Privacy Policy

Information We Collect

When you buy from us, we collect what is needed to fulfil the order:

• Name and shipping address
• Email address
• Payment information (processed by Stripe; we never see your full card number)

If you create an account, we also hold:

• Your name, email address, and any saved shipping or billing address
• Your password, stored only as a bcrypt hash. We cannot read it or recover it for you.
• Your order history, offers, bids, and any art cards registered to you

For account security we log sign-ins and account changes, which includes your IP address, your browser and operating system, and the time. This is what powers the list of signed-in devices on your profile, and it is how we detect and slow down attacks on accounts. We keep these records for a limited period and use them for nothing else.

How We Use Your Information

• Process and fulfil your orders
• Send order confirmation, shipping, and account security notifications
• Respond to customer service requests
• Protect accounts against unauthorised access

We do not sell your personal information, and we do not share it with third parties for their own marketing.

Your Rights and Controls

You can exercise these yourself from Profile Settings while signed in. No request or waiting period.

• Download your data. Get everything we hold about you as a single file: account, profile, orders, offers, bids, registered art cards, and your account security history.
• Correct your information. Update your name, address, and contact details at any time.
• Change your email or password. Changing your password signs out every other device. Changing your email requires confirmation from the new address, and we notify the old one.
• See and end sessions. Review every device signed in to your account and sign any of them out.
• Close your account. See what this does below.

Depending on where you live, you may also have rights under the GDPR or the CCPA, including the right to object to processing. Contact us at art@maclin.io and we will help. We will not treat you differently for exercising any of these rights.

Closing Your Account, and What We Keep

Closing your account erases your personal details: your name, email, phone number, saved addresses, saved payment methods, and your password. You are signed out everywhere and can no longer sign in. This cannot be undone.

We keep your order records. We are required to retain records of sales for tax and accounting purposes, so we cannot delete them on request. They are no longer connected to an account you can sign in to.

If an art card certificate is registered to you, the registration entry remains, because a certificate's ownership history is a permanent record of the artwork rather than personal data we hold about you. It will no longer show your name.

Security

Passwords are stored as bcrypt hashes, never in readable form. Sign-in links and password reset links are stored hashed as well, so they cannot be recovered from our database, and each one expires and works only once.

All payment processing is handled by Stripe. We never store or have access to your full card details. Stripe is PCI-DSS compliant and uses industry-standard encryption.

Data Retention

• Order and transaction records: kept as required by tax and accounting law
• Account details: kept until you close your account
• Security and sign-in logs: kept for a limited period, then discarded
• Sign-in and password reset links: minutes to an hour, then unusable

Third-Party Services

We rely on these providers to run the store:

• Stripe, for payment processing
• Supabase, for database and file storage
• Resend, for transactional email
• Shippo and the carriers, for shipping labels and delivery
• Vercel, for hosting

Children

Maclin is not intended for children under 13, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will remove it.

Contact

For any privacy question, including data access or deletion, email art@maclin.io.