Privacy information
Version of this text: Beta 1, 21 October 2026.
Who is responsible
Hugo Monteiro, Málaga, Spain. Register entry: not applicable.
Privacy questions and requests: admin@myartpass.app.
Who can use Art Pass
Art Pass is meant for people aged 16 and older. When you create an account you confirm that you are 16 or older. We store that you confirmed it, the version of the statement (age16-2026-10) and the time. We do not ask for your date of birth and we do not check your age; the statement is a self-declaration.
People aged 16 and 17 can create an account themselves; we do not ask for a parent's consent. Their accounts work exactly like everyone else's: there is no advertising, no analytics and no profiling, and a profile is private unless its owner chooses to make it public. A parent or guardian with a concern can write to the privacy address above.
What we process
- Without an account: you can browse paintings, artists and museums in the public catalogue. Sign in to save paintings, notes, visits and lists to your account.
- Account: your e-mail address, your password (stored by the sign-in service in a form we cannot read), your display name, your username and whether your profile is public or private.
- Your records: which artworks you marked as seen, the date, your private notes, your visits, your wish lists and tags. When you are signed in these are synchronized to your account so that you can use more than one device. They are private to your account.
- Reports you send: the category, your message, the record it is about, the app version and the catalogue release. Staff see a report without your identity. The publisher can look up who sent a report only to give you support or to prevent abuse, and each lookup is logged.
- Technical diagnostics: a short fixed code, the platform and the app version when the app cannot refresh or synchronize. They contain no names, notes or lists.
- Staff: accounts that hold an editorial role also have that role and a log of editorial actions.
- E-mail: we send you the messages needed for confirming your address and resetting your password. Staff accounts also receive work reminders and invitations.
How long we keep it
| Data | Kept |
|---|---|
| Account and your records | Until you delete your account. |
| Technical diagnostics | 14 days, or until you delete your account. |
| Reports that are open | Until they are closed. |
| Reports that are resolved or dismissed | 90 days after they were closed. When you delete your account the link to you is removed at once. |
| Proof that a deletion was requested | 30 days, as a one-way hash that cannot identify you. |
Deleted data may remain in backups for the backup retention period, and is deleted again if a backup is ever restored.
The Art Pass app does not use advertising or analytics services.
This website
The Art Pass website at https://myartpass.app sets no cookies and uses no analytics or advertising. It loads nothing from other companies.
Legal bases
Art Pass relies on these legal bases of the EU General Data Protection Regulation (GDPR). Your account, your records and their synchronization, the e-mails for confirming your address and resetting your password, and the handling of reports you send are necessary to provide the service you signed up for (Article 6(1)(b)). Staff roles, invitations and work reminders are necessary for the editorial work a staff member agreed to do (Article 6(1)(b)). Technical diagnostics, backups, the log of editorial actions and looking up who sent a report, for support or to prevent abuse, rely on our legitimate interest in keeping Art Pass working, secure and free of abuse (Article 6(1)(f)). The record of your age statement and the proof that a deletion was requested rely on our legitimate interest in being able to show that our rules and your requests were followed (Article 6(1)(f)). You can object at any time to processing that relies on legitimate interest.
Processors and transfers
Art Pass uses these service providers, each bound by its data processing agreement: Supabase, Inc. for the database, sign-in and server functions, with the data stored on Amazon Web Services in Frankfurt, Germany; Cloudflare, Inc. to host the Art Pass websites (myartpass.app and its subdomains), which means it handles the IP addresses and technical details of visits to them; and Zoho Corporation B.V. (Netherlands), from its EU data centre, to send the account e-mails (ZeptoMail) and to receive the e-mails you send us (Zoho Mail).
Your account and records are stored in the EU, and our e-mail runs in Zoho's EU data centre. Supabase and Cloudflare are based in the United States and Zoho belongs to a group with companies outside the EU, so these providers may access data from outside the EU, for example for support or security, and Cloudflare serves the websites from data centres around the world. Where personal data leaves the EU in this way, it is protected by the European Commission's Standard Contractual Clauses in each provider's data processing agreement and, for Cloudflare, also by its certification under the EU-U.S. Data Privacy Framework.
Your rights
You can ask us for access to your data, correction, deletion, restriction of processing, a copy of the data you provided, and you can object to processing. You can delete your account yourself in the app, see deleting your account. Write to admin@myartpass.app for anything else.
You may complain to the supervisory authority: Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), https://www.aepd.es.