Privacy policy

Who we are

Artluni is made and run by Tenkin Studios, a UK-based product studio. For UK data protection law (UK GDPR and the Data Protection Act 2018), Tenkin Studios is the controller of the personal data described here.

For anything about your data, email [email protected].

What we collect

• Your account. Your email address, your name, and your password, which our sign-in provider stores in hashed form. If you sign in with Google, we receive your name and email address from Google.
• The work you upload. Your image is sent to our AI providers to write your critique. We don't keep the full-size image: we store a small thumbnail (and one of any reference photo you add) so you can see your history. Your browser re-saves images before upload, which removes their hidden metadata. Location (GPS) data is never read. In Photo mode we read camera settings such as shutter speed and aperture, to give photography advice.
• What you write and receive. Your questions, anything you tell us about the piece, follow-up questions, the critiques themselves, and any rating you give a critique.
• Your subscription. Payments are handled by Stripe. We never see your card details. We store your Stripe customer reference and the status of your subscription.
• Usage records. For each critique we record which AI services were used, how long they took and what they cost. We also count simple events inside Artluni, such as starting a checkout, and when you last used the service. We don't use third-party analytics or advertising tools.
• If we invite you. When we send you a personal invitation, we store your email address, your name if we included it, the message we wrote, the discount on offer, and whether you've used it. It's a one-off personal email, not marketing: we don't add you to a mailing list.
• Technical data. Your IP address is used briefly to limit abuse (rate limiting) and isn't stored. Our server logs contain short identifiers and timings, never your images or critique text.

How we use it, and why we're allowed to

• To provide Artluni (your account, critiques, history and subscription). This is necessary for our contract with you.
• To keep Artluni safe and working well: preventing abuse, checking the quality of critiques, answering support requests, and understanding which features are used and what they cost to run. This is in our legitimate interests.
• To invite people personally who we think would enjoy Artluni, with a one-off email. This is in our legitimate interests.
• To keep financial records that tax law requires. This is a legal obligation.

Every critique is automatically checked for quality. If it falls short, it isn't counted against your monthly allowance. We don't make any other automated decisions that have legal or similarly significant effects on you.

We don't sell your data, we don't show ads, and we don't use your work to train AI models.

Who we share it with

We use a small number of service providers who process data on our behalf, under their own data protection terms:

• OpenRouter (USA), which passes your image and text to the AI model that writes your critique. Those model providers may be in the USA or elsewhere.
• TypeSafe, which checks the quality of critiques. It receives the critique text and what you told us about the piece, not your image.
• Stripe, for payments and subscriptions, including invitation discounts. Stripe doesn't receive your email address from an invitation until you subscribe.
• Neon, which hosts our database and sign-in (London), and sends password-reset emails.
• Railway, which hosts the Artluni website (EU).
• Resend (USA), which sends our invitation emails. It receives your email address and the contents of the invite, and only if we've sent you a personal invite.
• Google, if you choose Google sign-in. When we suggest tutorial videos, their thumbnails load from YouTube's servers, which can see your IP address.

Where your data goes outside the UK, we rely on the safeguards these providers offer, such as UK adequacy regulations or the UK's International Data Transfer Addendum.

Cookies and storage on your device

We only use cookies that are needed to keep you signed in. Artluni also saves a few preferences on your device, such as your chosen critique style and whether you've ticked off an exercise. If you install Artluni as an app, your device keeps an offline copy of the site. We don't use advertising or tracking cookies.

How long we keep it

• We keep your account and critiques while your account is open. You can delete any critique at any time.
• Deleting your account (Account → Delete account) removes your account, critiques, thumbnails and history. Usage records are kept for our accounts, but with your identity removed.
• We keep invitation records so we know who we've invited. If you'd like yours deleted, email us.
• Payment records are kept by Stripe, and by us where needed, for as long as tax law requires (usually six years).
• Our hosting provider keeps server logs for a limited period.

Your rights

You have the right to:

• access the personal data we hold about you
• ask us to correct it
• ask us to delete it
• object to or restrict how we use it
• get a copy of it in a portable format

Email [email protected] and we'll respond within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO).

Age

Artluni is for adults aged 18 and over. We don't knowingly collect data from children.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change is significant, we'll tell you by email or in Artluni.