Privacy Policy
Last updated: October 19, 2026
1. Who We Are
ArtistAlly is operated by Alchemy Lab LLC (“we,” “us,” or “our”). We provide a community tool that aggregates convention and conference information for the furry, anime, and gaming communities. Our service is available at artistally.alchemylab.sh.
For privacy questions, contact us at [email protected].
2. Information We Collect
We collect only the information necessary to provide and improve our service. Below are the categories of personal information we collect:
Account Information
- Email/password sign-up: Your name, email address, and a securely hashed password. We never store your password in plain text.
- Sign in with Microsoft: When you sign in with a Microsoft account (work, school, or personal), we receive and keep your name, email address, and the identifier Microsoft uses for your account. Microsoft also tells us which Microsoft directory (tenant) your account belongs to; we check it only while you sign in, to decide whether the account may hold staff access, and do not store it.
- Sign in with Google: When you sign in with Google, we receive and keep your name, email address, the identifier Google uses for your account, and whether Google has verified your email address. Google also sends a link to your profile photo; we do not use it or keep it.
Service Usage Data
- Event subscriptions: Which events and metro areas you follow.
- Notification preferences: Your opt-in choices for email and browser push notifications, including push notification tokens.
- Event suggestions: Content you submit when suggesting a new event.
Payment Information (Pro Subscribers)
If you subscribe to ArtistAlly Pro, payment processing is handled entirely by Stripe. We do not receive or store your credit card number. Stripe provides us with your subscription status, Stripe customer ID, and billing email for account management purposes.
Your Business Records (Sellers)
If you use the inventory, expense, and analytics tools, we store the business records you enter: your product list and prices, what you packed for an event, quantities sold, and event expenses. This is your own data about your own business — we use it only to show you your figures, and we do not sell it or share it with conventions.
You may also upload a payment export from your own payment processor to reconcile takings against your inventory after an event. When you do, we keep only the transaction amount, processor fee, currency, timestamp, and the processor’s own reference number for the transaction.
We do not keep your customers’ personal information. Payment exports often contain buyer names, email addresses, billing addresses, and partial card numbers. Our importer reads only the fields listed above and discards everything else before it is saved, and our database has no fields in which such data could be stored. We never receive or store full card numbers, and ArtistAlly is not a payment processor — uploading an export does not connect your payment account to us or give us any access to it.
Artist Profiles, Listings, and Report Cards
If you create a Who’s Tabling artist profile, what you put in it (the name you choose, a short description, links, and what you sell) shows publicly on every convention where you publish a listing, with that listing’s table number and note. If you also choose to have an artist page, your profile, the styles and offers you add (with their prices), your commission status and terms link, and the conventions where you’ve published a listing show at your page’s address and in the artist directory, to anyone. Turn the page off and it stops showing; an address you used before keeps pointing to you so nobody else can take it. Report cards are public too, under your display name only if you choose to show it. When someone follows an artist we keep who follows whom, so we can tell followers when the artist lists a new convention.
Reports and Blocks
If you report a listing or an artist page, we keep the report: the reason you picked, anything you wrote, and which account sent it, so moderators can act on it and the same person can’t report the same thing twice. We never tell the artist who reported them. If you block someone, we keep who you blocked and the name you saw when you did. Both are deleted when you delete your account, and a report is also deleted when the listing it is about is.
Problem Reports and Feedback
If you report a problem with a convention listing or send us feedback, we receive what you put in the form, and only when you press Send: the problem you picked and the words you typed; the listing and the page the report is about; whether you sent it from the website or an app; and your email address, only if you ask for a reply (account help always needs one). If you are signed in, your plan and an internal account reference go with the report so support can find your account.
We also store a code that lets us count you once when the same problem is reported again. It is different for every problem, so it cannot link your reports to each other. To limit abuse we keep, for no more than two days, a one-way code derived from your network address and the date; it cannot be turned back into the address.
Reports are grouped by problem and passed to Alchemy Lab’s own support ticketing system, which files each problem as one ticket for our support team. We delete a report 180 days after the last report of its problem, or when you delete your account; a ticket already filed is kept as support correspondence. To have a report or your address removed sooner, write to [email protected].
Automatically Collected Information
Our servers automatically record standard access logs (IP address, browser type, pages visited). User identifiers in our application logs are pseudonymized — we do not store raw personal information in our log stream.
3. How We Use Your Information
| Processing Activity | Purpose | Lawful Basis (GDPR) |
|---|---|---|
| Account creation and authentication | Provide access to personalized features | Contract (Art. 6(1)(b)) |
| Event subscriptions | Let you follow events and metro areas | Legitimate interest (Art. 6(1)(f)) |
| Email and push notifications | Alert you to registration openings and event changes | Consent (Art. 6(1)(a)) |
| Event suggestions | Improve the event directory with community contributions | Legitimate interest (Art. 6(1)(f)) |
| AI processing of suggestions | Verify and enrich submitted event information via Exa | Legitimate interest (Art. 6(1)(f)) |
| Problem reports and feedback | Correct listings, fix what isn’t working, and answer support requests | Legitimate interest (Art. 6(1)(f)); account help: Contract (Art. 6(1)(b)) |
| Pro subscription billing | Process payments and manage subscription status | Contract (Art. 6(1)(b)) |
| Security and audit logging | Detect abuse, maintain security, comply with legal obligations | Legal obligation (Art. 6(1)(c)) |
4. How We Use AI
We use Exa, an AI-powered search engine, to discover and verify convention information from publicly available sources on the web. Specifically:
- Exa searches for event dates, venues, registration deadlines, and other publicly posted convention details.
- If you submit an event suggestion, your submission text may be used as a search query in Exa after sanitization. You are informed of this at the time of submission.
- Every event detail sourced from AI is attributed per-field so you can see which information was manually verified versus auto-detected.
ArtistAlly does not train, fine-tune, or host any AI models. We do not use automated AI-art detection. Our portfolio feature (when available) is a human-verification support tool, not an automated content classifier.
5. Third-Party Service Providers
We share data with the following service providers (“processors”) to operate ArtistAlly:
| Provider | Purpose | Data Shared |
|---|---|---|
| Microsoft (Entra ID) | Sign-in with a Microsoft account | Name, email, account identifier, directory (tenant) ID |
| Sign-in with a Google account | Name, email, account identifier, email-verification status | |
| Stripe | Pro subscription payment processing only. Uploading your own payment export does not share anything with Stripe or connect your payment account to us. | Email, subscription status |
| DigitalOcean | Application hosting and database | All application data (encrypted at rest) |
| Exa | AI-powered event data discovery | Search queries (may include sanitized user text) |
| Anthropic (Claude) | AI extraction of event registration and logistics details from public web pages | Public event and website text (no personal data) |
| Microsoft 365 | Our support mailbox, when we reply to a report or support request | Your email address and our correspondence with you |
| Resend | Transactional email delivery | Email addresses, notification content |
| Sentry | Error monitoring and crash diagnostics | Error and stack-trace data with personal data removed (no emails, IP addresses, cookies, or request bodies) |
| Transitland (Interline) | Transit routing data | Venue coordinates (no personal data) |
We maintain Data Processing Agreements (DPAs) with processors that handle personal data. Donation platforms (Ko-fi, Open Collective) are linked from our site but do not receive any user data from ArtistAlly.
6. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data (name, email, password hash) | Active account + 30 days after deletion request |
| Event subscriptions and notification preferences | Active account lifetime; deleted on account deletion |
| Push notification tokens | Until unsubscribed or token expires |
| Event suggestions | Indefinite (anonymized upon account deletion) |
| Artist profile and page, offers, listings, and follows | Until you delete them or your account |
| Report cards | Indefinite (kept without your name upon account deletion) |
| Reports you make about listings, and the people you block | Until you delete your account; a report also goes when its listing does |
| Stripe subscription records | Active account + 30 days after deletion; Stripe retains records per their policy |
| Your business records (products, packing lists, sales, expenses, imported transaction amounts) | Active account lifetime; deleted on account deletion |
| Problem reports and feedback (what you wrote, the page, and your email address if you asked for a reply) | 180 days after the last report of the same problem; deleted on account deletion |
| Network-address code used to limit report abuse | No more than two days |
| Event data (public convention info) | Indefinite (not personal data) |
| Exa query logs | 12 months rolling |
| API usage and cost logs | 24 months rolling |
| Security and audit logs | 24 months rolling (pseudonymized) |
7. Your Rights Under GDPR
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation:
| Right | What It Means |
|---|---|
| Access (Art. 15) | View all personal data we hold about you from your account settings, or request a copy by email. |
| Portability (Art. 20) | Export your data (profile, subscriptions, suggestions) in a machine-readable JSON format. |
| Erasure (Art. 17) | Delete your account and personal data yourself, straight away, from your account settings or the account deletion page, which also lists what is kept. A request by email is processed within 30 days. |
| Rectification (Art. 16) | Update your notification preferences and subscriptions directly. SSO identity data is controlled by your identity provider. |
| Restrict Processing (Art. 18) | Disable all notifications and unsubscribe from events without deleting your account. |
| Object (Art. 21) | Object to AI processing of your event suggestions. Contact us to opt out. |
| Withdraw Consent | Withdraw notification consent at any time from your notification settings. |
To exercise any right, use your account settings page or contact [email protected]. We will respond within 30 days.
8. California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act:
- Right to know: You may request the categories and specific pieces of personal information we have collected about you. We collect identifiers (name, email), internet activity (event subscriptions, notification preferences), and user-generated content (event suggestions, artist profiles and pages, offers, listings, report cards, reports about listings and artist pages, problem reports, and feedback).
- Right to delete: You may request deletion of your personal information, subject to certain exceptions.
- Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.
- No sale of personal information: We do not sell your personal information and have never done so. See our Do Not Sell My Personal Information page.
- Shine the Light (Cal. Civ. Code § 1798.83): We do not share personal information with third parties for their direct marketing purposes.
9. International Data Transfers
ArtistAlly is hosted in the United States on DigitalOcean infrastructure. If you access our service from outside the US, your personal data will be transferred to and processed in the US.
For users in the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to provide adequate safeguards for international data transfers. Our hosting and processor agreements incorporate these clauses where applicable.
10. Data Security
We protect your data through the following measures:
- All data in transit is encrypted via TLS 1.2+
- Database and storage are encrypted at rest (DigitalOcean managed encryption)
- Passwords are hashed using bcrypt with appropriate cost factors
- User identifiers in logs are pseudonymized — no raw personal information appears in our log stream
- All API keys and secrets are stored in environment variables, never in source code
- Role-based access controls limit data access to authorized personnel
11. Children's Privacy
ArtistAlly is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at [email protected] and we will promptly delete it.
12. Changes to This Policy
We may update this privacy policy from time to time. We will notify registered users of material changes via email. The “Last updated” date at the top of this page reflects the most recent revision.
13. Contact Us
For any privacy-related questions, concerns, or to exercise your data rights, contact:
Alchemy Lab LLC
Email: [email protected]