Privacy policy

1. Controller and contact

The controller of your personal data is [IME I PREZIME — popuniti], [ADRESA PREBIVALIŠTA — popuniti], acting as a natural person (not a registered business) (“we”). For any privacy question, write toprivatnost@art-forus.com. This policy applies to the websiteart-forus.com and is applied in accordance with the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, “ZZPL”) and, for users in the European Union, the General Data Protection Regulation (GDPR).

2. What data we process and why

• Account — email address, password (stored only as a cryptographic hash), display name, short biography, language, country (optional — for the default view of listings), date on which you accepted the Terms and this Policy, notification settings, 2FA (encrypted secret). Purpose: running your account and signing you in. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Country you are visiting from — based on your IP address, Cloudflare tells us only a country code (e.g. RS); we use it at the moment of the request to choose the language and the default view of listings, and we do not store it. If you choose a view manually (“All countries” or another country), that choice is remembered in the afu_drzava cookie (see the Cookie policy). Legal basis: legitimate interest (showing relevant listings).
• Seller profile and works — seller type, categories, package, biography, contact details, social media, town, country (required — buyers from that country see your works by default), shipping costs, works with photos, prices and descriptions. Most of this is publicly visible, because that is the purpose of listing. Legal basis: contract.
• Seller’s identity document (for the “Verified seller” badge) — kept in restricted storage that only the administrator can access, and deleted 7 days after the decision. Legal basis: your consent and our legitimate interest in preventing fraud.
• Inquiries and orders — cart contents, the message sent with an inquiry, and your name and email address, which are sent to the seller so that they can reply to you; purchase confirmation. Legal basis: contract.
• Messages and commissioned work — message text, requests, reference images, offers. Only the participants in a conversation can see them; the administrator opens a conversation only if it has been reported. Legal basis: contract; for moderation, legitimate interest (user safety).
• Ratings — answers to guided questions and a comment; shown publicly with a shortened name (e.g. “Ana P.”). Legal basis: legitimate interest (trustworthiness of the platform).
• Reports and moderation — reports you submit or that are submitted against your content, account blocks, and the log of administrator decisions. We never reveal the identity of the person who made a report to the person reported. Legal basis: legitimate interest and legal obligations relating to unlawful content.
• Subscription — package and trial-period status; payment is processed by Freemius (we never see your payment card details), and from Freemius we receive only payment confirmation, dates and identifiers. Legal basis: contract and legal obligations.
• Newsletter — only if you expressly sign up and confirm through a link (double opt-in); you can unsubscribe at any time. You can also subscribe without an account (the form at the bottom of the page) — in that case we store only your email address, language and time of confirmation; a subscription that is not confirmed is deleted automatically as soon as the confirmation link expires (48 hours). Legal basis: consent (Art. 6(1)(a) GDPR).
• Alerts — saved searches and price-drop alerts that you switch on yourself. Legal basis: contract.
• Technical data — Cloudflare, our hosting provider, processes IP addresses and technical request data in order to deliver the website and protect it from attacks; we do not store IP addresses in our database. Exceptions: when you request a password reset we temporarily store a hash of your IP address (not the address itself) for at most 24 hours, and when you subscribe to the newsletter without an account — until the subscription is confirmed, for at most 48 hours; both to prevent abuse. Legal basis: legitimate interest (security).
• Statistics — aggregate daily counters (e.g. views per category, clicks on external links) with no link to any individual; we measure visits to the website with Cloudflare Web Analytics only if you allow it in the cookie settings. Legal basis: legitimate interest or, for analytics, consent.

There is no automated decision-making with legal effects. The only automatic step is temporarily hiding a listing after several reports from different accounts — the final decision is always made by a human.

3. Who receives the data

• Other users — when you send a seller an inquiry, the seller receives your name, email address and message; public profiles, works and ratings are visible to everyone.
• Processors acting on our behalf: Cloudflare, Inc. (hosting, database, image storage, sending email, Turnstile bot protection, Web Analytics) and Freemius, Inc. (subscription billing). For blog texts we use Anthropic (the Claude model) — it receives only topics and public information about the creator being written about (public profile and titles of works), never any data about buyers. Blog photos come from Unsplash; your browser loads them directly from Unsplash’s servers.
• Public authorities — where required by law (e.g. reporting content involving minors).

Some processors are located in the USA. Transfers rely on appropriate safeguards (standard contractual clauses or the EU–US Data Privacy Framework, where applicable) and on the ZZPL rules on transfers. [Pravni osnov prenosa proveriti sa advokatom.]

4. How long we keep data

• Account, profile, works, orders, messages and ratings — for as long as the account exists.
• Identity document for verification — 7 days after the administrator’s decision.
• Log of emails sent (type, subject, time) — 12 months.
• Raw CSV import files and per-row data — 90 days after the import finishes.
• Login sessions — until they expire (at most 30 days); confirmation links — until they expire.
• Password-reset requests, including the IP-address hash — at most 24 hours.
• Newsletter subscription without an account — until you unsubscribe; an unconfirmed subscription (with the IP-address hash) — at most 48 hours.
• Messages and conversations (chat, requests and offers for commissioned work, reference images) — for as long as the account exists. Only the participants in the conversation can see them. A moderator may read a conversationonly if one of the participants has reported it, and only to resolve that report; we do not read conversations that have not been reported. After your account is deleted, your messages remain available to the other party, without your personal data (see below).
• If an account has been banned — a cryptographic hash (SHA-256) of the email address, not the address itself, for as long as the ban lasts, including after the account is deleted, to prevent re-registration with the same address.
• An account whose email address was never confirmed — deleted automatically 30 days after registration (in the same way as when an account is deleted, see below).
• Your cookie choice — 365 days, only in your browser.
• After your account is deleted, your personal data is anonymised immediately: your email address, name, biography, password and 2FA are deleted, as are your wishlist, cart, saved searches, alerts, blocks, seller profile, works and their photos, identity document and reference images. We keep — without your personal data, under the label “Deleted user” — the record of orders (because it is also the other party’s record), ratings, the messages you sent in conversations (these are also the other party’s correspondence), reports and the moderation log (legitimate interest and legal obligations), and subscription and payment data (Freemius, as the seller of the service, keeps invoices in accordance with tax regulations). Content that is the subject of an open report or that the administrator has removed is kept as evidence until the procedure is completed.

5. Your rights

• Access and portability — the “Download my data” button on the account page gives you all your data in CSV format (tables in a single ZIP archive).
• Rectification — you can change most data yourself in your account and dashboard.
• Erasure — “Delete account” on the account page (see section 4).
• Restriction of processing and objection — write to us at privatnost@art-forus.com.
• Withdrawing consent — unsubscribe from the newsletter in your notification settings (if you subscribed without an account — through the unsubscribe link in any newsletter email, or by writing to privatnost@art-forus.com), and switch off analytics in the cookie settings; withdrawal does not affect the lawfulness of processing carried out before it.
• Complaint to a supervisory authority — the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (Poverenik, www.poverenik.rs). Users in the EU may also contact the supervisory authority of their own country (in Croatia: Agencija za zaštitu osobnih podataka, azop.hr). Users in Bosnia and Herzegovina may also contact the Personal Data Protection Agency of Bosnia and Herzegovina (Agencija za zaštitu ličnih/osobnih podataka u BiH, www.azlp.ba), and users in Montenegro the Agency for Personal Data Protection and Free Access to Information (Agencija za zaštitu ličnih podataka i slobodan pristup informacijama, www.azlp.me).

We respond to requests without undue delay and at the latest within 30 days.

6. Security and minors

We store passwords only as hashes, sessions as token hashes, 2FA secrets encrypted, and identity documents in separate restricted storage; all traffic goes over HTTPS. The platform is intended for adults (18+) and we do not knowingly collect data from minors.

7. Cookies

Which cookies and local storage we use, and how to change your choice, is explained on the Cookies page.

8. Changes

We notify registered users of material changes to this policy by email and on the website.

This policy was originally written in Serbian; we have prepared this translation in good faith so that the information about processing and your rights is clear to you. The Serbian original serves as the reference text if a dispute about interpretation arises, but this does not reduce the rights you have under this policy or under data-protection law. If anything in the translation is unclear, write to us at privatnost@art-forus.com.