Privacy policy

This policy explains what personal data Gesso for Galleries collects, why, who we share it with, and the choices you have. Gesso for Galleries is made by Gesso ("we", "us"), and runs at gessoforgalleries.com.

Who is responsible for what

We decide how to handle the data in staff accounts, in pilot requests sent from our website, and in our own records, so for that data we're the controller.

Galleries use Gesso for Galleries to keep records about their artists, collectors, and other contacts. Each gallery decides what goes in its workspace and is the controller of that data. We process it only on the gallery's behalf, to run the service, as set out in our agreement with the gallery. If you're a gallery's collector or artist, contact the gallery first about your data; we'll help them answer you.

What we collect

• Staff accounts: name, email address, a hash of your password (never the password itself), your two-factor settings, which galleries you belong to and your role there, and, if you sign in with Google, your Google account ID.
• Sign-in and security records: when you signed in, from which IP address, failed attempts, and the browser you used.
• Pilot requests: the name, email, gallery, city, and answers you send through the form on our website.
• Gallery records: what a gallery's staff enter, such as artists and their terms, works and photos, contacts with their addresses and notes, where works are, and a history of who changed what.
• Technical data: server logs and error reports, which can include your IP address and browser.

We don't run advertising, we don't use analytics cookies, and we don't sell personal data or share it for advertising.

How we use it

• To run the service: sign you in, show each gallery only its own records, and send the emails the service needs, such as invitations and password links.
• To keep it secure: limit repeated sign-in attempts, investigate problems, and fix errors.
• To plan the pilot: read pilot requests and reply to the galleries that send them.
• To meet legal obligations.

Where the GDPR or similar laws apply, we rely on our contract with the gallery to provide the service, on our legitimate interest in keeping it secure and working, and on your request when you send us a pilot request.

Who we share it with

We use these providers to run the service. Each handles personal data only to do its job for us:

• Railway hosts the app and its database in the United States.
• Cloudflare stores work photos (R2) and runs our domain names and email routing.
• Postmark sends the app's emails.
• Sentry receives error reports so we can fix problems.
• Google confirms who you are, but only if you choose "Continue with Google".

We also disclose data when the law requires it, or to protect people's rights and safety.

Cookies

We use only the cookies the service needs: one keeps you signed in during a visit, and, if you tick "Remember me", another keeps you signed in for up to two weeks. We don't use cookies for analytics or advertising.

How long we keep it

We keep staff accounts while they're in use. A gallery's records stay until the gallery deletes them or closes its account. Pilot requests stay while we plan the pilot and are deleted when we no longer need them. We keep some records longer when the law requires it, such as tax records for sales.

When a gallery erases a contact on request, everything that identifies that person is removed from the gallery's records and history. Sale amounts stay, without a name, for tax records.

Where it's processed

Data is stored and processed in the United States. Where the law requires it, we use safeguards such as standard contractual clauses for data that comes from other countries.

Your rights

Depending on where you live, you can ask to see, correct, export, or delete your personal data, or object to how we use it. Email us from the address on your account, and we'll answer within 30 days. If your data is in a gallery's records, ask the gallery; owners and directors can erase a contact on request. You can also complain to your local data protection authority.

California residents have the right to know, correct, and delete their personal information. We don't sell or share it for advertising.

Security, children, and changes

We protect data with encryption in transit, encrypted two-factor secrets, role-based permissions, and records kept separate for each gallery. No system is perfectly secure, and we'll tell affected galleries promptly if something goes wrong.

Gesso for Galleries is for gallery staff and isn't meant for children under 16.

If we change this policy in a way that matters, we'll update the date at the top and tell galleries by email.

Contact

Questions or requests: [email protected].