Privacy Policy

The short version

We collect the minimum needed to turn artwork into framed prints and get them to the people who buy them. We do not sell personal information. We do not use student information for advertising, and we do not build advertising profiles of students.

Student records stay under the control of the school or district that provided them, and we return or delete them on request.

What we collect

What we hold depends on who you are.

• —Students — first and last name, grade, and teacher or class. That is all. We do not collect student dates of birth, addresses, identification numbers, health information or disciplinary records, and students do not need accounts.
• —School and district staff — name, work email address, role, and the organisation you belong to.
• —Buyers — name, email address, shipping address, phone number, and the contents of your order. Payment card details go directly to Stripe and never reach us.
• —Guardians — name and signature where a permission record is captured, and an email address where one is given.
• —Everyone — records of sign-ins and of actions taken in the platform, so we can answer questions about who did what.

Artwork images

Full-resolution artwork files, print-ready files, signed agreements and guardian permission documents are held in private storage and are reachable only through short-lived links issued to an authorised person.

Gallery thumbnails are served publicly so a gallery link can be shared with families. A piece appears there only after the school has published it and it has cleared the permission requirement described in the terms.

How we use it

We use personal information to:

• —produce, frame and ship orders, and handle returns and support;
• —run galleries and show artwork to the people entitled to see it;
• —calculate and pay earnings to schools, districts and artists;
• —send transactional messages — order confirmations, account invitations, and notices about your organisation;
• —keep the platform secure and investigate misuse.

What we do not do

• —We do not sell personal information, and we do not share it for cross-context behavioural advertising.
• —We do not use student information to target advertising, or to build a profile of a student for any purpose other than providing this service.
• —We do not use student information to train machine-learning models.

Who we share it with

We use a small number of providers to run the service. Each receives only what it needs, and none may use it for their own purposes.

• —Supabase — database, authentication and file storage. Hosted on AWS in the United States (us-east-1).
• —Vercel — application hosting. Handles traffic in transit; stores no application data at rest.
• —Railway — background processing, including image preparation and the outbound email queue.
• —Stripe — payment processing. Receives purchaser name, email and billing address. Card data is entered directly into Stripe.
• —Zoho (ZeptoMail) — transactional email: invitations, receipts and notices.
• —Zoho Mail — correspondence between Artomé staff and school or district contacts. Not used for student data.

Embedded content

A school may choose to embed a video or document on its own gallery page. Only YouTube (in its privacy-enhanced mode), Vimeo and published Google documents can be embedded, enforced by a server-side allow-list. Embedded media sits behind a click-to-play placeholder, so no request reaches the provider unless a visitor chooses to open it.

How it is protected

• —Row-level security is enabled on 81 of 85 application tables, including every table holding student information. The four exceptions hold product catalogue data and no personal information.
• —Access is scoped to your own school or district. One school cannot read, list or reach another school’s students, artwork, rosters or orders.
• —Full-resolution artwork, print files, agreements and permission documents are in private storage, served only through short-lived signed links.
• —All traffic is served over HTTPS, and data at rest is encrypted by the providers listed above.
• —Sign-ins, role grants and administrative actions are logged with who performed them and when.
• —We are not currently SOC 2 or ISO 27001 certified, and we do not claim to be.

Children and schools

Where a school or district provides student information, it does so as the party responsible for those records, and we act on its instructions as a school official with a legitimate educational interest. Student records remain the property and under the control of the school or district.

A student’s artwork is not offered for sale, and a student’s name is not printed, until a guardian permission record or an organisational release covers it.

Individual artist accounts require the account holder to be 13 or older. We do not knowingly collect personal information directly from children under 13, and if we learn that we have, we delete it.

How long we keep it

We keep artwork and order records for as long as the account is active, and for as long as we need them for accounting, tax and dispute purposes. Guardian permission records are kept as evidence of the permission given.

A school or district may ask us to return or delete its student information, and we will do so within a reasonable period, except where we must keep a record of a completed transaction.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, or to object to certain processing. Write to info@artome.com and we will respond.

For student information, please make the request through the school or district — they control those records and we act on their instruction.

We do not discriminate against anyone for exercising these rights.

Changes to this policy

We update this page when our practices change, including when we add or remove a provider from the list above. The effective date at the top always reflects the current version.

Contact

Privacy questions, or a request about your information: info@artome.com · Artomé, Alpharetta, Georgia, United States.