may access, correct, and request deletion of your information and, where applicable, complain to your national data-protection authority. We apply the protections in this Policy to all users and will honor local rights as the law requires.

11.6 How to exercise your rights

Email privacy@artisansparadise.com or use the account tools we provide. To protect your privacy, we will take reasonable steps to verify your identity before acting, and we may be unable to fulfill a request that would compromise others' rights or that the law requires or permits us to decline. We respond within the timeframe required by applicable law (generally 30–45 days), and this service is free unless a request is excessive or repetitive.

12. Automated Decision-Making and Profiling

We use automated tools to help detect and prevent fraud, abuse, and prohibited activity (for example, flagging suspicious bids, payments, or accounts). We do not make decisions producing legal or similarly significant effects about you based solely on automated processing without human involvement. If a significant automated decision ever applies to you, you may request human review and contest it where required by law.

13. Children's Privacy

The Service is intended for adults and is not directed to anyone under 18. We require users to be at least 18 years old and do not knowingly collect personal information from anyone under 18 (or the higher age of majority in your jurisdiction). If you believe a minor has provided us information, contact us and we will delete it and close the account.

14. Third-Party Links and Services

The Service may link to or integrate third-party websites and services (such as Sellers' social links) that we do not control. This Policy does not apply to those sites, and we encourage you to review their privacy policies.

15. Changes to This Policy

We may update this Policy from time to time. The effective date at the top of this page reflects the current version, and we will provide notice of material changes as required by law (for example, by email or an in-product notice, and by asking you to re-acknowledge where required).

16. Controller, Representatives, and Contact

Data controller: Artisans Paradise LLC, Massachusetts, USA.

EEA / UK representative: If you are in the EEA or UK, you may contact our Article 27 representative once appointed. [EEA and UK representatives — to be appointed before targeting those regions]

Privacy contact: Questions or privacy requests — privacy@artisansparadise.com [dedicated privacy inbox — to be set up]. You may also have the right to complain to your local data-protection authority.