Biennale.io Privacy Policy

1. Artist Ownership of Works

1.1 Full Ownership Retained

Artists retain full copyright, intellectual property, and moral rights to all works uploaded to the Platform. Biennale.io does not claim ownership of your creative content.

1.2 Licensing to Biennale.io

Artists retain full copyright and moral rights. By uploading work, you grant Biennale.io a limited, non-exclusive licence to store it and process it for review, curation, and presentation within your private Studio and collections, and to display it to viewers through sharing links you activate.

Only when you submit a work for public presentation and human curators approve it does this licence also cover display in the Biennale.io Gallery and use on Biennale.io’s official communication channels, including social accounts, to promote the artist and the Platform. Private uploads are not authorized for public promotion. This does not transfer ownership or permit resale or licensing to unrelated third parties.

You can withdraw a work from public display, revoke collection links, or request removal by contacting hello@biennale.io. The display and promotional licence ends when withdrawal or soft deletion is processed; we stop new promotional use and remove existing uses from channels we control. Copies already shared or published by others may remain outside our control. A limited storage and processing permission continues during the 90-day soft-deletion retention period and for records that must be retained by law. It does not authorize continued public display or promotion.

1.3 Future Artist Compensation

Any future artist compensation programme will be explained in separate terms before participation. No current payout entitlement is established by this policy.

1.4 User Responsibility

Users may only upload works they have the legal right to share. You are responsible for ensuring you own or have permission to use all content you upload.

2. Data We Collect

2.1 Account and Content Data

We process account and profile information, including name, email, date of birth, country, biography, profile picture and social links; artworks, descriptions and metadata; messages, support requests and consent records. For under-18 artists we also process the parent or guardian consent form and related correspondence.

2.2 Gallery Experience Data

Gallery experience data includes artwork views, information-panel opens, saved art, likes and ratings where used, and choices such as “Not for me” and “Show less from this artist”. We also store your language, audio and appearance preferences. For signed-in users, these records can be linked to their account. They support the experience, remember choices, and improve the service; they are not advertising data.

2.3 Subscription Data

Apple or Google processes Gallery purchases. We receive purchase references, store and product identifiers, verification and expiry information to verify and restore subscription access. We do not store your payment card details.

2.4 Optional Hub Analytics

If you accept optional analytics cookies in the Artists Hub, usage and device information may be processed through Google Analytics to understand performance and improve the service. If you reject them, analytics storage consent remains denied. We do not use advertising cookies, remarketing pixels, or data for advertising.

2.5 Essential Operational Data

We process authentication, security, error and performance logs necessary to operate and protect the service. Such records may contain account or technical identifiers; they are not all anonymous.

3. How We Use Your Data

We use account and content data to provide the Artists Hub and Gallery, process and review artworks, enable sharing, deliver messages, verify subscriptions, maintain security, and provide support. Gallery interaction history and preferences support the requested experience and service improvement. Optional Hub analytics help us understand usage and optimise performance. We do not use this data to serve or target advertising.

We send marketing emails only with separate permission. Accepting analytics cookies does not subscribe you to marketing.

Legal Bases

We rely on contract performance to provide requested services, consent for optional analytics cookies and marketing, legitimate interests for proportionate service improvement and security, and legal obligations where applicable. You can exercise the rights described in Section 11.

4. Cookies and Tracking Technologies

4.1 Artists Hub

Essential cookies support authentication, security, and remembering your consent choice. The Hub also offers optional analytics cookies to help us understand and optimise the service. “Accept analytics” grants analytics storage permission; “Reject analytics” leaves it denied. Advertising storage, advertising user data, and advertising personalization permissions remain denied with either choice.

Google Tag Manager and Google Analytics support this measurement. Denied analytics storage is not permission to set analytics cookies; Google Consent Mode may still send limited cookieless consent and measurement signals. These signals are not used by Biennale.io for advertising and should not be described as a guarantee of anonymity.

4.2 Gallery Experience

The Gallery does not use the Hub’s optional analytics-cookie choice to control account-linked experience records. Artwork interactions, saved choices, preferences and subscription verification form part of providing and improving the Gallery experience. They are described in Sections 2 and 3 and remain subject to your privacy rights. Essential authentication and session technologies may still be used. This does not authorize advertising tracking or undisclosed optional tracking.

4.3 Changing Your Choice

Use “Cookie settings” in the Hub to accept or reject optional analytics again. Your consent choice is stored for up to one year. Browser controls can also clear or block cookies, although blocking essential cookies may prevent sign-in or other core functions.

4.4 No Advertising

We do not use advertising cookies, remarketing pixels, or cookie-derived audiences, and do not use your data to serve or target advertisements.

5. AI and Data Usage

5.1 Curation and Recommendations

Biennale.io uses AI technologies to:

• Curate and recommend artworks based on user preferences
• Organize collections and exhibitions
• Provide search and discovery features
• Enhance content moderation and safety

Gallery choices and interaction history may be linked to your account to support the experience, independently of the Hub analytics-cookie choice. Cookie rejection does not make account activity anonymous.

5.2 Training Data

Unless explicitly agreed by the artist, uploaded works will NOT be used to:

• Train AI or machine learning models
• Create derivative works
• Generate synthetic content
• Develop competing products or services

Artists who wish to participate in AI training programs must opt-in separately through explicit agreement.

5.3 Content Moderation AI

We use AI for automated content moderation to detect:

• Copyright violations
• Inappropriate content
• Spam or malicious activity

This processing is necessary for Platform safety and complies with legal obligations.

6. Legal Basis for Processing (GDPR/UK DPA)

For users in the UK, EU, and EEA, we process your personal data based on:

1. Consent (Article 6(1)(a) GDPR):
   • When you accept cookies
   • When you opt-in to marketing communications
   • When you provide explicit permission for specific processing
2. Contract Performance (Article 6(1)(b) GDPR):
   • To provide Platform services you've requested
   • To process payments and manage your account
   • To fulfill our obligations under the Terms of Service
3. Legitimate Interests (Article 6(1)(f) GDPR):
   • To improve Platform security and prevent fraud
   • To improve service performance through proportionate operational measurement; optional analytics cookies rely on consent
   • To develop and improve our services
   • To protect intellectual property rights
4. Legal Obligation (Article 6(1)(c) GDPR):
   • To comply with legal requirements
   • To respond to lawful requests from authorities
   • To enforce our Terms of Service

7. Sharing of Data

7.1 We Do Not Sell Your Data

Biennale.io does not sell or rent your personal data to third parties.

7.2 When We Share Data

Service Providers (Data Processors):

• Hosting and infrastructure providers (Microsoft Azure)
• Apple App Store and Google Play for Gallery purchases and subscription verification
• Email service providers
• Analytics providers (Google Analytics - only with consent)
• Security and fraud prevention services

All service providers are bound by data protection agreements and process data only on our instructions.

With Your Consent:

• Social media platforms (when you enable sharing features)

Legal Requirements:

• Law enforcement or regulatory authorities when required by law
• To protect rights, property, or safety of Biennale.io, users, or the public
• In response to lawful court orders or subpoenas

Business Transfers:

In the event of merger, acquisition, or asset sale, your data may be transferred (you will be notified)

7.3 No Advertising Tracking

We do not use cookies or tracking pixels to build advertising audiences, target advertisements, or remarket to visitors. We do not share cookie-derived data with advertising partners for these purposes.

8. International Transfers

8.1 Data Storage Locations

Your data may be stored and processed in:

• United Kingdom
• European Economic Area
• United States (for certain service providers)

8.2 Safeguards for International Transfers

When transferring data outside the UK/EU, we implement:

• Standard Contractual Clauses (SCCs) approved by the EU Commission
• Adequacy decisions where applicable
• Additional security measures including encryption and access controls
• Data Protection Impact Assessments (DPIAs) for high-risk transfers

8.3 Your Rights Regarding International Transfers

You have the right to:

• Request information about data transfer mechanisms
• Object to transfers that do not provide adequate protection
• Contact us for copies of applicable safeguards

9. Data Retention and Deletion

9.1 Current Manual Process

Request account closure or content removal at hello@biennale.io. Requests are currently handled manually. We apply soft deletion to remove the account or content from active use and public display. The affected records and stored content are permanently destroyed 90 days after soft deletion. The 90-day period begins when soft deletion is applied, not when the request is sent. Records we must retain by law are restricted to that purpose and retained for the required period.

This rule applies to retained copies, including backups; it is not a separate 30-day artwork deletion schedule. Subscription cancellation must be completed separately through Apple or Google.

9.2 Artwork and Sharing

Studio deletion marks an artwork as deleted. Remove it from collections first, or ask support for help. Revoke active collection links when withdrawing shared content. Soft deletion ends active display and new promotional use as described in Section 1.2; the retention period does not authorize continued display.

9.3 Other Records

We retain account-linked operational and experience data while needed to provide the service, subject to the account-deletion rule above. Optional analytics data is retained for up to 26 months. Truly anonymized aggregate statistics that no longer identify an individual may be retained longer.

10. Security Measures

We implement industry-standard security measures:

10.1 Technical Measures

• Encryption: TLS/SSL for data in transit, AES-256 for data at rest
• Access Controls: Role-based access, multi-factor authentication
• Secure Servers: Microsoft Azure with SOC 2 Type II certification
• Firewall Protection: Network segmentation and intrusion detection
• Regular Security Audits: Penetration testing and vulnerability assessments

10.2 Organizational Measures

• Staff Training: Regular privacy and security training
• Data Processing Agreements: With all service providers
• Incident Response Plan: Procedures for data breach notification
• Privacy by Design: Security considerations in all development

10.3 Payment Security

• PCI-DSS Compliance: Level 1 certified payment processors
• Tokenization: Payment card data never stored on our servers
• 3D Secure: Additional authentication for card payments

10.4 Your Responsibility

You are responsible for:

• Maintaining password confidentiality
• Using secure networks when accessing the Platform
• Reporting suspicious activity immediately

11. Your Privacy Rights

11.1 Rights Under GDPR/UK DPA

Right to Access (Article 15):

• Request a copy of all personal data we hold about you
• Receive information about how we process your data

Right to Rectification (Article 16):

• Correct inaccurate or incomplete personal data

Right to Erasure / "Right to be Forgotten" (Article 17):

• Request deletion of your personal data
• Subject to legal retention requirements

Right to Restrict Processing (Article 18):

• Limit how we use your data in certain circumstances

Right to Data Portability (Article 20):

• Receive your data in a structured, machine-readable format
• Transfer your data to another service provider

Right to Object (Article 21):

• Object to processing based on legitimate interests
• Object to direct marketing at any time

Right to Withdraw Consent:

• Withdraw cookie consent at any time
• Unsubscribe from marketing communications
• Does not affect lawfulness of processing before withdrawal

Right to Lodge a Complaint:

• Contact your local data protection authority
• UK: Information Commissioner's Office (ICO) - ico.org.uk

11.2 Rights Under CCPA (California Users)

Right to Know:

• Categories of personal information collected
• Sources of information
• Business purposes for collection
• Categories of third parties with whom data is shared

Right to Delete:

• Request deletion of personal information

Right to Opt-Out:

• Opt-out of sale of personal information (Note: We do not sell data)

Right to Non-Discrimination:

• Not receive discriminatory treatment for exercising privacy rights

11.3 Exercising Your Rights

To exercise any of these rights:

1. Email us at: hello@biennale.io with subject "Privacy Rights Request"
2. Provide proof of identity (to prevent unauthorized access)
3. Specify which right(s) you wish to exercise

We will respond within:

• 30 days for GDPR requests
• 45 days for CCPA requests
• May be extended by additional 30 days for complex requests (with notification)

12. Marketing Communications

12.1 Types of Communications

With Your Consent:

• Newsletter and product updates
• Personalized recommendations
• Promotional offers and events
• New feature announcements

Service-Related (No Consent Required):

• Account notifications and security alerts
• Payment confirmations and receipts
• Legal notices and policy updates
• Support responses

12.2 Opt-Out Options

You can unsubscribe from marketing communications:

• Click "Unsubscribe" link in any marketing email
• Contact us at hello@biennale.io

Note: You cannot opt-out of essential service communications.

13. Third-Party Links and Services

13.1 External Links

The Platform may contain links to third-party websites, plugins, or applications. We are not responsible for:

• Privacy practices of third-party sites
• Content or security of external links
• Data collection by third parties

We recommend reviewing the privacy policies of any third-party sites you visit.

13.2 Social Media Integration

If you use social media features (e.g., sharing buttons), these platforms may collect data about you according to their own privacy policies:

• Facebook: https://www.facebook.com/privacy
• Instagram: https://help.instagram.com/privacy
• Twitter/X: https://twitter.com/privacy

14. Younger Artists and Gallery Eligibility

14.1 Artists Hub

Invited artists under 18 may participate only after we have received and accepted signed parent or guardian consent. Request an invitation first. We provide a consent form for the parent or guardian to confirm they have discussed participation with the artist and agree to it. Return the signed form before we process the request and issue the invitation code. Contact hello@biennale.io for assistance; do not enter a false date of birth to bypass registration checks.

14.2 Gallery

Gallery account holders and subscribers must be at least 18. A family-account feature for younger viewers is planned but is not currently available. Approved participation in the Artists Hub does not override Gallery account eligibility.

14.3 Questions and Removal

A parent or guardian can contact hello@biennale.io about an artist’s participation, consent, or a removal request. We review unauthorized under-age registrations and handle removal under the manual soft-deletion and 90-day destruction process in Section 9, subject to applicable legal requirements.

15. Changes to This Privacy Policy

15.1 Updates

We may update this Privacy Policy to reflect:

• Changes in our practices
• New legal requirements
• Feedback from users
• Technology developments

15.2 Notification

We will notify you of significant changes by:

• Email notification to registered users
• Prominent notice on the Platform
• Updated "Last Updated" date at the top of this policy

15.3 Continued Use

Your continued use of the Platform after changes constitutes acceptance of the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically.

16. Data Protection Officer

For data protection inquiries, you can contact our Data Protection Officer:

17. Contact Us

For any privacy-related questions, concerns, or requests:

Response Time: We aim to respond to all inquiries within 5 business days.

18. Supervisory Authority

If you are in the UK/EU and believe we have not addressed your concerns, you have the right to lodge a complaint with your local supervisory authority:

UK Users:
Information Commissioner's Office (ICO)
Website: https://ico.org.uk

EU Users:
Find your local data protection authority: https://edpb.europa.eu/about-edpb/board/members_en

Appendix A: Cookie and Tracking Technology Details

Essential cookies support authentication, security, and Platform operation. Analytics technologies help us understand and improve use of the Platform, subject to the choices described in Section 4.

Advertising cookies, remarketing pixels, and advertising audience tracking are not used, regardless of whether you accept or reject optional cookies.

This Privacy Policy is updated on 27 October 2026.

© 2026 Biennale.io LTD. All rights reserved.