Global Privacy Policy

Effective and last updated: 9 November 2026 · Version 2026-11-09

This policy explains how DigiArte handles personal data when you browse, buy or sell digital goods, fund a wallet, request custom work, message another member, submit KYC, receive payouts, join a referral program, contact support or use our apps. The legal entity and privacy contact published in our Legal Notice is the controller; creators areindependent controllers for data they lawfully receive to fulfil a transaction.

1. Data we collect

• Account and profile: name, username, email, phone, country, language, avatar, biography, age/terms attestations, role and security settings.
• KYC and payout: date of birth, government-ID details and images, selfie/verification result, address, tax identifiers, payout account details and sanctions/fraud results. Verification providers may process the underlying documents directly.
• Transactions: cart, orders, downloads, licences, wallet deposits and credits, refunds, subscriptions, fees, tax location and invoices. Full card credentials are handled by payment providers, not stored by DigiArte.
• Marketplace content: listings, previews, source files, custom requests, deliveries, reviews, reports, disputes, copyright notices, counter-notices and creator analytics.
• Communications: messages, support conversations, notices and notification preferences. We may review communications when reported or needed for fraud, safety or legal compliance.
• Device and usage: IP address (used for security/rate limits; not stored long-term for first-party analytics), user agent (classified into device/browser family then discarded), approximate location (country/city from edge headers), anonymous browser identifiers after consent, logs, pages/events, dwell-time buckets, referring URL, UTM/click identifiers and cookie choices.
• First-party analytics (consent): when you allow Analytics cookies we record coarse page paths, device/browser class, approximate city/country, returning-visit flags and campaign parameters so DigiArte can measure traffic and surface anonymous “hot leads” (returning browsers that never submitted a form or started checkout). Obvious bots are filtered; soft spam suspects may be marked. We do not store raw IP or full User-Agent strings in the analytics tables.
• Ads and referrals: consent state, ad interactions, UTM and common click ids (for example gclid, fbclid, igshid) and referral attribution. Third-party ad pixels load only after Advertising consent. We do not knowingly sell personal data for money.

2. Purposes and legal bases

• Contract: create accounts, deliver files, process purchases, wallet credit, subscriptions, payouts, licences, messages and disputes.
• Legal obligation: tax and accounting records, KYC/AML and sanctions checks where applicable, consumer rights, valid legal requests and copyright notices.
• Legitimate interests: secure the service, prevent malware/fraud, enforce policies, improve reliability, measure essential performance and defend legal claims, balanced against your rights.
• Consent: optional analytics, personalised advertising where used, marketing communications, and any processing for which local law requires consent. You may withdraw consent without affecting earlier processing.
• Vital/public interests: only where necessary to protect a person or comply with a lawful public-interest duty.

3. Who receives data

We disclose only what is necessary to service providers such as Supabase (database, authentication and storage), Vercel (hosting and delivery), payment/KYC gateways, email and support providers, security/fraud vendors, Google Analytics or AdSense only when enabled and permitted by your consent, and professional advisers. A creator receives order and custom-work details needed to fulfil your purchase. Authorities or claimants receive data only when required by valid law, to protect safety, or to establish or defend rights. Providers must use data under contract and appropriate confidentiality/security terms.

4. International transfers

DigiArte is global, so data may be processed outside your country. For EEA, UK and Swiss data we use adequacy decisions where available, approved Standard Contractual Clauses or the UK Addendum/IDTA, plus supplementary security measures. Other transfers use safeguards required by applicable law. Contact us for information about the relevant safeguard.

5. Retention

• Account/profile data: while active, then normally deleted or anonymised within 30 days after a verified deletion request.
• Orders, payouts, wallet and tax records: generally 7 years, or longer if local tax/accounting law requires.
• KYC evidence: only as long as legally required or needed for fraud/dispute defence; provider retention may differ. Verification results may be retained longer than document images.
• Messages and support: normally account life plus 2 years; reported, dispute or safety records up to 7 years.
• Security logs: normally 12 months; consent and legal-acceptance evidence up to 7 years after the relevant relationship.
• First-party consented visitor analytics events: normally up to 13 months for aggregates and operational review, then deleted or anonymised.
• Backups are overwritten on a rolling schedule. Legal holds suspend deletion only for the affected records.

6. Your rights worldwide

Depending on location, you may request access, correction, deletion, portability, restriction, objection, withdrawal of consent, review of certain automated decisions, or appeal a denied request. Use Privacy & data rightsto download your data, request deletion, or choose Do Not Sell or Share My Personal Information. We verify identity, respond within the locally required period (normally 30 days; California normally 45 days), explain extensions, and do not discriminate for exercising rights. An authorised agent may contact us with proof of authority. You may complain to your local data-protection authority.

• EEA/UK/Switzerland: GDPR/UK GDPR rights and the legal bases above apply; you may contact your supervisory authority.
• California: CCPA/CPRA rights to know, delete, correct, limit use of sensitive data, and opt out of sale/sharing. DigiArte does not knowingly sell data for money; GPC is treated as an opt-out for that browser/device.
• Brazil: LGPD rights include confirmation, access, correction, anonymisation/deletion, portability, information about sharing and review.
• India: DPDP rights include access to processing information, correction, erasure, grievance redressal and nomination, subject to applicable exceptions.
• Singapore and Thailand: applicable PDPA access, correction, withdrawal, objection/deletion and complaint rights apply.
• Canada: PIPEDA and provincial-law access, correction and consent rights apply.
• Australia: Australian Privacy Principles access/correction and complaint rights apply.
• Bangladesh: we apply applicable privacy, cyber-security and consumer-protection requirements and provide the request mechanisms above.

7. Children and seller eligibility

Accounts are for people aged 13 or older, or the higher digital-consent age required where they live. DigiArte is not directed to children. A parent or guardian who believes a child provided data should contact us. Creators who sell, contract for custom work or receive payouts must be at least 18 and legally able to contract.

8. Security and automated decisions

We use access controls, encryption in transit, signed downloads, 2FA options, rate limits, malware/fraud screening and restricted administrative access. No online service is risk-free. Fraud, originality or risk scores may route activity to human review; we do not rely solely on automated processing for a decision that produces significant legal effects unless law permits it and appropriate review rights exist.

9. Cookies, changes and contact

See the Cookie Policy and re-open Cookie Settings from the footer. Material changes are announced in-product and may require re-acceptance. Earlier versions and acceptance timestamps are retained for accountability. Questions or complaints can be submitted through Contact. The owner must publish the responsible entity and privacy contact in the Legal Notice before launch.