Paint of Society

Privacy Policy

What we collect, why, and your choices.

  1. 1Who we arePaint of Society is operated by Apeka Group Limited, company number 17105369, 66 Paul Street, London EC2A 4NA, United Kingdom, which is the data controller for your personal data under UK data protection law. Contact: hello@paintofsociety.com.
  2. 2What we collectYour email address and login details; your username; the pixels you own and the designs and messages you attach to them; your order history and a record of the consents you give at checkout (including the time, your IP address, and the terms version); and basic technical data such as your IP address, browser type, and approximate country. Payments are handled by Stripe; we never see or store your full card number.
  3. 3Why we use itTo provide the service and complete your purchases (performance of a contract); to keep records of payments, consents, and taxes (legal obligation); to secure the service, prevent fraud and abuse, limit traffic, and review reported content (our legitimate interests); and to contact you about your purchases and any future auction (performance of a contract). We do not use your data for third-party advertising.
  4. 4Who processes it for usWe use these providers: Supabase (database and login; data stored in London), Stripe (payments; certified under the UK Extension to the EU-US Data Privacy Framework), Vercel (hosting and anonymous performance analytics; certified under the UK Extension to the Data Privacy Framework), ImprovMX (email delivery), and Upstash (rate limiting; short-lived request counters keyed by IP address, stored in the European Union). They act only on our instructions. We do not sell your data.
  5. 5International transfersYour data is stored in the UK or the European Union, but some of our providers are based in or provide support from the United States. Where data leaves the UK we rely on safeguards recognised by UK law, such as the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses with the UK addendum. You can ask for a copy of the relevant safeguards by emailing hello@paintofsociety.com.
  6. 6How long we keep itAccount data: for as long as you have an account. Order, payment, and consent records: 6 years after the transaction, as required for tax and legal claims. Content reports: 3 years after resolution. Server and security logs: up to 30 days. Support emails: up to 2 years. Painted pixels, designs, and messages: permanently, as part of the shared artwork.
  7. 7The permanent artwork and your identityDesigns placed on the canvas are a permanent part of the collective artwork and are not deleted when an account closes. If you ask us to erase your data, we anonymize instead: your account is deleted, your username is replaced with a neutral placeholder, and your message is removed, while the painted design itself stays as an anonymous part of the artwork. This is the balance the law allows between your right to erasure and the integrity of a collective work.
  8. 8Your rightsYou can ask to access, correct, or delete your personal data, object to or restrict processing, and receive a copy of data you gave us in a portable format. Email hello@paintofsociety.com and we will respond within one month. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or to your local data protection authority.
  9. 9Cookies and browser storageWe only store what the site needs to work: your language choice (pos-lang), your in-progress design (pos-draft), whether you have seen the intro (pos-tutorial-seen), your cart during checkout (pos-checkout, cleared when the tab closes), and Supabase login cookies that keep you signed in. Vercel Analytics measures visits without cookies and without tracking you across sites. We use your approximate country, taken from your network address, to show a local currency hint and to apply regional restrictions. We do not use third-party advertising trackers, so no consent banner is required.
  10. 10ChildrenThe service is not intended for children under 13, and you must be 18 or older to buy pixels. We do not knowingly collect data from children; if you believe a child has given us personal data, contact us and we will delete it.
  11. 11SecurityAll traffic is encrypted in transit. Database access is restricted with row-level security, card payments never touch our servers, and access to production systems is limited to the operator. No system is perfectly secure; if a breach affects your data we will notify you and the ICO as the law requires.
  12. 12ChangesWe will post any changes to this policy on this page with a new version date. If a change significantly affects your rights, we will highlight it on the site or email you.

Version 2026-07-10. Questions about your data: hello@paintofsociety.com.