Legal

Privacy Policy

Effective from the day the ArtistQuarter service launches. Last updated October 5, 2026.

1. Who this covers
2. What we collect
3. How we use it
4. Jurying and anonymity
5. Payments
6. Email
7. Help assistant, tag suggestions and wallet cards
8. Who we share it with
9. Cookies
10. How long we keep it
11. Security
12. Your rights
13. Where it's stored
14. Children
15. Changes
16. Contact

1. Who this covers, and who is responsible

This policy covers Wildfire Interactive, operating ArtistQuarter, of Vancouver, British Columbia, Canada ("ArtistQuarter", "we"), and the ArtistQuarter service and website. It is written to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia's Personal Information Protection Act (PIPA), the EU and UK General Data Protection Regulation (GDPR), and US state privacy laws.

• Information held for an organization. When a guild, society, gallery or festival uses ArtistQuarter, it decides what to collect from its artists, jurors, members and buyers, and what to do with it. For that information we act on the organization's behalf, as its service provider (in some laws, its "processor"). If you entered a call or joined as a member, the organization is your first point of contact for questions about your information. We'll help it answer them.
• Information we hold for ourselves. We decide how to handle organization account and billing details, support requests, and visits to this website. For those we are responsible (the "controller").

2. What we collect

Who	What
Organization administrators	Name, email, role, organization details, billing contact, and the payment card kept on file for free calls (stored by the payment provider, not by us).
Artists	Name, contact details and address; entries, including artwork images, titles, sizes, media, prices and descriptions; entry status and results; profile and portfolio if you create one.
Jurors	Name and contact details; scores, comments and jurying progress.
Members	Membership type and dates, payment status, any custom details your organization asks for, directory listing choices, workshop registrations.
Buyers	Name, contact details and shipping address for purchases.
Everyone	Login details (your password is stored only as a one-way hash), records of payments and invoices, messages sent through the service, and basic technical logs such as IP address, browser and time of request, kept for security.

We collect only what's needed for the service and what organizations choose to ask for. We don't buy information about you from other sources.

3. How we use it

• To run the service: taking entries, jurying, sending results, managing memberships, processing payments through the organization's payment provider, and producing labels, catalogues and exports.
• To send email the service needs to send, such as receipts, reminders, results and password resets, and bulk email that your organization sends.
• To keep the service secure and prevent fraud and abuse.
• To bill organizations and give support.
• To meet legal obligations.

We don't sell personal information, and we don't "share" it for cross-context behavioural advertising, as US state privacy laws use those terms. We don't use it for advertising, we don't build marketing profiles, and we don't contact artists or members for our own marketing. We don't use your information or artwork to train AI models, and our contracts with our AI provider don't allow it to do so either.

Legal bases (EU and UK)

Where the GDPR applies, we rely on: contract, to provide the service you or your organization signed up for; legitimate interests, to keep the service secure and prevent fraud, which we balance against your rights; legal obligation, for tax and accounting records; and consent, for bulk email where the law requires it. You can withdraw consent at any time. For information held for an organization, the organization decides the legal basis.

4. Jurying and anonymity

In a blind jurying round, jurors see each work's images, title, size and medium (and its description, if the organization chooses), but not the artist's name or contact details. Organization administrators can see scores and comments. If an organization turns on juror comments, the artist may see the comments, but not which juror wrote them.

5. Payments

Card payments are made on the payment provider's own secure form, straight into the organization's account. We never receive or store full card numbers or security codes. We keep only what's needed to show and reconcile a payment: amount, date, status, card type, the last four digits and the provider's transaction reference. Card details never go into our logs.

6. Email

• Service emails, such as receipts, entry confirmations, results, juror reminders and password resets, go to you because you used the service.
• Bulk email from your organization is sent only to people the organization has permission to email. Every bulk email has an unsubscribe link that works immediately. We keep a record of consent and unsubscribes so organizations can follow anti-spam law.
• We record whether each email was delivered, bounced or marked as spam, to protect delivery for everyone. These delivery records contain addresses and subjects, but not the full message, and are deleted after 12 months.

7. Help assistant, tag suggestions and wallet cards

• Help assistant. What you type into the assistant is sent to our AI provider, Anthropic, to produce an answer. Please don't type passwords, card numbers or other people's personal details into it. Anthropic may not use it to train its models. We keep conversations for 90 days to fix problems, then delete them.
• Tag suggestions. When an artist adds artwork, its image may be sent to our AI provider, Anthropic, to suggest descriptive tags. Only the image is sent, not the artist's name or details.
• Wallet membership cards. If you add your membership card to Apple Wallet or Google Wallet, the card carries your name, organization, membership type and expiry date. After that, Apple or Google holds the card under its own privacy policy. You can remove the card at any time.

8. Who we share it with

We share personal information only:

• With the organization whose call you entered or which you joined;
• with service providers who help us run ArtistQuarter, under contracts that let them use it only to provide their service to us and require them to protect it (listed below);
• with the public, only where an organization publishes something, such as an online exhibition, member directory or results list, and only the details it chooses to show. Members can choose whether they appear in the directory;
• when the law requires it, or to protect someone's safety. Where we're allowed to, we'll tell the organization first;
• if the business changes hands, with notice beforehand and with this policy still applying.

Service providers

Purpose	Provider	Location
Hosting and database	Hetzner Online	United States
Image and file storage, image delivery	Cloudflare (R2 storage and content delivery)	United States; images are delivered through Cloudflare's worldwide network
Email delivery	Amazon Web Services (Amazon SES)	United States
Card payments (the organization's own account)	Stripe or Square, whichever the organization uses	Canada and United States
Help assistant and artwork tag suggestions	Anthropic	United States
Shipping quotes for artwork sales	Not yet in use. We'll name the provider here at least 30 days before it receives any information.	To be listed

We'll update this list and tell organization administrators at least 30 days before we add a new provider that handles customer data.

9. Cookies

We use only the cookies the service needs to work: keeping you signed in, remembering your login if you ask us to, and keeping your cart or entry in progress. We don't use analytics, advertising or tracking cookies, and this website has no third-party trackers. The payment provider's form may set its own cookies to prevent fraud.

10. How long we keep it

• Customer data is kept for as long as the organization keeps its account, or until the organization deletes it.
• When an organization closes its account, it has 60 days to export. We then delete its data from the live service within 30 days, and from backups within a further 35 days.
• Invoices and payment records may be kept longer where tax or accounting law requires.
• Security logs are kept for one year. Email delivery records are kept for 12 months.
• Temporary files, such as uploads in progress, generated exports and download bundles, are deleted automatically within 7 days.

11. Security

Section 8 of our Terms of Service lists our security commitments. In short:

• Everything is sent over encrypted connections. Uploaded images and files are encrypted where they're stored, and so are our backups.
• Passwords are stored only as strong one-way hashes and are never sent by email. Reset links work once and expire quickly.
• Private links use long random codes and expire.
• Uploaded files are checked and kept in private storage.
• Staff access to personal information is limited and logged.
• If a breach affects your information, we'll tell the organization without undue delay, and within 72 hours of confirming it, so that you can be told.

12. Your rights

Depending on where you live, you may have the right to see the information held about you, correct it, get a copy, have it deleted, or object to or limit how it's used. These rights come from laws including PIPEDA, BC PIPA, the GDPR and UK GDPR, and US state privacy laws. We won't treat you differently for using them.

• You can update most of your details yourself from your account.
• For information an organization holds about you, such as your entries or membership, contact that organization. If you contact us instead, we'll pass your request on to it and help it respond.
• For anything else, email our Privacy Officer at hello@artistquarter.com. We'll reply within 30 days. We may need to confirm your identity first.
• If you're not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, or, in the EU or UK, your local data protection authority.

Some records may have to be kept even after a deletion request, for example invoices that tax law requires, or jury scores an organization needs to keep for a call. In that case we'll tell you what we're keeping and why.

13. Where it's stored

We're based in Canada, but customer data is stored in the United States, with the hosting and storage providers listed above. Information stored there is subject to US law and may be accessible to US courts and authorities. For information from the EU and UK, we rely on Standard Contractual Clauses or another approved safeguard. Whatever the country, our contracts require every provider to protect information to the standard in this policy.

14. Children

ArtistQuarter isn't meant for children to use on their own. If an organization runs a call or membership for people under 16, it must get consent from a parent or guardian. If you believe a child's information was added without that consent, contact the organization or us and we'll help remove it.

15. Changes

We'll post any change here and update the date at the top. We'll email organization administrators at least 30 days before an important change takes effect.

16. Contact

Privacy Officer, Wildfire Interactive, operating ArtistQuarter, Vancouver, British Columbia, Canada. Email: hello@artistquarter.com