Data Processing Addendum

When you store your gallery's data in Artfolio, you are trusting us to process it carefully and only as you direct. This is a plain-language summary of our Data Processing Addendum (DPA). The full, signable DPA is available from legal@artfolio.ai.

Roles

For the personal data inside your account — your contacts, collectors and team — you are the data controller, and Manual 2 AI Private Limited acts as your data processor. That means we process that data on your behalf and on your instructions, not for our own independent purposes.

Scope & purpose

We process your data only to provide and support the Artfolio service — running the platform, delivering the features you use, keeping it secure, and helping you when you ask. We do not sell your data, and we do not train shared or public AI models on your private content.

Confidentiality & security

Everyone with access to customer data is bound by confidentiality obligations. We apply technical and organisational security measures including encryption in transit and at rest, per-organisation isolation enforced by row-level security, least-privilege access and regular backups. These are described in more detail on our security overview.

Sub-processors

We use a small set of vetted infrastructure providers to deliver the service, each engaged for a specific purpose under appropriate safeguards. The current list — including each provider's role and region — is published at /legal/sub-processors/, and we notify customers of material changes.

Your rights & assistance

We help you meet your own obligations to the people whose data you hold. That includes assisting with data-subject requests (such as access, correction or deletion) where you need our support, and cooperating with reasonable requests relating to your compliance.

International transfers

Some of our sub-processors operate globally, so your data may be processed outside your country. Where that happens, we rely on appropriate transfer mechanisms and contractual safeguards to protect it.

Deletion, return & export

You can export your data at any time while your account is active. On termination, you may request the return or deletion of your data, and we will delete it within a commercially reasonable period, subject to any retention we're legally required to keep.