At D-ARTIST (accessible at dartist.lk), we believe privacy policies should reflect the actual technology and workflows running on the platform, rather than generic legal boilerplate. We do not sell your personal data, and we do not run third-party behavioral advertising networks.
1. Information We Collect
Depending on how you interact with D-ARTIST, we collect the following categories of information:
A. Account & Profile Information
- Registration Details: When you register an account, we collect your display name, chosen unique username, email address, and date of birth (for age verification).
- Authentication Credentials: Password authentication and Google Single Sign-On (OAuth) are handled securely through Google Firebase Authentication. D-ARTIST servers never see or store your raw password.
- Profile Avatar: If you upload a profile photo, it is processed and stored on our media distribution network.
- Art Interests: The traditional medium preferences you select (e.g. watercolor, charcoal, oil) to customize your discovery feed.
B. Artist Verification & Portfolio Information
If you apply to become a verified traditional artist, we additionally collect:
- Artist Biography & Statement: Your artistic background and statement.
- Studio Location: City or regional location.
- Direct Inquiry Contacts: Your studio WhatsApp phone number and inquiry email address.
- Disciplines & Collector Line: Selected mediums and custom artist tagline.
- Verification Media: High-resolution artwork photos, work-in-progress (WIP) stage photographs, and close-up photos of your physical hand-written signature on the artwork. WIP and signature photos are stored in our private, access-controlled storage bucket and are used exclusively by our curation team to review authenticity.
C. Artwork & Studio Content
- Artwork Metadata: Title, description, creation year, medium, substrate/materials, physical dimensions (height, width, depth), pricing in LKR, availability status, and tags.
- Artwork Imagery: High-resolution photographs of your artwork, stored in our Cloudflare R2 media storage.
- Curated Collections: Titles, descriptions, and curated groupings created inside Artist Studio.
D. Community & Interaction Data
- Comments: Comments and replies you post on artwork pages, synchronized in real time via Firebase Realtime Database.
- Saves & Follows: Records of artworks you bookmark and verified artists you follow, stored in our Cloudflare D1 database.
- Likes & Views: Anonymized view counts protected by temporary cooldown timestamps to prevent metric manipulation.
- Moderation Reports: Information submitted when you flag an artwork, comment, or user for guideline review.
E. Order & Acquisition Information
When you place an acquisition inquiry for an artwork:
- Delivery Address: Recipient name, contact phone number, street address, city, and postal code.
- Communication Channel Preference: Whether you choose WhatsApp or Email to connect with the artist.
- Order Status History: Logged status changes (e.g. New, Contacted, Preparing, Shipped, Completed) tracked in D1.
- Financial Disclaimer: Because D-ARTIST does not process payments directly, we do not collect, process, or store credit card numbers, bank account numbers, or payment gateway tokens.
2. How We Use Your Information
We use the information we collect strictly for the following purposes:
- Providing the Platform: Authenticating your session, rendering your public portfolio, maintaining your saved gallery, and delivering the service.
- Facilitating Direct Connections: Generating official acquisition requests and connecting buyers with artists via WhatsApp or studio email.
- Curatorial Verification: Reviewing artist applications to protect our human-crafted art standards.
- Notifications: Sending necessary transactional notifications (order requests, application decisions, comment alerts) via in-app feeds and email (sent via
notifications@dartist.lk). - Platform Security & Moderation: Enforcing our Terms of Service, preventing bot spam, and maintaining community safety.
3. Third-Party Service Providers Actually Used
We do not share your data with advertisers or data brokers. We rely solely on the following infrastructure providers:
- Google Firebase: Used for secure user authentication (Firebase Auth) and real-time comment synchronization (Firebase Realtime Database).
- Cloudflare: Provides serverless compute (Cloudflare Workers), relational database storage (Cloudflare D1), media storage (Cloudflare R2), and Content Delivery Network (CDN) caching with SSL/TLS encryption.
- Resend: Used to dispatch transactional system emails (e.g., account confirmation, order alerts, verification updates) using authenticated DKIM/SPF domains.
- WhatsApp (Meta): When you choose WhatsApp for order communication, your browser opens WhatsApp directly with a pre-formatted message. Meta's own privacy policy governs your WhatsApp communications with the artist.
4. Storage, Security & Cookies
We employ robust technical measures to safeguard your information:
- Transport Security: All data transmitted between your browser and our servers is encrypted using HTTPS / TLS 1.3.
- Database Integrity: Cloudflare D1 database operations use parameterized SQL queries, eliminating SQL injection risks.
- Token Cryptography: Worker API routes cryptographically verify Firebase ID Tokens using Google's public JWKS keys.
- Private Evidence Storage: Artist verification WIP photos and signature close-ups are sequestered in an access-restricted private bucket (
dartist-private), never exposed on public gallery feeds. - Cookies & Local Storage: We use browser LocalStorage and SessionStorage solely to preserve your active authentication session and UI preferences. We do not use third-party tracking or advertising cookies. A first-party Google Analytics tag (
G-57TSYE7YVV) is configured to measure aggregated platform page traffic without cross-site tracking.
5. Data Retention & Account Deletion
We retain your personal data only as long as your account remains active or as needed to provide our services.
- Account Deletion: You have the right to delete your D-ARTIST account and all associated personal data at any time.
- How to Request Deletion: Send an email from your registered address to support@dartist.lk with the subject "Account Deletion Request". Upon verification, your account profile, artist application records, and personal address entries will be permanently deleted from our database within 30 days.
- Artwork Removal: Artists may unpublish, delete, or archive their artworks at any time directly through the Artist Studio Workspace.
6. User Rights
Depending on your jurisdiction, you have the right to:
- Access the personal information we hold about you.
- Request correction of inaccurate or incomplete details.
- Request erasure of your personal data.
- Object to or restrict certain processing activities.
- Export your account data in a readable format.
To exercise any of these rights, contact us at support@dartist.lk.
7. Children's Privacy
D-ARTIST requires users to provide their date of birth during registration. The platform is not directed at children under the age of 13. If we discover that personal information has been collected from a child under 13 without verified parental consent, we will promptly delete that account.
8. Changes to this Privacy Policy
We may update this Privacy Policy periodically as platform features evolve. When changes are made, we will update the "Last Updated" date at the top of this page. Substantial changes will be announced via an in-app notice or email notification.
9. Contact Us
If you have questions, feedback, or privacy requests regarding this policy, please reach out directly:
D-ARTIST Privacy Desk
Email: support@dartist.lk
General Inquiries: hello@dartist.lk
Website: https://dartist.lk
Location: Colombo, Sri Lanka