Privacy notice

1. Who we are

The controller of your personal data is Varvara Shcherbakova, trading as Artisanist, a sole trader (Empresário em Nome Individual) at Rua de Sant'Ana à Lapa 112 2E, 1200-800 Lisboa, Portugal. For anything about your data, email collective@artisanist.org.

2. The short version

• We only collect what we need to run the course, the platform and our community, and to keep them safe.
• Statistics and advertising tools run only if you say yes, and you can change your mind at any time.
• We don’t sell your data.
• Payments are handled by Link, a Stripe company, which is responsible for the payment data it collects.
• You can ask us for a copy of your data, to correct it or to delete it.

3. What we collect and why

When you visit the website

Our server receives your IP address and browser details to deliver each page. We don’t keep access logs of visits. If something goes wrong, an error message is written to the server’s log, which keeps only a limited amount of recent entries and overwrites older ones.

Only if you accept statistics: we store a random identifier in your browser and record the pages you view, the page you came from and any campaign tags in the link (for example utm_source), with your browser type. This tells us which pages help and where visitors come from. We also use Google Analytics for this purpose. Google receives a random browser identifier, page addresses without query strings, the referring page without query strings, public campaign tags and browser/device details. We do not send your name, email, card or bank details or advertising click identifiers to Google Analytics. Its advertising features are disabled. Google processes network information to receive these visits; see the Google privacy policy.

With your statistics choice, we also remember the latest external link or referring website for up to 30 days and connect that source to an order when you start a purchase. This helps us understand which visits lead to purchases. We keep this optional source record separately from payment records for up to 13 months; unused checkout source records are removed after 30 days. We do not connect your full browsing history to your learner account. With this choice, Google Analytics may also receive confirmed purchases and refunds: the amount, currency, course package, event time and a random transaction reference. Google browser and session identifiers connect these events to your visit. We keep our copies of these optional identifiers with the source record for up to 13 months and remove them when you withdraw statistics.

You can withdraw statistics in Cookie settings. We clear the optional browser source and request removal of the linked source records on our server. A random withdrawal key is kept only until the request is delivered, for no more than 13 months. If you are offline, we retry when you return online or visit again. This does not affect your purchase, course access or required payment records.

Only if you accept advertising: we load the Meta Pixel and keep advertising click identifiers from the link you arrived with (such as fbclid or gclid). See advertising measurement.

When you join the newsletter

We keep your email address, and, if you accepted advertising, the campaign details of the visit that brought you. Kit sends a confirmation email first (double opt-in). You can unsubscribe with one click in any email.

When you buy

Checkout is run by Link, a Stripe company, which sells on our behalf as merchant of record. It collects your payment details, billing address and tax information, handles tax, and sends your receipts. Link is responsible for that data as an independent controller under its own privacy policy. Link shares with us what we need to give you access and support: your name, email address, country, what you bought, the amounts, your Membership status and payment or refund status. Payment notifications from Stripe can also include limited card details (card type and last digits); we don’t use them and delete them after 90 days. We never see your full card number.

Your account and learning

To give you access we keep your email address, your name, your password (stored only as a secure one-way hash), your sign-in sessions, what you have access to, and your progress through the lessons (which lessons you opened, how far you watched and what you completed), so you can pick up where you left off. We also send you the emails the service needs: access and sign-in links, password setup and reset, and purchase confirmations.

Course videos

Lesson videos are streamed by Kinescope B.V. (Netherlands). When a video plays, your device connects to Kinescope’s servers, which receive technical data such as your IP address and device details. We pass only the video’s identifier, never your name or email address.

Our Discord community

If you connect your Discord account on the Community page, we receive and keep your Discord user ID and username, add you to our private server and give you the member role while your Membership is active. We remove the role when access ends. You can disconnect at any time. Discord is responsible for your Discord account under its own privacy policy.

When you write to us

We keep your messages and our replies so we can help you and keep a record of what we agreed.

Security

We record sign-in attempts to stop password guessing, and we keep a record of actions our team takes on accounts (for example granting access or sending a setup email).

Advertising measurement (only with your consent)

If you accepted advertising when you started checkout, then when your purchase is paid we tell Meta about it through Meta’s Conversions API, so we can measure our ads. We send: your email address in hashed form (scrambled so it can’t be read, only matched), your IP address and browser details, Meta’s browser identifiers (_fbp, _fbc), the page where checkout started, and the value (before tax) and currency of the purchase. We never send test purchases, purchases refunded or disputed before they were reported, or anything without your consent.

For collecting and sending this data (and the Pixel’s data), we and Meta Platforms Ireland Ltd are joint controllers under an agreement with Meta (the Controller Addendum). We are responsible for telling you about it and for your consent; Meta is responsible for your rights over the data it holds. What Meta does with the data afterwards is covered by Meta’s privacy policy.

You can withdraw consent at any time in Cookie settings. Tracking from your browser stops at once. A purchase you started while you had consented may still be reported to Meta afterwards, but only within 7 days of the purchase.

4. Our legal bases

You need to give us your email address and name to create an account and use the course; without them we can’t provide it. Everything based on consent is optional.

5. Who receives your data

We use these providers. Those marked “processor” act only on our instructions.

We may also share data where the law requires it, for example with tax authorities. We don’t sell personal data.

6. Transfers outside the EU

Some providers are based in, or use, the United States. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified, and on the European Commission’s Standard Contractual Clauses. Switzerland (Proton) is recognised by the EU as providing adequate protection. You can ask us for more information, including a copy of the relevant safeguards.

7. How long we keep data

• Account, access and progress: while your account exists, then 30 days.
• Order and tax records: 10 years, as Portuguese tax law requires.
• Our own visit statistics with your consent: up to 13 months. Google Analytics event data: 2 months; user data: 14 months after the last activity. Aggregated Google reports may be kept longer. Google cookies: up to 1 year.
• Newsletter: until you unsubscribe (we then keep your address only on a do-not-email list).
• Discord link: until you disconnect or your account is deleted.
• Emails with us: 2 years after the conversation ends.
• Your cookie choice: 12 months, in your browser; then we ask again.
• Advertising data kept when you start checkout: the identifiers sent to Meta (IP address, browser details, _fbp, _fbc and the page) for 8 days; the record of your consent for 90 days.
• Sign-in links and tokens: deleted soon after they expire.
• Database backups: 30 days.

8. Your rights

You can ask us to access, correct or delete your data, to restrict how we use it, to give you a copy in a portable format, and you can object to uses based on our legitimate interests. You can withdraw consent at any time (in Cookie settings for statistics and advertising, or with the unsubscribe link for the newsletter); this doesn’t affect what happened before. Write to collective@artisanist.org and we’ll answer within one month. We may need to confirm it’s you first.

Some data we must keep even if you ask us to delete it, such as order records required by tax law.

You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal, +351 213 928 400, www.cnpd.pt, or to the authority where you live or work.

We don’t make decisions about you based solely on automated processing.

9. Age

Artisanist is for adults. You must be 18 or older to buy the course and join our community, and we don’t knowingly collect data from children.

10. Changes

We’ll update this notice when our practices change and show the date above. If a change affects you significantly, we’ll tell you by email.