Who processes your data
The data controller is Luyten Gallery, S.L. (Spanish tax number B21619937), which provides this service under the trade name ArtBidHere.
For anything about privacy, use the contact form. The company's email address is in the Legal notice.
We have not appointed a data protection officer: given the kind and volume of data we process, the law does not require one.
What we process, why, and on what legal basis
If you make an offer on an artwork
| Data | Why | Legal basis |
|---|---|---|
| Your email address | To verify the offer is yours, tell you what happens to it, and give it to the seller if you win | Performance of the terms you accept when bidding (art. 6.1.b GDPR) |
| Your phone number | So the seller can call you. It is required to bid. We do not verify it: we never send SMS | Art. 6.1.b |
| Your preference on the "you have been outbid" notice | To send you that one notice only if you have not switched it off | Art. 6.1.b |
| The amount and time of each offer | To determine the highest offer and keep a record | Art. 6.1.b |
| Your language and time zone | To write to you in your language and give closing times in your own clock | Art. 6.1.b |
| A digest of your IP address | To limit attempts and prevent abuse of code sending. We do not keep the IP itself, but a derived value it cannot be recovered from | Legitimate interest in the security of the service (art. 6.1.f) |
We never ask for your name. A verified email address and a phone number are all it takes to bid. There is no account and no password: your address identifies your offers, and the browser remembers for 30 days that you verified it. From "My details" on any artwork's page you can change the phone number or have this device forget you; your bidder page lists every offer you have made.
We never charge you anything. ArtBidHere neither processes nor holds money for artworks.
If you open an artwork's page
We count how many people open each artwork's public page, so that whoever shows it knows whether anybody saw it. We do it without a cookie and without storing your IP address or your browser: we keep a fingerprint of both and of the day, computed with a key that changes every day and is deleted when the day ends, so it cannot be recovered or linked to another day. Beside that fingerprint we keep which way the visit came — the QR on the label, a link the seller shared on Instagram, in a message or in an email, or their own website — taken from a mark the link carries and not from you. The seller sees only the number and how many visits came each way. The legal basis is our legitimate interest in telling the seller whether their label and their links are seen (art. 6.1.f GDPR). Those fingerprints are deleted 90 days after bidding closes.
If you see the bidding in a box inside the seller's own website, or on the seller's own page, we count nothing and set no cookie: the visit is counted when you open the artwork's page.
If you are a seller
We process the email address you sign in with, your password — only as a cryptographic digest it cannot be recovered from — the public name you present yourself under, any contact details you choose to publish, and the artworks you create. If you sign in with Google or Apple, where offered, all we receive from them is your email address and the fact that they have verified it; we keep no session of theirs. The legal basis is performance of the Terms of service.
Billing and payment data are processed by Stripe directly. We never see or store card numbers; we keep the amount, the tax applied, the billing country and the transaction reference, because tax and accounting law requires it (art. 6.1.c).
If you write to us
The contact form processes your email address, the topic and the message, and a six-digit code that confirms the address is yours, because we answer by email. Legal basis: dealing with your enquiry (art. 6.1.b) and our legitimate interest in a form that cannot be used to send messages in somebody else's name (art. 6.1.f). The IP digest is used here too, only to limit attempts.
Who we share it with
We give your email address and phone number to the seller of that artwork from the moment your offer is recorded, whether or not you win. That is the main purpose of the service and you accept it when you bid: you are making an offer to buy from a gallery or an artist, and the person receiving it knows who it is from.
It is not public and it goes to nobody else. Your address never appears on the artwork's page, it is never given to another bidder, and it is used for nothing but this bidding. If your offer is the highest, the seller additionally undertakes to approach you first for one hour, as the terms explain.
The following also process data on our behalf:
| Provider | What for | Where the data is processed |
|---|---|---|
| Supabase | Database and image storage | Frankfurt, Germany (European Union) |
| Vercel | Hosting and running the application | Frankfurt, Germany (European Union) |
| Brevo | Sending the service's emails | European Union |
| Stripe | Charging the seller's fee | European Union and United States |
All application processing happens in the European Union. Stripe and Vercel are companies with United States parents: any international transfer that may occur within them is covered by the safeguards in chapter V of the GDPR — standard contractual clauses and, where applicable, the EU–US adequacy framework.
We do not sell data and do no profiling or automated decision-making with legal effects on you. What we do tell advertising platforms, and only with your consent, is described in the next section.
Analytics and advertising
On the home page, the marketing and legal pages and the seller's screens — never on the pages where a collector makes an offer, the collector's own page, the seller's own page, the box on the seller's website or the administration panel — we use three third-party services, each only if you have agreed to it through the cookie banner or the "Cookie preferences" link:
| Provider | What for | Role | Where |
|---|---|---|---|
| Google Ireland Ltd (Google Analytics 4, Google Ads) | Which pages are read and where people leave; whether one of our adverts led to an account or a purchase | Processor for Analytics; joint controller with us for Ads measurement | European Union and United States |
| Meta Platforms Ireland Ltd (Meta pixel and Conversions API) | Showing our own adverts to people who visited this site, and whether an advert led to an account or a purchase | Joint controller with us for the measurement | European Union and United States |
| Microsoft Ireland Operations Ltd (Clarity) | Recordings and heat maps of how pages are used, with form fields and collectors' contact details masked | Processor | European Union and United States |
The legal basis is your consent (art. 6.1.a GDPR and art. 22.2 LSSICE), given through the banner, category by category, and withdrawable at any time from "Cookie preferences" at the foot of every page. Withdrawing it does not affect what was lawfully processed before. Without your consent, Google's tag runs in what Google calls Consent Mode: it sets no cookie and sends no identifier, only an aggregate signal that a page was shown, from which Google estimates results.
What is sent, and when. If you gave consent to Advertising and you create a seller account or pay for credits, your browser tells Google Ads that it happened (with the amount of a purchase, never with your address), and our server tells Meta, together with your email address transformed with SHA-256 — a one-way hash Meta can match against its own users but cannot turn back into an address — the click identifier of the advert you arrived from, if any, and the amount. No email address, hashed or not, is ever sent to Google. Without consent to Advertising nothing that identifies you is sent to either of them: Meta receives nothing, and Google Ads only an anonymous, cookieless signal that a sign-up or a purchase took place, with the click identifier of the advert removed before it leaves your browser.
We also keep, on your seller account, the campaign parameters and click identifiers the address you arrived by contained (`utm_*`, `gclid`, `fbclid` and the like), for the same purpose and for as long as the account exists. They go when the account is erased.
Google, Meta and Microsoft are companies with United States parents; any international transfer within them is covered by the EU–US Data Privacy Framework, to which all three are certified, and by standard contractual clauses where it does not apply. Their own notices explain what they do with the data as controllers: Google, Meta and Microsoft.
How long we keep it
- An artwork's public page stops answering 7 days after bidding closes. The page stops
answering; nothing is deleted, and the seller keeps the result.
- The fingerprints of who opened an artwork's page are deleted 90 days after bidding
closes; the day's key they were computed with, when that day ends.
- Everything else we keep for as long as the account exists. An artwork, its result and the
contact details of the people who bid on it are kept while the seller's account is open. They are not deleted on a timer. An art sale can take a year to close, a collector who bids at one fair often buys at the next, and data that disappeared on a schedule would take the seller's own record of their business with it.
- You can delete it yourself, at any time. Deleting a seller account erases that workspace,
its artworks, its images and the bidders' contact details held inside it — at once, and for good. There is no waiting period and no need to ask us.
- We do not delete an account without telling you first. If we ever needed to close a
long-dormant account, we would write to the address it is registered to and give you time to export what is yours or to object.
- A bidder may ask us to erase their contact details at any time, and we do so within 30
days. Ask through the contact form.
- Billing records are kept for as long as commercial and tax law requires. Those we cannot
delete on request, and we say so plainly.
- Email delivery records are kept for as long as needed to evidence delivery and handle
problems.
Keeping data for as long as the account exists is a decision, and it is the honest one: a retention clock that silently emptied a gallery's results would cause the harm it claims to prevent. The control is in your hands rather than on a timer.
Your rights
You may ask us at any time for:
- Access to the data we hold about you.
- Rectification of anything inaccurate.
- Erasure of your data.
- Restriction of, or objection to, processing.
- Portability of the data you gave us.
- Withdrawal of consent where processing is based on it, without affecting what came before.
Ask through the contact form from the address you are asking about, or telling us which it is. We answer within the period the GDPR sets.
If you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency (aepd.es), the competent supervisory authority in Spain.
Minors
This service is not directed at, and must not be used by, anyone under 18.
Changes
If we change this policy we will publish the new version here with its date. Acceptances already recorded continue to refer to the version in force when they were made.