Privacy Policy

• Account details: name, username, email address and a securely hashed password (we never store your actual password). If you use Google sign-in, we receive your name, email address and Google account ID; we don't receive your Google password.
• Profile: anything you add, such as a photo, bio, country, art categories and styles, social links (Instagram, Pinterest and others) and commission settings.
• Your artwork: images you upload and their titles, descriptions, stories and tags. When you upload an image we remove its EXIF/GPS metadata, so your location isn't published.
• Commissions and messages: briefs, budgets, deadlines, reference images and messages between you and the other party.
• Payments: amount, status and Razorpay order and payment IDs. Razorpay processes your card, UPI or bank details; ARTON never receives them.
• Activity: likes, saves, follows and comments, and anonymised view counts (see below).
• Support messages you send us through the contact form.

• To run your account, show your gallery and deliver features you ask for (for example, messaging, commissions and payments).
• To recommend artwork and artists (For You and Rising Artists) based on what you like, save and follow on ARTON.
• To show artists anonymised insights (views, likes, saves and followers).
• To send essential emails, such as email confirmation and password reset. We don't send marketing emails without your consent.
• To keep ARTON secure: rate-limiting, fraud prevention and enforcing our Terms.
• To meet legal duties, such as keeping payment records for tax and accounting.

To count artwork and profile views without tracking you, we combine your IP address and browser type with a secret value that changes every day and store only the resulting scrambled code. We don't store your IP address, and the code can't be linked across days.

ARTON uses only essential cookies:

• arton_session: keeps you signed in (up to 30 days).
• arton_oauth: a temporary cookie (10 minutes) that protects Google sign-in.

We don't use advertising cookies or third-party analytics trackers. Razorpay's checkout window may set its own cookies needed to process payments.

We don't sell your personal data. We share it only with the service providers needed to run ARTON, under contracts that limit their use of it:

• Razorpay: to process payments and refunds.
• Google: only if you choose Google sign-in.
• Hosting and email providers that store ARTON's data and send its emails.
• Authorities, when Indian law requires it.

What you publish (public profile, published artwork, comments) is visible to everyone. Unlisted artwork is visible to anyone with the link; private artwork and drafts only to you.

We keep your data while your account is active. If you ask us to delete your account, we delete or anonymise your personal data within 30 days, except records we must keep by law (for example, payment and tax records, usually up to 8 years) and data needed to resolve open disputes or prevent fraud.

Under the DPDP Act, 2023 you can:

• access a summary of the personal data we hold about you;
• correct or update it (most of it directly in Settings);
• ask us to delete your account and data;
• withdraw consent (for example, by deleting content or your account);
• nominate someone to exercise these rights on your behalf;
• raise a grievance with our Grievance Officer (below), and if unresolved, with the Data Protection Board of India.

To use any of these rights, contact us through the contact page (topic “Privacy or my data”). We respond within 30 days.

Passwords are hashed with bcrypt, sessions use random tokens stored only in hashed form, all uploads are checked and re-encoded, and access to commissions, messages and reference images is limited to the two people involved. No system is perfectly secure; if you find a vulnerability, please report it as described on our Security page.

ARTON is for people aged 18 and over. We don't knowingly collect data from children. If you believe a child has created an account, contact us and we'll remove it.

If we change this policy in a meaningful way, we'll update the date above and tell you on the site or by email.

In line with the Information Technology Act, 2000 and the rules made under it, our Grievance Officer acknowledges complaints within 24 hours and resolves them within 15 days.

• Email: athuwankhade912@gmail.com
• Or use the contact form.