Paint of Society

Privacy Policy

What we collect, why, and your choices.

  1. 1Who we arePaint of Society is operated by Apeka Group Limited, company number 17105369, 66 Paul Street, London EC2A 4NA, United Kingdom, which is the data controller for your personal data under UK data protection law. Apeka Group Limited is registered with the Information Commissioner's Office (ICO), registration reference ZC109112. Contact: hello@paintofsociety.com.
  2. 2What we collectYour email address and login details; your username; the pixels you own and the designs and messages attached to them; order and consent records linked to your account (including the time, your IP address, and the terms version); and basic technical data such as your IP address, browser type, and approximate country. Card payments are handled by Stripe when a payment occurs; we never see or store your full card number.
  3. 3Why we use itTo provide the service and administer orders (performance of a contract); to keep records of payments, consents, and taxes (legal obligation); to secure the service, prevent fraud and abuse, limit traffic, and review reported content (our legitimate interests); and to contact you about your orders and the exhibition (performance of a contract). We do not use your data for third-party advertising.
  4. 4Who processes it for usWe use these providers: Supabase (database and login; data stored in London), Stripe (payments; certified under the UK Extension to the EU-US Data Privacy Framework), Vercel (hosting and anonymous performance analytics; certified under the UK Extension to the EU-US Data Privacy Framework), ImprovMX (email delivery), and Upstash (rate limiting; short-lived request counters keyed by IP address, stored in the European Union). They act only on our instructions. We do not sell your data.
  5. 5International transfersYour data is stored in the UK or the European Union, but some of our providers are based in or provide support from the United States. Where data leaves the UK we rely on safeguards recognised by UK law, such as the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses with the UK addendum. You can ask for a copy of the relevant safeguards by emailing hello@paintofsociety.com.
  6. 6How long we keep itAccount data: for as long as you have an account. Order, payment, and consent records: 6 years after the transaction, as required for tax and legal claims. Content reports: 3 years after resolution. Server and security logs: up to 30 days. Support emails: up to 2 years. Painted pixels, designs, and messages: permanently, as part of the shared artwork.
  7. 7The permanent artwork and your identityDesigns placed on the canvas are a permanent part of the collective artwork and are not deleted when an account closes. If you ask us to erase your data, we anonymise instead: your account is deleted, your username is replaced with a neutral placeholder, and your message is removed, while the painted design itself stays as an anonymous part of the artwork. This is the balance the law allows between your right to erasure and the integrity of a collective work.
  8. 8Your rightsYou can ask to access, correct, or delete your personal data, object to or restrict processing, and receive a copy of data you gave us in a portable format. Email hello@paintofsociety.com and we will respond within one month. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or to your local data protection authority.
  9. 9Cookies and browser storageWe only store what the site needs to work: your language choice (pos-lang), your in-progress design (pos-draft), whether you have seen the intro (pos-tutorial-seen), and Supabase login cookies that keep you signed in. Vercel Analytics measures visits without cookies and without tracking you across sites. Your approximate country, derived from your network address, may appear in our security logs. We do not use third-party advertising trackers, so no consent banner is required.
  10. 10ChildrenThe service is not intended for children under 13, and owning pixels or taking part in the artwork is limited to adults (18 or older). We do not knowingly collect data from children; if you believe a child has given us personal data, contact us and we will delete it.
  11. 11SecurityAll traffic is encrypted in transit. Database access is restricted with row-level security, card payments never touch our servers, and access to production systems is limited to the operator. No system is perfectly secure; if a breach affects your data we will notify you and the ICO as the law requires.
  12. 12ChangesWe will post any changes to this policy on this page with a new version date. If a change significantly affects your rights, we will highlight it on the site or email you.

Version 2026-08-12. Questions about your data: hello@paintofsociety.com.