Privacy Policy
Last updated: July 6, 2026
1. Who We Are
ArtistAlly is operated by Alchemy Lab LLC(“we,” “us,” or “our”). We provide a community tool that aggregates convention and conference information for the furry, anime, and gaming communities. Our service is available at artistally.alchemylab.sh.
For privacy questions, contact us at [email protected].
2. Information We Collect
We collect only the information necessary to provide and improve our service. Below are the categories of personal information we collect:
Account Information
- Email/password sign-up: Your name, email address, and a securely hashed password. We never store your password in plain text.
- Microsoft Entra ID (SSO): When you sign in via Microsoft, we receive your name, email address, and organizational membership from your identity provider.
Service Usage Data
- Event subscriptions: Which events and metro areas you follow.
- Notification preferences: Your opt-in choices for email and browser push notifications, including push notification tokens.
- Event suggestions: Content you submit when suggesting a new event.
Payment Information (Pro Subscribers)
If you subscribe to ArtistAlly Pro, payment processing is handled entirely by Stripe. We do not receive or store your credit card number. Stripe provides us with your subscription status, Stripe customer ID, and billing email for account management purposes.
Automatically Collected Information
Our servers automatically record standard access logs (IP address, browser type, pages visited). User identifiers in our application logs are pseudonymized — we do not store raw personal information in our log stream.
3. How We Use Your Information
| Processing Activity | Purpose | Lawful Basis (GDPR) |
|---|---|---|
| Account creation and authentication | Provide access to personalized features | Contract (Art. 6(1)(b)) |
| Event subscriptions | Let you follow events and metro areas | Legitimate interest (Art. 6(1)(f)) |
| Email and push notifications | Alert you to registration openings and event changes | Consent (Art. 6(1)(a)) |
| Event suggestions | Improve the event directory with community contributions | Legitimate interest (Art. 6(1)(f)) |
| AI processing of suggestions | Verify and enrich submitted event information via Exa | Legitimate interest (Art. 6(1)(f)) |
| Pro subscription billing | Process payments and manage subscription status | Contract (Art. 6(1)(b)) |
| Security and audit logging | Detect abuse, maintain security, comply with legal obligations | Legal obligation (Art. 6(1)(c)) |
4. How We Use AI
We use Exa, an AI-powered search engine, to discover and verify convention information from publicly available sources on the web. Specifically:
- Exa searches for event dates, venues, registration deadlines, and other publicly posted convention details.
- If you submit an event suggestion, your submission text may be used as a search query in Exa after sanitization. You are informed of this at the time of submission.
- Every event detail sourced from AI is attributed per-field so you can see which information was manually verified versus auto-detected.
ArtistAlly does not train, fine-tune, or host any AI models. We do not use automated AI-art detection. Our portfolio feature (when available) is a human-verification support tool, not an automated content classifier.
5. Third-Party Service Providers
We share data with the following service providers (“processors”) to operate ArtistAlly:
| Provider | Purpose | Data Shared |
|---|---|---|
| Microsoft (Entra ID) | Single sign-on authentication | Name, email, organization |
| Stripe | Pro subscription payment processing | Email, subscription status |
| DigitalOcean | Application hosting and database | All application data (encrypted at rest) |
| Exa | AI-powered event data discovery | Search queries (may include sanitized user text) |
| Anthropic (Claude) | AI extraction of event registration and logistics details from public web pages | Public event and website text (no personal data) |
| Resend | Transactional email delivery | Email addresses, notification content |
| Sentry | Error monitoring and crash diagnostics | Error and stack-trace data with personal data removed (no emails, IP addresses, cookies, or request bodies) |
| Transitland (Interline) | Transit routing data | Venue coordinates (no personal data) |
We maintain Data Processing Agreements (DPAs) with processors that handle personal data. Donation platforms (Ko-fi, Open Collective) are linked from our site but do not receive any user data from ArtistAlly.
6. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data (name, email, password hash) | Active account + 30 days after deletion request |
| Event subscriptions and notification preferences | Active account lifetime; deleted on account deletion |
| Push notification tokens | Until unsubscribed or token expires |
| Event suggestions | Indefinite (anonymized upon account deletion) |
| Stripe subscription records | Active account + 30 days after deletion; Stripe retains records per their policy |
| Event data (public convention info) | Indefinite (not personal data) |
| Exa query logs | 12 months rolling |
| API usage and cost logs | 24 months rolling |
| Security and audit logs | 24 months rolling (pseudonymized) |
7. Your Rights Under GDPR
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation:
| Right | What It Means |
|---|---|
| Access (Art. 15) | View all personal data we hold about you from your account settings, or request a copy by email. |
| Portability (Art. 20) | Export your data (profile, subscriptions, suggestions) in a machine-readable JSON format. |
| Erasure (Art. 17) | Request deletion of your account and personal data. Processed within 30 days. |
| Rectification (Art. 16) | Update your notification preferences and subscriptions directly. SSO identity data is controlled by your identity provider. |
| Restrict Processing (Art. 18) | Disable all notifications and unsubscribe from events without deleting your account. |
| Object (Art. 21) | Object to AI processing of your event suggestions. Contact us to opt out. |
| Withdraw Consent | Withdraw notification consent at any time from your notification settings. |
To exercise any right, use your account settings page or contact [email protected]. We will respond within 30 days.
8. California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act:
- Right to know: You may request the categories and specific pieces of personal information we have collected about you. We collect identifiers (name, email), internet activity (event subscriptions, notification preferences), and user-generated content (event suggestions).
- Right to delete: You may request deletion of your personal information, subject to certain exceptions.
- Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.
- No sale of personal information: We do not sell your personal information and have never done so. See our Do Not Sell My Personal Information page.
- Shine the Light (Cal. Civ. Code § 1798.83): We do not share personal information with third parties for their direct marketing purposes.
9. International Data Transfers
ArtistAlly is hosted in the United States on DigitalOcean infrastructure. If you access our service from outside the US, your personal data will be transferred to and processed in the US.
For users in the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to provide adequate safeguards for international data transfers. Our hosting and processor agreements incorporate these clauses where applicable.
10. Data Security
We protect your data through the following measures:
- All data in transit is encrypted via TLS 1.2+
- Database and storage are encrypted at rest (DigitalOcean managed encryption)
- Passwords are hashed using bcrypt with appropriate cost factors
- User identifiers in logs are pseudonymized — no raw personal information appears in our log stream
- All API keys and secrets are stored in environment variables, never in source code
- Role-based access controls limit data access to authorized personnel
11. Children's Privacy
ArtistAlly is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at [email protected] and we will promptly delete it.
12. Changes to This Policy
We may update this privacy policy from time to time. We will notify registered users of material changes via email. The “Last updated” date at the top of this page reflects the most recent revision.
13. Contact Us
For any privacy-related questions, concerns, or to exercise your data rights, contact:
Alchemy Lab LLC
Email: [email protected]