Your data, in plain English.

Last updated: 2 July 2026

This policy explains what personal data Art Vault collects, why, and what rights you have. Art Vault is a product of Expression Labs Ltd. We built Art Vault to help artists protect their work — so protecting your data matters to us too.

Who we are

Expression Labs Ltd, registered in England & Wales (company no. 16912629), registered office 1 Sandpiper Drive, Stockport, SK3 8UL. We are the data controller. We are registered with the UK Information Commissioner's Office (ICO), reference ZC160882.

What we collect, and when

1. When you create an account

Your email address and a securely hashed password. We never store your password in readable form.

2. When you protect artwork

The images you upload and any metadata you choose to add (e.g. usage terms, credit). Your artwork is your personal data and your intellectual property — see "How we treat your artwork" below.

3. When you subscribe

Billing details handled by our payment processor (Stripe). We do not see or store your full card number; the processor handles that under PCI-DSS.

4. Automatically, through cookies

Analytics and advertising cookies — but only after you accept them (see our Cookie Policy). Nothing non-essential loads until you choose.

5. When you contact us

The content of your message and your email address, so we can reply and support you.

How we treat your artwork

We process your uploaded images only to apply protection (adversarial processing, provenance signing, watermarking) and to make them available in your vault. We do not train AI models on your work, we do not sell it, and we claim no ownership. You grant us only a limited licence to process and store it so we can provide the service. See the Terms of Service.

Why we use your data — and our lawful basis

Purpose	Lawful basis (UK GDPR)
Provide your account, protect your images, deliver the service	Performance of a contract
Take payment for subscriptions	Performance of a contract
Analytics & advertising cookies; marketing email	Consent (withdraw any time)
Security, fraud & abuse prevention, service improvement	Legitimate interests
Tax, accounting and legal compliance	Legal obligation

Who we share it with

We use trusted service providers ("processors") who act on our instructions under data-processing agreements. They include, as applicable:

Hosting / infrastructure (e.g. Netlify and our backend host)
Payments (Stripe)
Email / support (e.g. our email provider)
Analytics & advertising (Google — GA4 and Google Ads), only with your consent

We do not sell your personal data.

Sending data outside the UK

Some providers are based in the United States. Where personal data is transferred outside the UK we rely on appropriate safeguards — the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the UK–US Data Bridge, as applicable.

How long we keep it

Account and artwork data: for as long as your account is active, then deleted or anonymised within a reasonable period after closure (target: 90 days), except where we must keep records longer for legal or accounting reasons. Analytics data: per the retention set in our tools.

Your rights

Under UK GDPR you can ask us to: access your data; correct it; delete it; restrict or object to processing; port it; and withdraw consent at any time. Email hello@expressionlabs.co and we'll respond within one month.

If you are in the United States (CCPA/CPRA)

California residents have the right to know what personal information we collect, to delete it, to correct it, and to opt out of the "sale" or "sharing" of personal information (including sharing for cross-context behavioural advertising). We do not sell your data for money; to opt out of advertising-related sharing, decline cookies in our banner or email hello@expressionlabs.co. We will not discriminate against you for exercising these rights.

If you are in Canada (PIPEDA)

We collect, use and disclose personal information with your knowledge and consent, for the purposes described above, and give you access to your information on request. If you are in Québec, additional rights under Law 25 may apply; contact us to exercise them.

Cookies

See our Cookie Policy for the full list and to change your choice.

Complaints

We'd like the chance to help first — email hello@expressionlabs.co. You also have the right to complain to the ICO: ico.org.uk/make-a-complaint.

Changes to this policy

If we change this policy we'll update the date above; for significant changes we'll do more to let you know.