Privacy Policy

Document: DOC 7

Version: 2.0

Effective date: 1 August 2026

Introduction

This Privacy Policy explains how STOODIO LTD (trading as Stoodio, "we", "us", "our") collects, uses, stores, and shares personal data when you visit stoodio.io (the "Stoodio Website"), when you register as an artist on the Stoodio platform, and when you interact with us in any other capacity.

This Policy applies to the Stoodio Website and platform only. It does not govern the processing of personal data by individual artists on their own Stoodio-powered websites. If you are visiting an artist's website (e.g. artistname.stoodio.io), the artist's own Privacy Policy applies to that site. Stoodio's separate processing of data collected via artist websites is described in Section 9 of this Policy.

We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, where applicable, EU GDPR (Regulation (EU) 2016/679). If you have any questions about this Policy, please contact us at hello@stoodio.io.

1. Who We Are

STOODIO LTD is a company incorporated in England and Wales (Company No. 14071912), with its registered office at Roberts Court, 45 Barkston Gardens, London SW5 0ES, trading as Stoodio. We operate the Stoodio platform, accessible at stoodio.io, which enables visual artists to create and manage professional portfolio websites, receive payments from collectors and buyers, and access tools for the optimisation of their market visibility and career development.

STOODIO LTD is the data controller in respect of all personal data collected via the Stoodio Website and platform, as described in this Policy.

Our data protection contact is: hello@stoodio.io.

2. What Personal Data We Collect

2.1 Data you provide directly

We collect personal data that you voluntarily provide when you interact with the Stoodio Website or platform, including:

• Registration and onboarding data: your display name, legal name, email address, password (stored in encrypted form), location (city and country), artistic discipline and medium, year your artistic career commenced, social media handles (Instagram, TikTok, Facebook, and others), gallery representation status (including gallery names and exclusivity arrangements), and price range information.

• Profile and portfolio data: artwork images, titles, dimensions, materials, year of creation, edition information (edition size and number of editions sold), prices, availability status, exhibition history, biography, CV, and any other content you upload to the platform.

• Payment and subscription data: subscription plan selection and billing information. Payment card details are processed directly by our payment processor (Stripe or equivalent) and are never stored by Stoodio.

• Sales and transaction data: records of artwork sales you log manually in the platform, including sale price, buyer geography, sale date, and channel (online or offline). Transaction status notifications received from your connected payment processor (completed, pending, failed) — not including card or bank details.

• Support and communications: the content of any messages, emails, or support requests you send to us.

• Waitlist and early access: your email address and any information you provide when registering for the Stoodio waitlist or early access programme.

2.2 Data we collect automatically

When you use the Stoodio Website or platform, we collect certain data automatically:

• Technical data: IP address, browser type and version, device type and operating system, screen resolution.

• Usage data: pages visited on stoodio.io, features used within the dashboard, login frequency, onboarding progress, and session duration.

• Analytics data: how you arrived at stoodio.io (referral source), geographic location (country and city level, derived from IP address).

2.3 Social media data

As a necessary element of providing the Stoodio service and performing the contract between you and Stoodio (as described in Clause 9.4 of DOC 1), we collect publicly available data from your social media profiles and publications across all platforms on which you maintain a public presence, including without limitation Instagram, TikTok, and Facebook. This includes follower counts, engagement rates, publication frequency, content performance metrics, and any other publicly accessible data. This data is used to generate performance insights for you and to provide market intelligence to Art Sector Partners as described in Section 6.

The collection and processing of Social Data is an integral component of the service Stoodio provides. We collect it to compute your own performance metrics as part of operating the service. Its onward sharing with Art Sector Partners in individual form follows the same legitimate-interests basis and the same opt out as Section 3.3.

2.4 Data from third parties

We may receive data about you from third parties, including:

• Payment processors (Stripe, PayPal, or other processors you connect): transaction status notifications only (not payment credentials).

• Social media platforms: public profile data, where you have connected your accounts or where we collect publicly available data as described in Section 2.3.

• Visitor contact data (independent controller): where a visitor to an artist website ticks the separate opt-in inviting Stoodio to keep in touch, we hold that visitor's name and email address in our own right, as described in Section 9.

3. How We Use Your Personal Data

3.1 To provide and operate the Stoodio platform

Legal basis: Performance of a contract (Article 6(1)(b) UK/EU GDPR).

We use your registration, profile, and usage data to create and maintain your account, publish and operate your artist website, provide the dashboard and its features, process your subscription, and deliver the services described in our Terms and Conditions (DOC 1).

3.2 To generate performance insights for you

Legal basis: Performance of a contract (Article 6(1)(b) UK/EU GDPR); Legitimate interests (Article 6(1)(f) UK/EU GDPR).

We use your Artist Data — including profile data, social media data, sales data, and website analytics — to compute performance metrics and scores (including the Momentum Score and Gallery Visibility Score), generate personalised insights and recommendations, and help you understand your market position and audience.

3.3 To provide market intelligence to Art Sector Partners

Legal basis: Legitimate interests (Article 6(1)(f) UK/EU GDPR), for sharing your individual, non-anonymised data with Art Sector Partners. Fully anonymised and aggregated data is not personal data and falls outside the scope of the UK/EU GDPR.

A core part of Stoodio's mission is to connect artists with galleries, collectors, art advisors, art-technology platforms, and other professional operators active in the primary art market (Art Sector Partners), and to help Art Sector Partners better understand the primary art market. To this end, we share Artist Data — which may include individual, non-anonymised data as well as aggregated data — with Art Sector Partners as an integral part of the services we provide under our Terms and Conditions (DOC 1). The Stoodio service is designed to generate visibility and professional opportunities for artists by making their data available to Art Sector Partners. You control whether your individual, non-anonymised data takes part in this sharing, as set out below.

The types of data that may be shared with Art Sector Partners include: your public profile, portfolio and pricing data, performance scores, social media metrics, website audience data, inquiry volumes, and sales activity. Art Sector Partners use this data to discover artists whose profile matches their interests, to evaluate market trends, and to identify emerging talent.

The sharing of your individual, non-anonymised data with Art Sector Partners is carried out on the basis of our legitimate interests (Article 6(1)(f)) in operating a discovery and market-intelligence service for the art sector. You may object to it, and may opt out at any time, in the Privacy & legal section of the Settings. The opt out takes effect for future sharing; it does not recall data already provided to a partner. Fully anonymised and aggregated outputs, from which you can no longer be identified, are not personal data, and we continue to produce them regardless of this setting.

3.4 To process your subscription and billing

Legal basis: Performance of a contract (Article 6(1)(b) UK/EU GDPR); Legal obligation (Article 6(1)(c) UK/EU GDPR) for financial records.

We use your subscription and billing data to manage your account plan, process recurring payments via our payment processor, send invoices and receipts, and comply with financial record-keeping obligations.

3.5 To communicate with you

Legal basis: Performance of a contract (Article 6(1)(b) UK/EU GDPR) for transactional communications; Consent (Article 6(1)(a) UK/EU GDPR) for marketing communications; Legitimate interests (Article 6(1)(f) UK/EU GDPR) for platform improvement communications.

We use your email address to send transactional communications (account notifications, subscription confirmations, security alerts), product updates and feature announcements where we have a legitimate interest in keeping you informed, and marketing communications where you have given consent. You may opt out of marketing communications at any time via the unsubscribe link in any email or via your account notification settings.

3.6 To improve the platform

Legal basis: Legitimate interests (Article 6(1)(f) UK/EU GDPR).

We use aggregated and anonymised usage data to understand how artists use the platform, identify areas for improvement, develop new features, and monitor platform performance and security.

3.7 To comply with legal obligations

Legal basis: Legal obligation (Article 6(1)(c) UK/EU GDPR).

We process personal data where required to comply with applicable laws, including tax, accounting, anti-money laundering, and data protection obligations.

3.8 To develop and improve our Assistive AI

Legal basis: Legitimate interests (Article 6(1)(f) UK/EU GDPR).

We train, evaluate, and improve the internal, non-generative models described in Section 6 on the content and data artists upload to the platform, including artwork images, so that the platform can understand, organise, and recommend their work. Our legitimate interest is in operating and improving the discovery, matching, and insight services artists engage us for. Safeguards: the prohibitions in Section 6.1 apply in full; these models are non-generative with respect to visual artworks; Derived Representations are internal only and are never sold, licensed, or disclosed. You may object at any time as described in Section 11.

4. How Long We Keep Your Data

We retain your personal data for as long as your account is active and for a period of up to five (5) years following account termination, after which data is deleted or permanently anonymised, except where longer retention is required by law or legitimate business need. Specific retention periods are:

• Account and profile data: retained for the duration of your account and up to 5 years post-termination.

• Social media data and performance metrics: retained for the duration of your account and up to 5 years post-termination. Historical snapshots used in longitudinal analysis may be retained in anonymised form indefinitely.

• Sales and transaction records: retained for 7 years to comply with UK financial record-keeping obligations.

• Support communications: retained for up to 3 years from the date of the communication.

• Waitlist data: retained until you are admitted to the platform or for up to 24 months if you are not admitted, after which it is deleted.

• Analytics and usage data: individual-level data retained for up to 26 months; aggregated and anonymised data retained indefinitely.

• Derived metrics and scores (Momentum Score, Gallery Visibility Score, etc.): retained for the duration of your account and up to 5 years post-termination in individual form; in anonymised form indefinitely.

• Derived Representations: deleted or irreversibly disassociated within 90 days of account termination.

5. Who We Share Your Data With

5.1 Art Sector Partners

As described in Section 3.3, we share Artist Data with galleries, collectors, art advisors, art-technology platforms, and other professional operators in the art sector as part of the services provided under our Terms and Conditions (DOC 1). Art Sector Partners are required to use the data only for the purposes for which it was shared and to maintain appropriate confidentiality.

5.2 Service providers (processors)

We engage third-party service providers who process personal data on our behalf as data processors, including:

• Hosting and infrastructure providers: for storage and delivery of the Stoodio platform and artist websites.

• Email delivery providers: for transactional and marketing email communications.

• Analytics providers: for platform usage analytics.

• Payment processors: for subscription billing. Your payment credentials are processed directly by the payment processor and are not stored by Stoodio.

• Privacy and consent management providers: for cookie consent management on stoodio.io and on artist websites.

All processors are bound by data processing agreements requiring them to protect your data to a standard consistent with UK GDPR.

5.3 Legal and regulatory disclosures

We may disclose personal data to law enforcement agencies, regulatory authorities, or courts where required to do so by applicable law, court order, or regulatory requirement.

5.4 Business transfers

If Stoodio is involved in a merger, acquisition, restructuring, or sale of all or substantially all of its assets, your personal data may be transferred to the acquiring entity, subject to the same protections as described in this Policy.

5.5 No sale of personal data

Stoodio does not sell your personal data in the ordinary sense of that term. Sharing of data with Art Sector Partners as described in Section 3.3 occurs in the context of Stoodio's mission to connect artists with professional opportunities and to provide market intelligence services, not as a commercial transaction in which data is the product sold.

6. Your Artwork and Data: What We Will Never Do (and What We Will)

We are aware that artists have serious and legitimate concerns about the use of their work and personal data in connection with artificial intelligence. We want to be unambiguous on this point.

In this Section:

• "Generative Visual AI" means any artificial intelligence or machine learning model, system, or service that synthesises new visual images, artworks, or other visual creative content as an output. It does not include any model or process that reproduces, crops, resizes, reframes, colour-corrects, or otherwise renders your own content for the purpose of displaying that content as your work on the platform or your artist website.

• "Assistive AI" means any artificial intelligence or machine learning model, system, or service we use that is not Generative Visual AI, including analytical, statistical, classification, ranking, matching, language, translation, and text-generation models.

• "Derived Representation" means any internal machine-readable representation of your content that we compute, including embeddings, descriptors, feature vectors, and classifications, which is computed for our internal use only and is used to analyse, search, compare, match, and recommend your work.

6.1 What we will never do

We will never, and will never permit any third party to:

(a) use your content and artwork images to train, fine-tune, pre-train, embed for training purposes, or otherwise develop or improve any Generative Visual AI, whether operated by us or by any third party;

(b) license, sell, transfer, disclose, or otherwise make available your content and artwork images, or any Derived Representation of them, to any third party for the purpose of AI or machine learning training, dataset creation or curation, benchmarking, or any form of automated reproduction or synthesis of visual works. This does not prevent us from disclosing your content to a sub-processor engaged on our behalf, on the terms described in Section 6.2, and solely for the purpose of training, evaluating, or operating our own Assistive AI;

(c) use your content and artwork images or your other data to replicate, imitate, emulate, or generate derivative versions of your artistic style, technique, visual language, or body of work, or to enable any third party to do so;

(d) share your individual artwork images or other creative content with Art Sector Partners or any other third party for any purpose other than the display and promotion of your work as part of the platform and the services described in this Policy;

(e) sell, license, or disclose to any third party the Derived Representations we compute from your content, whether for the purpose of generating visual content, reconstructing your works, or training any Generative Visual AI;

(f) use, or attempt to use, any Derived Representation to train, fine-tune, or evaluate any Generative Visual AI, or to reconstruct, invert, approximate, or regenerate your content, style, or technique, whether by us or by any third party. Derived Representations exist solely to power the analysis, search, matching, and recommendation services described in Section 6.2, and we may use them for no other purpose.

These commitments are absolute. They survive termination of your account, and no change to this Policy will weaken them in respect of content you uploaded before that change takes effect.

6.2 How we use AI

Subject always to Section 6.1, we may develop, train, operate, procure, and improve Assistive AI for any purpose that is, directly or indirectly, of benefit to you, to other artists on the platform, or to the community we serve. Permitted purposes include, without limitation:

• Insights and metrics. Computing, refining, and personalising the Momentum Score, the Gallery Visibility Score, and any other derived metric.

• Discovery and matching. Surfacing you to galleries, collectors, advisors, and art-technology platforms whose professional interests align with your practice, and surfacing relevant opportunities, partners, and audiences to you.

• Assistance with your own material. Helping you draft, edit, translate, or improve text you choose to publish, such as a biography, an artist statement, a work description, an exhibition text, or a reply to an inquiry. Any such output is presented to you as a suggestion for you to accept, edit, or discard, and is never published without your own action.

• Studying and understanding the work itself. Analysing the visual content of your artwork images in order to understand them: their composition, palette, materials, medium, subject matter, technique, scale, period, and stylistic characteristics. This expressly includes computing and retaining Derived Representations for the purpose of powering the analysis, search, matching, and recommendation services described in this Section. It also includes generating alternative text for accessibility, detecting the subject or focal point of an image for cropping and framing, extracting or verifying metadata, reading text from a document you upload such as a CV, transcribing or captioning video, and detecting duplicates.

• Search, similarity, and recommendation. Enabling you, collectors, and Art Sector Partners to search, filter, and discover works and profiles, including by visual, stylistic, and semantic affinity, and recommending your specific works to collectors, galleries, advisors, and other parties whose established interests, collection, or programme those works resemble. No visual output is generated: the output is a match, a ranking, or a recommendation pointing to your own work.

• Trust, safety, and integrity. Detecting spam, fraud, abuse, bot traffic, unlawful or infringing material, and unauthorised use of the platform.

• Support and operations. Triaging and answering support requests, translating communications, and improving our documentation and internal processes.

• Platform development. Analysing usage in order to build, test, debug, secure, and improve the platform and the quality of the connections it facilitates.

• Market understanding. Producing the aggregated and anonymised market intelligence described in Sections 3.3 and 6.3.

Reading, measuring, describing, classifying, and comparing an artwork in order to understand it and to place it in front of the right person is expressly permitted. Using it to train, or to help anyone else train, a model that makes visual work is not.

No Assistive AI we operate or procure produces visual artworks, images, or other visual creative content as an output. Its outputs consist of scores, rankings, classifications, matches, recommendations, descriptions, translations, and text suggestions.

Where we use third-party AI services as sub-processors, within the carve-out in Section 6.1(b), we engage each provider on terms that contractually prohibit the provider from using our inputs, including any content or data of yours, to train or improve that provider's own models, and that require deletion of those inputs within a limited retention period. We will not transmit your content to any AI provider that does not offer those terms.

6.3 Purpose of data collection and sharing

The data we collect and share is used exclusively to:

• Help you, as an artist, gain greater visibility with galleries, collectors, and the broader professional art world.

• Enable Art Sector Partners to discover artists whose practice and market trajectory match their professional interests.

• Improve the collective understanding of how the primary art market functions, including which artists are emerging, how prices develop, and how audiences engage with work, so that the art world operates with better information.

• Power the internal analytical and matching models described in Section 6.2.

In short: your work is yours. We exist to get it seen by the right people and to bring the right opportunities to you, not to extract value from it in ways you have not agreed to and would not want.

7. International Transfers

Stoodio stores and processes personal data primarily within the United Kingdom and the European Union. Where personal data is transferred outside the UK or EEA — for example, to service providers located in the United States — we ensure that appropriate safeguards are in place in accordance with UK GDPR, including Standard Contractual Clauses (UK Addendum), adequacy decisions, or other approved mechanisms.

Where Art Sector Partners to whom we disclose Artist Data are located outside the UK or EEA, we take reasonable steps to ensure that such transfers are covered by appropriate safeguards or that the transfer is otherwise permitted under applicable law.

8. Security

We implement and maintain appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• Encryption of data in transit (TLS) and at rest.

• Access controls and role-based permissions limiting access to personal data to authorised personnel only.

• Regular security assessments and penetration testing of our infrastructure.

• Secure credential storage using industry-standard hashing algorithms.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach and will notify you directly where required by law.

9. Processing of Visitor Data via Artist Websites

Stoodio powers artist websites at artistname.stoodio.io and connected custom domains. When you visit an artist's website, the artist is the data controller in respect of personal data you submit via that website (inquiry forms, contact forms, newsletter sign-ups, purchases). Stoodio processes that data as the artist's data processor.

In addition, Stoodio collects certain analytics data from artist websites in its own capacity as an independent controller, for the purposes of:

• Generating performance analytics and insights for the artist via the Stoodio dashboard.

• Computing platform-wide metrics and performance scores.

• Providing market intelligence to Art Sector Partners, as described in Section 3.3.

Where a visitor to an artist website separately opts in to hearing from Stoodio, we process that visitor's name and email address as an independent controller, on the basis of the visitor's consent (Article 6(1)(a)), to share artists, works, and opportunities matching their interests. The visitor may withdraw at any time via the link in any email we send or by contacting hello@stoodio.io. This data is retained until withdrawal and deleted within 30 days of it.

Stoodio's independent collection of analytics data from artist websites is disclosed in the Privacy Policy and Cookie Policy published on each artist website, and is subject to visitor consent where required. If you are a visitor to an artist website and have questions about Stoodio's processing of your data, you may contact us at hello@stoodio.io.

10. Cookies on stoodio.io

The Stoodio Website uses cookies and similar technologies. For full details of the cookies we use, please see our Cookie Policy at stoodio.io/cookies. Non-essential cookies are only placed with your consent, which is sought via the cookie banner displayed on your first visit to stoodio.io.

11. Your Rights

Under UK GDPR (and, where applicable, EU GDPR), you have the following rights in relation to your personal data:

• Right of access: you may request a copy of the personal data we hold about you.

• Right to rectification: you may ask us to correct inaccurate or incomplete data.

• Right to erasure: you may ask us to delete your personal data in certain circumstances.

• Right to restriction: you may ask us to restrict our processing of your data in certain circumstances.

• Right to data portability: where processing is based on consent or contract, you may ask us to provide your data in a structured, machine-readable format.

• Right to object: you may object to processing based on legitimate interests, including profiling for the purpose of providing market intelligence to Art Sector Partners.

• Right to withdraw consent: where processing is based on consent, you may withdraw consent at any time via the Privacy & legal settings in your account. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. You may separately object to processing based on legitimate interests — including the sharing described in Section 3.3 and the Assistive AI processing described in Section 3.8 — via the Privacy & legal settings or by contacting hello@stoodio.io.

To exercise any of these rights, please contact us at hello@stoodio.io or via the Privacy & legal settings in your account. We will respond within one month of receiving your request.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. If you are located in the European Economic Area, you may also lodge a complaint with your local supervisory authority. A full list of EEA supervisory authorities is available at edpb.europa.eu.

12. Children

The Stoodio platform is intended for use by individuals aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe that a person under 18 has registered on the platform, please contact us at hello@stoodio.io and we will take appropriate action.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will always be available at stoodio.io/privacy. Where changes are material — for example, if we introduce a new purpose for processing or a new category of data sharing — we will notify you by email and, where required, seek your consent before the change takes effect.

This Policy was last updated on 1 August 2026.

14. Contact

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by Stoodio, please contact:

STOODIO LTD

Email: hello@stoodio.io

Website: stoodio.io/privacy

Registered address: Roberts Court, 45 Barkston Gardens, London SW5 0ES

We aim to respond to all requests within one month. If your request is complex or you have made a number of requests, we may extend this period by a further two months, in which case we will notify you.

STOODIO LTD · Registered in England and Wales · stoodio.io

Last updated 1 August 2026, version 2.0