Who we are
Artistivo is operated by PXL CREATIVE LIMITED, 7 Fairfax, Cambridge, CB1 3AY, United Kingdom (the “Controller”). When you use artistivo.com, the Controller decides how your personal data is processed.
Questions about this policy or your data? Email hello@artistivo.com.
What we collect
Account data: email address, display name, username, and password hash (managed by AWS Cognito; we never see plaintext passwords).
Profile content: anything you choose to publish — bio, location, avatar, works, albums, events.
Usage data: pages viewed, search queries, and interaction events that help us understand what works. Aggregated and de-identified where possible.
Technical data: IP address, browser type, device class — used for security, fraud prevention, and basic analytics.
Why we use it
To deliver the platform, authenticate you, surface relevant artists and works, send transactional notifications (e.g. password reset, event invites you opted into), and improve the product. We do not sell your personal data.
Legal bases under GDPR: contract (delivering the service), consent (analytics, marketing email), and legitimate interest (security, abuse prevention).
Signing in with Google
What we receive: if you choose to sign in with Google, Google sends us only the basic profile information covered by the openid, email and profile scopes — your email address, your name, your profile picture, and the unique identifier that links your Google account to your account here. We never receive, see, or ask for your Google password, and we request no access to any other Google service: no Gmail, Drive, Calendar, Photos or Contacts.
What we use it for: solely to create and authenticate your account — to sign you in, to pre-fill your profile name and avatar (both of which you can change at any time), and to recognise you on later sign-ins. We do not use it for advertising or profiling, and we do not sell it or share it with third parties. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
How it is stored: the linked identity is held in AWS Cognito and in our own database, both hosted in the EU (eu-central-1), under the same retention rules as the rest of your account data.
Your control: you can revoke our access at any time from your Google Account permissions page. Deleting your account from account settings removes the linked Google identity along with the rest of your data.
Cookies and analytics
We use a small number of strictly-necessary cookies for authentication and session persistence. Analytics and marketing cookies require your explicit consent via our cookie banner (powered by CCM19). The Artistivo network sites (artistivo.com, barcelonaartists.com, britainartists.com, spainartists.com) are all operated by the same controller, and each site asks for your consent separately — your choice on one does not carry over to the others. You can withdraw at any time via Cookie Settings on any of these sites.
Google Analytics: with your consent, we use Google Analytics 4 (provided by Google Ireland Limited) to understand how the site is used so we can improve it. It sets the _ga and _ga_* cookies (up to 2 years) and processes pseudonymous usage data — pages viewed, approximate location from a truncated IP address, device and browser type, referring page, and a randomly generated identifier. The legal basis is your consent (Art. 6(1)(a) GDPR; § 25(1) TDDDG). Data may be transferred to Google in the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses. Analytics runs only after you accept the analytics category — decline or ignore the banner and Google Analytics loads nothing and sets no cookies.
You can revisit or withdraw your choices any time via Cookie Settings in the footer, or opt out with Google’s browser add-on.
Who we share it with
Service providers (data processors) that help us run Artistivo: AWS (hosting, eu-central-1 region), AWS Cognito (authentication), Stripe (payments — only if you subscribe), Amazon SES (transactional email), and a self-hosted CCM19 consent-management platform operated on our behalf by BlenCode GmbH (cookie consent).
All processors are contracted under GDPR-compliant Data Processing Agreements. Data remains in the EU unless explicitly stated otherwise.
Embedded media providers: some pages contain videos or audio hosted by YouTube (Google Ireland Limited), Vimeo, SoundCloud, or Spotify. These embeds are blocked by default — the provider only receives data (such as your IP address) after you explicitly choose to load the content. Where available we use the providers' privacy-enhanced modes (YouTube no-cookie, Vimeo Do-Not-Track).
Your rights
You can at any time:
- access a copy of your personal data
- correct or update inaccurate information
- delete your account and all associated content
- export your content in a machine-readable format
- withdraw consent for any opt-in processing
- lodge a complaint with your supervisory authority
Most of the above is self-service from Account Settings. For everything else, write to hello@artistivo.com and we’ll respond within 30 days.
Retention
Account data is kept while your account is active. After deletion, we retain anonymised usage logs for up to 12 months for security and analytics, then irreversibly delete them. Backups roll over within 30 days.
Changes to this policy
If we make material changes, we’ll notify you by email and update the “Last updated” date above. Continued use after the effective date means you accept the revised policy.