ArtraPeople Privacy Policy

1. Scope and responsible party

This Policy applies to the current website prototype, including account, profile, portfolio, messaging and verification demonstrations. Mobile applications and live processing by external providers are planned, not confirmed as operational by this Policy.

ArtraPeople is operated by Alina Khozhantayeva, full legal name Khozhantayeva Alina Rustemovna (Хожантаева Алина Рустемовна), an individual founder based in Kazakhstan. She is the responsible owner and operator of personal data and currently works alone; no separate review or support team is appointed.

For support, privacy and account-deletion requests, email support@artrapeople.com, including if you cannot sign in. The founder handles requests; no 24/7 response is promised. Never send passwords, recovery codes or identity documents in your initial email. Receiving a request does not mean that deletion has been completed.

2. Personal data we collect

The prototype can process details entered into its forms: real and public professional names, transliterations, email, date of birth, gender, country of origin and residence, city, language, professional role, interests and collaboration preferences. Registration, verification of contact details, login and password recovery use email only; phone and SMS authentication are disabled. Passwords are checked on the server and stored as password hashes, not as readable passwords.

In database test mode, Supabase Auth stores email accounts, password hashes, confirmation/recovery state, authenticator factors and sessions. The local PostgreSQL database stores each account's private profile draft, limited image previews, saved searches, contacts, chat drafts and conversations. These records survive application and database-container restarts. Language/theme choices and the pending email-verification step may remain in browser storage. Existing shared browser-demo records are neither imported nor erased automatically.

Session and security cookies support authentication and request protection. Local browser storage supports the prototype, language and theme choices. Requests can produce technical and security records, including IP-related identifiers, request times and outcomes. Future analytics, diagnostics and verification collection require a reviewed data inventory; only necessary data should be requested.

3. Why we process data

The current processing supports testing of accounts, professional profiles, discovery, QR and artwork sharing, communications, safety and support. Live identity verification, external analytics and provider-based delivery must not be inferred from demonstration screens.

Before real-data collection, each purpose, necessary data category, recipient and retention rule must have an applicable legal basis. Where consent is required, it must be recorded in a confirmable form. Reading or accepting this Policy is not blanket permission for new purposes, foreign transfers or promotional use; any required additional consent must be obtained before that processing.

4. Public profiles and communications

Profiles are private drafts until explicitly published. Discovery exposes only the professional display name, role, city/country, practice, interests, collaboration preferences and reviewed status. Legal names, birth dates, gender, email addresses, private image previews and evidence links are not published. Messages are accessible to conversation participants through account permissions; they are not end-to-end encrypted. Database operators have privileged technical access. Sender deletion replaces message text with a tombstone. A previously reported message can remain as a restricted safety-case snapshot.

Blocking prevents sending in either direction. Read receipts, conversation mute preferences, limited-rate messaging and reports are stored in the database. Reports have no connected automatic operator alert or review dashboard yet. For support, email support@artrapeople.com. This mailbox is not monitored continuously.

5. Verification

Verification helps members make informed professional introductions. A verification badge confirms review under the current process; it does not guarantee artistic quality, reputation, conduct, ownership of artwork, or availability.

Manual identity review by the founder is implemented but document collection is disabled by default. When explicitly enabled on the configured Kazakhstan deployment, a member separately consents to submitting an ID/passport photo and a current selfie with a one-time code. Images are re-encoded, encrypted and accessible through the application only to the appointed founder after two-factor authentication; infrastructure operators may have privileged access. Pending retention and audit periods are shown before consent. A decision, withdrawal or expiry removes images from the active database; backup expiry and deletion after restoration require the operator's configured policy. The latest minimal result and consent remain until account deletion. This visual review does not certify document authenticity, professional role or authorship, and cannot eliminate leak risk. No external identity-verification service or AI is connected. Do not submit real documents until the production safeguards and retention process have been configured and tested. Message attachments remain disabled.

6. Artwork, photos, and rights

You keep copyright and other rights in content you own. By uploading it, you grant ArtraPeople a limited, non-exclusive permission to host, display, resize, transmit, back up, and make it available through the features you choose to use.

You must have the right to upload or share each artwork, photograph, document, or portrait, including any required consent from people depicted. ArtraPeople does not obtain ownership of your work because you add or share it on the Platform.

7. Future social-media promotion

Member-initiated sharing is distinct from promotion by ArtraPeople. No automatic promotional publication is connected. If ArtraPeople wishes to use a member’s name, profile image, portrait or artwork outside the Platform, for example in social media, a newsletter or a campaign, it will first request separate, specific, affirmative consent and any necessary content licence.

That optional consent will identify the content, purpose, channels, intended audience or territory where appropriate, duration, attribution, and withdrawal method. Declining or withdrawing it will not block ordinary membership, discovery, verification, or messaging.

8. Who may receive data

We do not sell personal data. Information intentionally shared with another person is available to that recipient. Disclosure to a service provider or authority requires a defined purpose, minimum necessary data and an applicable legal basis.

The app now connects to a Supabase stack running locally in Docker, not the hosted EU test project. Test email messages are captured on this computer instead of being delivered externally. Hosted Supabase, Upstash, Resend and Sentry production integrations are not activated by this change. Google sign-in remains unavailable until separately configured. Use synthetic data only.

Before connecting a provider, we must document its role, data categories, countries, subprocessors, contractual protections and deletion arrangements and update this notice. Identity documents, passwords and private message content must not be placed in ordinary monitoring events. Optional analytics, advertising trackers and session replay are not authorised by accepting this Policy.

9. Storage location and international transfers

Kazakhstan law requires personal-data storage in Kazakhstan and separately regulates foreign transfers. The EU test setup is not a confirmed production solution. Localisation and transfer conditions must be resolved before real-user collection; consent alone does not establish compliance.

No Kazakhstan production database or final production-provider list is confirmed yet. A future transfer notice must explain the relevant recipients, destination countries, purpose and applicable safeguards. If ArtraPeople targets other markets, additional applicable privacy requirements must also be assessed.

10. Security and retention

The prototype implements password hashing, server session controls and request protections, but production encryption, access control, monitoring and backup restoration are not certified by this notice. No online service can guarantee absolute security.

Database records persist across restarts; clearing browser data does not delete an account or its messages. Final retention periods, scheduled purge jobs, production backups and deletion replay after restoration are not enabled. Test data must be removed by the operator through a controlled, account-scoped process. Access rules and local restart persistence have tests; this does not certify production security or disaster recovery.

Production retention periods for verification evidence, messages, reports, support cases, logs and backups have not been finalised or implemented. A previous proposed 30-day safety-copy period is not an operating retention guarantee. Before launch, each category must have a justified duration or clear retention criterion, deletion process and limited legal-hold rules. Verification evidence should be removed when its purpose ends; legal exceptions must be documented and reviewed, not used for indefinite retention.

11. Deleting your profile

Permanent account deletion is not enabled in this database test mode. The app returns an explicit unavailable notice and does not pretend that browser cleanup deletes server data. Contact the founder through the channel used for testing. The final workflow must cover Supabase Auth, profile drafts, public profiles, conversations, reports, storage objects, logs and backups under an approved retention policy before real-user registration opens. Message deletion and hiding a public profile are separate available actions; neither deletes the account.

12. Your rights

Subject to Kazakhstan law, you may request information about processing, access, correction, withdrawal of consent, blocking or deletion where applicable, and information about recipients. You may update public profile fields and some portfolio content through the Platform.

For support, privacy and account-deletion requests, email support@artrapeople.com, including if you cannot sign in. The founder handles requests; no 24/7 response is promised. Never send passwords, recovery codes or identity documents in your initial email. Receiving a request does not mean that deletion has been completed.

13. Age requirement and changes

ArtraPeople is for people aged 18 or older. We do not knowingly create accounts for children. We may update this Policy when the Platform, its processing activities, or Kazakhstan law changes. If fresh consent is needed for a new purpose, we will request it separately.

14. Kazakhstan legal references

Relevant sources include Kazakhstan's Law on Personal Data and Their Protection (https://adilet.zan.kz/rus/docs/Z1300000094), Civil Code Article 145 on one's image, and the Law on Copyright and Related Rights. This local-test notice is not a legal-compliance certificate. The production arrangements, consent forms and matching English, Russian and Kazakh texts require Kazakhstan legal review before public launch.

15. One personal account per person

Each person may maintain only one active personal ArtraPeople account, regardless of email address, professional role or name used. Do not create extra accounts to bypass messaging or subscription limits, verification, another member's block or a suspension. Any separate organisation profile requires prior approval; it does not authorise another personal identity. If you accidentally create a duplicate or lose access, request help through support.

For a first confirmed, non-abusive duplicate, we normally issue a warning and allow 7 calendar days from the notice to choose which account to keep and arrange closure of the duplicate. An unresolved or repeated violation may lead to restrictions on the duplicate account's messaging and visibility. Serious abuse or deliberate evasion may require immediate temporary suspension, followed by human review; repeated or serious violations may result in permanent removal.

A matching name, IP address or shared device alone is not proof. We explain restrictions and how to appeal; you may request reconsideration within 14 calendar days of the decision notice. Email support@artrapeople.com, including if you cannot sign in. The founder reviews cases and appeals; this is not an independent review. Automatic duplicate-account detection and automatic bans are not enabled.

The one-account rule is also stated in Terms and Community Rules. Any manual review must use only the existing account information and relevant report or support evidence necessary to resolve the case. Do not send identity documents, passwords or authentication codes to report a duplicate. This rule does not introduce device fingerprinting, new identity-document collection or access to unrelated private conversations.

Warnings, decisions and appeals must be kept confidential, with access limited to the reviewer and a documented purpose and retention deadline under the retention policy. Suspension is not account deletion and does not authorise indefinite storage. Final production retention periods remain to be approved and implemented; this update does not change the account-deletion limitations described above.