This notice covers the public ARVONAR storefront only. Artist and admin accounts will receive a separate privacy notice.
1. Scope and overview
This notice explains how personal data is processed in the public ARVONAR storefront. It covers browsing, inquiries, artist contact, reviews, the chat assistant, reservations, purchases, and document delivery.
You can use large parts of the site without actively giving us personal data. However, technical data is processed when the site is called, and additional data is processed when you use interactive features.
2. Controller roles and contact
The controller for the processing described in this storefront notice is the entity named in our Legal Notice. For privacy questions, contact kontakt@arvonar.de.
ARVONAR operates a marketplace-style platform. For website operation, technical checkout orchestration, reservation handling, document delivery, and some communication flows, ARVONAR processes data in its own role as platform operator. For the sale, shipping, seller-side support, return or withdrawal handling, warranty handling, and where relevant direct response to artwork or commission requests, the respective artist is your contractual seller or seller-side contact and processes the data needed for that role.
Depending on the step, ARVONAR and the respective seller may each process your data for their own responsibilities. Where data is passed to the relevant artist for seller-side fulfillment or request handling, that artist may also act as a separate controller for that downstream processing. Typical legal bases are Art. 6(1)(b), Art. 6(1)(c), and Art. 6(1)(f) GDPR.
3. Hosting, database, security, and logs
To run the storefront, we use a hosting/runtime provider (currently Vercel), a managed database provider, and supporting infrastructure for secure delivery, webhooks, document downloads, and email flows. When you access the site, technical request data such as IP address, browser information, requested URL, timestamp, and security-relevant event data may be processed.
We also use Sentry for error monitoring and incident response. Where feasible, we try to avoid or redact direct identifiers in monitoring data.
Legal basis: Art. 6(1)(f) GDPR. Where providers process data outside the EU/EEA, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.
4. Analytics, marketing measurement, consent, and browser storage
The storefront offers optional consent choices for anonymous analytics via Plausible Analytics and marketing measurement via Google Ads. Plausible events are sent only if you enable analytics in our privacy settings. The Google Ads tag is loaded only if you enable marketing in the privacy settings.
When marketing measurement is enabled, Google Ads and the Google tag may process browser-related identifiers, ad click information, usage events, and consent signals to measure advertising performance and provide advertising features after consent. In this first implementation, ARVONAR does not send enhanced conversion data such as email address, name, address, or phone number to Google.
Your preference is stored in your browser. We also use technically necessary cookies and browser storage for storefront operation, for example checkout reservations, duplicate-event prevention after checkout, and remembering your consent choice.
Legal bases: Art. 6(1)(a) GDPR for optional analytics and marketing measurement, and Art. 6(1)(f) GDPR for technically necessary storage and secure operation.
5. Reservations, orders, payments, and documents
If you reserve or buy an artwork, we process data such as your name, email address, shipping address, locale, order amount, reservation token, and Stripe session/payment identifiers.
Payments are processed through Stripe. Invoices and certificates of authenticity are stored privately in Hetzner Object Storage and delivered through first-party download routes or by email. Transactional emails are sent via IONOS. Where necessary for sale fulfillment, delivery coordination, after-sales support, return or withdrawal handling, warranty handling, or legally required business operations, the relevant artist or seller may also receive the required customer and order data. Depending on the operational setup, this data may be made available through the ARVONAR admin area, first-party document or download routes, operational mailboxes, or other ARVONAR-supported communication channels. Where email is used, communication may take place through an ARVONAR-managed email address on the arvonar.de domain or through the artist's own business email address.
Order, invoice, and related accounting data are kept as long as required for contract handling and legal retention obligations, generally up to 10 years. Legal bases: Art. 6(1)(b) and Art. 6(1)(c) GDPR.
6. Contact, artist contact, artwork inquiries, B2B, and commissions
If you contact us by email or use artwork inquiry, B2B inquiry, or commission forms, we process the information you submit in order to answer your request and handle follow-up. Depending on the form, this may include your name, email address, company, project details, size preferences, budget, timeline, and free-text message.
If you use the public artist contact form, we process the contact details you provide, your email address, an optional link to your website or social media profile, and your free-text message in order to answer your contact request and communicate with you about a possible later presentation of your works on ARVONAR. This artist contact data is not passed to individual sellers; it is handled internally at ARVONAR and processed through the email infrastructure we use.
To answer your request, the relevant artist or seller may receive the necessary inquiry or commission data. Depending on the operational setup, this data may be made available in the ARVONAR admin area, in operational mailboxes, or through other ARVONAR-supported communication channels. Where email is used, communication may take place through an ARVONAR-managed email address on the arvonar.de domain or through the artist's own business email address. Commission requests may later include quote or payment-link metadata if the request advances. Emails are sent through IONOS.
Legal basis: Art. 6(1)(b) GDPR where your request is aimed at a contract or pre-contractual steps, otherwise Art. 6(1)(f) GDPR. Our current retention targets are generally up to 12 months after the last reply for artwork inquiries, up to 24 months after last activity for commission and B2B requests, and up to 24 months after last activity for artist contact requests unless the request converts into an artist or admin relationship; mailbox copies may remain in operational mailboxes for the applicable operational or legal retention period.
7. Reviews and post-purchase feedback
After a purchase, we may send review invitations and process review data such as your name, email address, review token, rating, and optional comment. Approved reviews may remain published while needed for storefront trust and documentation. Review-related communication and moderation may be handled by ARVONAR and, where relevant, the artist or seller responsible for the artwork.
Depending on the operational setup, review-related data may be made available in the ARVONAR admin area, in operational mailboxes, or through other ARVONAR-supported communication channels. Where email is used, review-related emails may be sent through an ARVONAR-managed email address on the arvonar.de domain or through the artist's own business email address. Legal bases: Art. 6(1)(b) GDPR for purchase-related communication and Art. 6(1)(f) GDPR for operating and moderating the review flow.
8. Chat assistant and “view in room”
If you use the storefront chat assistant, we process the live message content you send, your locale, artwork/artist context, and interaction metadata in order to generate a reply and evaluate broad outcomes such as whether the conversation led to a CTA.
Chat responses are currently generated through Anthropic or OpenAI, depending on the active provider configuration or controlled experiments. New raw chat transcripts are no longer stored in our application database. We only retain minimized chat insight/outcome records for a short operational window, currently targeted at 90 days.
If you use “view in room” with your own room photo, that image stays on your device/browser in the current implementation. It is not uploaded to our servers. Legal basis: Art. 6(1)(f) GDPR for requested storefront assistance and feature operation.
9. Processors, recipients, and international transfers
Depending on the feature you use, our processors and recipients may include the relevant artist or seller, Vercel, our managed database provider, Stripe, IONOS, Plausible, Google Ads, Sentry, Hetzner Object Storage, Cloudinary for storefront media delivery, and Anthropic and OpenAI for chat. Where artist communication or fulfillment is involved, the artist may receive data through the ARVONAR admin area, first-party document or download routes, operational mailboxes, or other ARVONAR-supported channels. Where email is used, this may include an ARVONAR-managed email address on the arvonar.de domain or the artist's own business email address.
Some of these providers may process data outside the EU/EEA or use global support structures. Where this happens, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses. More information about the relevant safeguards can be requested via kontakt@arvonar.de, and we update this notice when the processor setup changes materially.
Where communication is routed through ARVONAR-managed operational mailboxes, ARVONAR may access mailbox content and related metadata where needed for support, security, abuse prevention, continuity, legal compliance, or technical administration. If communication is routed to the artist's own business mailbox, that mailbox is operated outside ARVONAR's direct technical control.
10. Retention and deletion principles
We keep personal data only as long as needed for the relevant purpose, legal obligations, or the defense or enforcement of claims. The main target periods in the current storefront model are:
- Orders, invoices, and accounting-related documents: generally up to 10 years.
- Minimized chat insight/outcome data: 90 days.
- Artwork inquiries: generally up to 12 months after the last reply.
- Commission, B2B request, and artist contact data: generally up to 24 months after last activity unless converted into an order, accounting, or artist-account context.
- Approved reviews: while published or otherwise needed for storefront trust and documentation; pending, rejected, or unsubmitted review flows: generally up to 12 months after closure.
- Operational mailbox copies and purely operational email flows: the applicable operational or legal retention period, followed by deletion or anonymization where feasible.
If data must be kept longer for legal reasons, dispute handling, or fraud prevention, we restrict access and keep only what is necessary.
11. Your rights, consent choices, required data, and automated decisions
You have the rights under the GDPR, especially access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). You can also withdraw optional analytics and marketing-measurement consent at any time through our privacy settings with effect for the future.
To exercise your rights, contact kontakt@arvonar.de. If your request concerns a completed sale or fulfillment by the respective seller, we may need to coordinate with that artist in order to answer properly. Some checkout, payment, shipping, and inquiry data is contractually or operationally required so that we can start checkout, process an order, answer a request, or coordinate fulfillment. If required data is not provided, we may be unable to provide the relevant order or inquiry flow.
ARVONAR does not currently use solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you in the storefront flows described here.
12. Complaints and changes to this notice
You have the right to lodge a complaint with a data protection supervisory authority, especially in the member state of your habitual residence, place of work, or the place of the alleged infringement. A German overview is available here: Federal Commissioner for Data Protection — contact details.
We update this notice when processors, retention rules, or storefront data flows change materially.
13. External links to social networks
Our platform may display links to external social media profiles of ARVONAR and to social media profiles of individual artists, for example Instagram, TikTok, Pinterest, LinkedIn, or Facebook.
These links are normal external links only. We do not embed content from social networks directly on our website, and no social media plugins or feeds are loaded automatically.
Only when you click such a link do you leave our website and get redirected to the respective platform. From that point onward, the privacy policies of the respective platform operator apply. Personal data may be processed there, in particular your IP address, device information, usage data, and information that you visited our website.
We have no influence over the nature and scope of data processing by the respective platform operators. Please consult the respective providers directly for their privacy policies.