Privacy Policy

1. Controller and contact

The data controller is the legal SOOMI operator identified in the site footer and your confirmation email. Email privacy questions or rights requests to hello@withsoomi.com.

2. Information we use

• Account and profile information, including name, email, location, biography, links and membership status.
• Artwork, portfolio, pricing, opportunity, enquiry and private Studio records you choose to add.
• Contact and enquiry information, including collector or buyer details, messages, artwork interests and follow-up notes that you submit or choose to store.
• Order, buyer, delivery, issue, refund and payout records. Stripe receives payment-card, identity and bank information directly where its hosted services are used; SOOMI does not directly receive or store full card details.
• Security and technical data such as sign-in times, device or browser information, approximate location and cookie identifiers.
• Messages, support requests, consent and policy-acceptance records.

3. Why we use it and lawful bases

• To create and run the account, Studio, subscription and requested transaction: performance of a contract or steps requested before a contract.
• To keep records, meet tax, accounting, consumer, sanctions and law-enforcement duties: legal obligation.
• To secure the service, prevent fraud, improve reliability, answer support and defend legal claims: legitimate interests, balanced against your rights.
• To create and publish the core artist profile described when you register, keep its public details current and operate the fair daily rotation: performance of the requested service and legitimate interests. You can edit or remove optional public details and close the account.
• For optional marketing or non-essential cookies: consent, which is separate, optional and withdrawable. We do not treat acceptance of terms or acknowledgement of this notice as marketing consent.

4. Sharing and international transfers

We share only what is necessary with service providers such as Supabase for authentication and data hosting, Stripe for payments and connected accounts, transactional email providers, security or monitoring providers, Google or Apple when you request a wallet pass, and professional advisers or authorities where required. Where personal information is transferred outside the UK, we use safeguards required by applicable data-protection law.

The artist or studio name supplied at signup is published on the artist profile. Other profile information you add can be viewed and copied globally, so do not add private contact details or information you do not want made public.

5. Cookies and analytics

SOOMI uses essential cookies and similar storage for sign-in, security, membership state and requested checkout flows. These are necessary to provide the service you ask for.

SOOMI does not use optional analytics, personalisation or marketing tools unless the provider, purpose and duration are identified and you are given a clear choice where consent is required. The separate Cookie Policy explains how to manage those choices.

6. Retention and inactive free accounts

We keep information only as long as needed for the purposes above. A free account is warned after 90 inactive days and scheduled for deletion at 100 days; signing in cancels deletion, and an active paid membership is excluded. Public profile and ordinary Studio data are then deleted or anonymised, subject to backup expiry.

Orders, payments, payouts, tax, fraud, complaints, disputes, policy acceptance and legal claims may be retained longer where required by law or reasonably necessary to establish, exercise or defend legal rights.

7. Account deletion and data requests

You may ask to close your account or delete information by using the available account controls or contacting the privacy address shown above. We will explain if an unresolved order, payment, dispute, fraud-prevention need or legal duty requires particular records to be retained.

When we act on a valid deletion request, public profile and ordinary Studio information will be removed or anonymised from active systems, subject to backup expiry and any lawful retention described above.

8. Your UK GDPR rights

Subject to applicable conditions and exemptions, you may request access, correction, deletion, restriction or portability of your personal information, object to certain processing, and withdraw consent where consent is the basis. You also have the right not to be subject to a solely automated decision that has legal or similarly significant effects where the relevant UK GDPR rules apply.

We may need to verify your identity before acting on a request. You can complain to the UK Information Commissioner’s Office, and if you live elsewhere you may also have the right to contact your local supervisory authority.

9. Security and changes

We use access controls, private storage, hosted payment collection, audit records and other proportionate safeguards. No service can promise absolute security. Material notice changes will be communicated and the version acknowledged at signup is recorded.