Privacy Policy

1. Who we are

The controller of your personal data is Leona Creo OÜ, a private limited company registered in Estonia under register code 14863242, at Sakala tn 7-2, Tallinn 10141, Estonia (“Leona Creo”, “we”, “us”).

For any question about this policy or your data, to exercise your rights or to ask for the deletion of your data, write to [email protected]. We answer in English or Estonian. We have not appointed a data protection officer, because the law does not require one for a service of our kind; the address above reaches the people responsible for your data.

2. What data we process, why, and on what legal basis

For each purpose we name the legal basis under Article 6(1) of the GDPR:

• Contract (Article 6(1)(b)): the processing is needed to provide Leona Creo, which you asked for when you created an account and accepted the Terms and Conditions.
• Legitimate interests (Article 6(1)(f)): the processing is needed for an interest of ours that we name each time, such as keeping Leona Creo secure, and does not override your rights. You can object to it at any time (see Your rights).
• Consent (Article 6(1)(a)): only where we ask for it, and you can withdraw it at any time.
• Legal obligation (Article 6(1)(c)): where a law requires us to keep or hand over data.

2.1 Your account

• What: your email address, first and last name, password (we store only a secure hash of it, never the password itself), the account type you choose (Artist or Collector), a member ID we generate, the time you accepted the terms, and whether you verified your email address.
• Sessions: when you sign in on the website, WordPress sets sign-in cookies. When you sign in in the app, the app keeps a session token in your phone’s secure storage, and we keep only a digest of it with its creation, expiry and last-use times. We do not record your device, your IP address or your browser with the session.
• Codes: the codes we email to confirm your address, reset your password or delete your account are stored only as a digest and expire after 10 minutes.
• Purpose: to create your account, sign you in and keep it secure. Legal basis: contract.

2.2 Your profile

• What: your public name, bio, country, business name, website and social links, profile photo and cover photo, as far as you add them.
• Who sees it: your profile is public, on the website and in the apps.
• Purpose: to present you and your work to the community. Legal basis: contract.

2.3 Artworks, photos and videos

• What: the artworks you post, with their photos and videos, title, description, details and the price you choose to show.
• Moderation: an artwork is published only after our moderators approve it. Once published it is public.
• Metadata: the app removes the information embedded in a photo (such as the camera and the place it was taken) before uploading it, and we refuse videos that carry a location. We keep the original file you uploaded in private storage that is not reachable from the internet, and publish resized copies.
• Purpose: to publish and show your work. Legal basis: contract.

2.4 Your activity: follows, applause, saved artworks, comments, reviews and messages

• Follows, applause and saved artworks: who and what you follow, applaud or save, to build your feed and show counts.
• Comments: comments on artworks are published at once and are public. The artist can remove comments on their own artworks, and our moderators can remove any comment.
• Reviews: reviews and the artist’s replies are published only after moderation.
• Messages: your conversations with other members are private to the people in them. They are stored on our servers so that both of you can read them. Our moderators read a conversation only when someone reports it.
• Notifications: we record the activity that concerns you (a new follower, applause, a comment, a message) to show it in your notifications, and we email you according to your notification preferences.
• Purpose: these are the features of Leona Creo. Legal basis: contract.
• IP address of comments and reviews: with each comment and review we store the IP address it was sent from, as WordPress does for every comment. Purpose: to detect and stop spam and abuse. Legal basis: our legitimate interest in a service free of spam and abuse.

2.5 Reports, blocks and moderation

• Reports: when you report an artwork, a member, a conversation, a comment or a review, or send us a notice by email, we keep the reason, your note, who reported (if you are signed in, or the name and email address you give us) and what was reported.
• Moderation records: our decision on the report, the statement of reasons we send to the member concerned, and any complaint about the decision.
• Blocks: when you block a member, we keep the block so that they cannot message you or interact with your work. They are not told.
• Purpose: to keep the community safe, enforce our Terms and Conditions, and handle notices, statements of reasons and complaints as the EU Digital Services Act (Regulation (EU) 2022/2065) requires. Legal basis: contract for blocks; legal obligation for notices, statements of reasons and complaints; our legitimate interest in a safe service for the rest.

2.6 Signing in with Google, Apple or Facebook

• What we receive: if you choose to sign in with Google, Apple or Facebook, the provider tells us an identifier that is unique to your account with that provider, and, if you allow it, your email address and name.
• What we keep: the provider’s name and that identifier, linked to your Leona Creo account, and the date of the link. We never receive your password for that provider. The provider is never your Leona Creo account: it is one way to sign in to it.
• Facebook: on iPhone the app uses Facebook’s Limited Login, without tracking. The app turns off Facebook’s app-event logging and advertising identifier, and starts Facebook’s code only when you press the Facebook button.
• Google’s sign-in service on our pages: on the sign-in page, the website loads Google’s sign-in service (Google Identity Services) from Google’s servers for visitors who are not signed in, so that a visitor who is signed in to Google in the browser can sign in to Leona Creo in one step. On every other page shown to visitors who are not signed in, it loads only after you accept in our cookie banner (see section 4); if you refuse, or have not chosen, it does not load there. When it loads, your browser connects to Google, and Google receives your IP address and the address of the page you are on. If you are signed in to Google, Google may show you its own prompt to continue with your Google account, and on the sign-in page Google’s button may show your name. We receive nothing from Google unless you choose to continue. Pages shown to signed-in members do not load it. Legal basis: on the sign-in page, our legitimate interest in offering a quick and secure sign-in; on the other pages, your consent.
• Purpose: to let you sign in without a separate password. Legal basis: contract. The provider’s own privacy policy applies to what you share with it.
• You can unlink a provider at any time; see Deleting your account and your data.

2.7 Importing posts from Instagram (artists only)

• What: if you connect your Instagram account, Instagram gives us your Instagram username, your account identifiers and an access token, which we store encrypted. When you choose posts to import, we copy their images and captions into new artworks in your account, which you complete and which our moderators approve before they are published.
• Purpose: to save you from posting your work twice. Legal basis: contract, at your request; connecting Instagram is optional.
• You can disconnect Instagram at any time, and the token and identifiers are then deleted. Artworks you already imported stay yours until you delete them.

2.8 Statistics of artwork views

• What: we count how many times each artwork is viewed, per hour, without recording who viewed it. To count a visit only once, we keep a keyed digest of the visitor’s IP address and a digest of the browser’s identification for at most one hour.
• Purpose: to show artists how their work is seen. Legal basis: our legitimate interest in giving artists statistics about their work, without any profile of visitors.

2.9 Contact form and emails

• Contact form: your name, email address and message, delivered to our mailbox so that we can answer you. Legal basis: our legitimate interest in answering the people who write to us, or steps you ask for before a contract.
• Emails we send you: codes, password resets, confirmations and the notifications you keep on. We send them from [email protected]. Legal basis: contract. We send no marketing emails.

2.10 Push notifications

The apps do not send push notifications today. When they do, the app will ask your permission first, we will store a push token for your device and delete it when you sign out or delete your account, and we will update this policy before that starts.

2.11 Security, logs and error reports

• Server logs: our servers record each request, with the IP address, the time, the address requested (which may include search words) and the browser’s identification. Purpose: to keep Leona Creo secure, find faults and stop attacks. Legal basis: our legitimate interest in the security and operation of the service.
• Abuse limits: to limit abuse, such as repeated sign-in attempts, we keep counters keyed by a digest, never the address itself, for the length of their time window. Legal basis: our legitimate interest in protecting accounts.
• Security and fraud records: when we detect or investigate abuse, fraud or an attack, we keep the records needed for it. Legal basis: our legitimate interest in protecting the service, its members and our rights.
• Error reports from the server and the apps: when the server or the apps fail, they can send an error report to our error-monitoring service, Sentry, stored in Sentry’s EU data region (de.sentry.io). A report holds only a fixed error code, the version, the platform and the part of the service that failed: no name, email address, message, IP address or other content. Legal basis: our legitimate interest in a working service.
• Error reports from your browser: the website can also report errors of its own pages from your browser, but only after you accept in our cookie banner (see section 4). A report holds only the kind of error, the name of the website’s own script file, the line and column where it happened, a fixed error code and the version of the website: no message, address, cookie or other content of your page. It is stored in Sentry’s EU data region. If you refuse, or withdraw, your browser sends none. Legal basis: consent, which you can withdraw at any time.

2.12 Search

The words you search for are used to answer your search and are not stored with your account.

2.13 No sales and no payments

Leona Creo does not sell artworks and takes no payments today. A price on an artwork is information from the artist; if you buy from an artist, you do it directly with them, outside Leona Creo, and we receive no payment data. If we introduce paid features, we will update this policy before they start.

Records of orders made on the earlier version of the website are kept only because accounting law requires it. Legal basis: legal obligation.

2.14 Analytics and advertising

The website measures how it is used with Google Analytics, through Google’s Site Kit plugin, on every page and for every visitor. Google’s tag loads from Google’s servers, your browser connects to Google, Google receives your IP address, the address of the page you view and your browser’s identification, and Google Analytics sets its cookies to tell visits apart (see section 4). This does not depend on your choice in our cookie banner. We use these statistics only to understand how Leona Creo is used and to improve it, and we use none of Google Analytics’ advertising features. Legal basis: our legitimate interest in knowing how our website is used. You can object at any time (section 9), and you can stop it yourself by blocking or deleting cookies in your browser or with Google’s opt-out browser add-on for Google Analytics.

We use no advertising, no advertising identifier and no tracking pixels, on the website or in the apps, and the apps use no analytics service.

3. What you must give us

To create an account you must give us an email address, your first and last name and a password, or sign in with Google, Apple or Facebook, and accept the terms: without them we cannot open or protect your account. Everything else (your profile details, artworks, comments, messages, the Instagram connection) is up to you. No law requires you to give us personal data.

4. Cookies and similar technologies

Apart from what Google Analytics, Google’s sign-in service and the browser error reports need, described below, the website’s own cookies are only those that are strictly necessary for the service you ask for, which the law allows without consent:

• Sign-in cookies (WordPress, such as wordpress_logged_in_… and wordpress_sec_…) keep you signed in, for up to 14 days, and a test cookie checks that your browser accepts cookies.
• Short-lived sign-in cookies protect a sign-in with Google, Apple or Facebook while it travels to the provider and back, and expire within minutes.
• Security cookies of our network provider, Cloudflare, may be set to tell people from automated traffic.
• The appearance cookie lcr_theme remembers whether you chose the light or the dark mode, for one year. It is set only when you make that choice, and only to keep it.
• Your cookie choice is kept in two cookies, wp_consent_statistics and wp_consent_consented_services, for 30 days. They hold only whether you pressed Accept or Refuse in our cookie banner, so that we can honour your choice and do not ask again on every page. They are set only when you press one of those two buttons.

Forms and actions on the website also carry a one-time security code (a nonce) in the page itself, not in a cookie, to protect you from forged requests.

Google’s sign-in service. On the sign-in page, for visitors who are not signed in, the website loads Google’s sign-in service from Google’s servers, and on every other page shown to them only after you accept in our cookie banner (see section 2.6). It can show Google’s own prompt to sign in with your Google account, and Google sets its own cookie g_state on our website to remember whether you closed that prompt. We do not read that cookie. Google decides how its prompt and its cookie behave, under its own privacy policy. When the service loads, we set our own cookie __Host-lcr_google_tap. It holds random values that only our server reads, to tie Google’s answer to this browser. The website’s pages cannot read it; it is sent with requests to our website but read only by our sign-in service. It is renewed when a page that loads Google’s sign-in service asks for it, at most every ten minutes in each browser tab, and expires one hour after the last renewal. It is deleted each time you use Google’s prompt or button on our website, whether or not the sign-in completes. In your browser tab’s session storage we also keep, for at most ten minutes, the answer that lets Google’s prompt start; it is removed when you use the prompt, when you close the tab and when you withdraw your choice. Pages shown to signed-in members do not load the service.

Your choice, and how to change it. The cookie banner asks one question with two buttons, Accept and Refuse, which weigh the same. If you accept, we collect the browser error reports of section 2.11 and load Google’s sign-in service on the pages other than the sign-in page. If you refuse, or have not chosen, we do neither. Google Analytics does not depend on this choice (section 2.14). You can change your choice at any time, as easily as you made it: with one click on “Cookie settings” in the footer of every page, or here: Change your cookie choice. When you withdraw, we stop using Google’s sign-in service and the error reports on that page at once. We cannot remove Google’s g_state cookie, which Google set, nor __Host-lcr_google_tap, which only our server can read; Google’s expires by itself or when you delete it in your browser, and ours within an hour.

We set no advertising cookies. Google Analytics sets its cookies _ga and _ga_… on our website for every visitor, for up to two years, to tell visits apart, whatever you chose in our cookie banner (section 2.14). Google’s sign-in service and your cookie choice are described above. The browser error reporting described in section 2.11 sets no cookie and keeps nothing on your device, and runs only if you accept. On the phone, the apps keep your session token in the phone’s secure storage and your appearance choice in the app’s own settings.

Some pages of the website load common code libraries from the public content networks jsDelivr and cdnjs. Your browser then connects to them, and they see your IP address, as any website you connect to does.

5. Who receives your data

• Other people: what you publish (your profile, published artworks, comments, approved reviews, and the applause and follows shown on them) is public. Your messages go only to the people in the conversation.
• Our processors, who process data only on our behalf, under our instructions and a data processing agreement:
  • Amazon Web Services: the servers that run the website and the apps’ service, in the EU (Ireland);
  • Cloudflare: domain name service, network protection and delivery of the website’s pages and media;
  • Zoho: our mailbox and the sending of our emails, in its EU data centres;
  • Sentry: error reports, which contain no personal data by design, in its EU data region;
  • Automattic (Akismet): checks comments left on our blog posts for spam, and only those.
• Content networks: jsDelivr and cdnjs deliver code libraries to your browser and see its IP address (see Cookies).
• Sign-in and import providers, when you choose to use them: Google, Apple and Meta (Facebook Login and Instagram). They are controllers of their own data and act under their own privacy policies. If the apps add push notifications, Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service) will deliver them.
• Google’s sign-in service: on the sign-in page, and on the other pages shown to visitors who are not signed in once you accept in our cookie banner, your browser loads Google’s sign-in service from Google’s servers, and Google then receives your IP address and the address of the page you are on, even if you do not sign in (see section 2.6). Google is a controller of that data and acts under its own privacy policy.
• Google Analytics: Google receives the measurement of section 2.14 (your IP address, the pages you view and your browser’s identification) for every visitor.
• App stores: Apple and Google distribute the apps and process data about your download under their own policies.
• Authorities: courts, the police or other authorities, when the law requires it, for example an order under the Digital Services Act, or when we must report a threat to someone’s life or safety or child sexual abuse material.
• Advisers: our lawyers, accountants and auditors, under confidentiality, when they need it for their work.
• A new owner: if Leona Creo is merged or sold, your data would pass to the new owner, who would remain bound by this policy, and we would tell you first.

We do not sell or rent your personal data, and we do not share it with advertisers or data brokers.

6. Transfers outside the European Economic Area

Our servers, our mailbox and our error reports are in the European Union. Some of the providers named in section 5 (Cloudflare, Automattic, jsDelivr and cdnjs, Google, Apple and Meta) are based in the United States or may process data there. When personal data leaves the European Economic Area, it is protected:

• by the EU–US Data Privacy Framework, where the provider is certified under it (an adequacy decision of the European Commission); or otherwise
• by the Standard Contractual Clauses adopted by the European Commission, with additional measures where needed.

You can ask us for a copy of the safeguards that apply by writing to [email protected].

7. How long we keep your data

• Your account, profile, artworks, comments, reviews, follows, applause, saved artworks and blocks: as long as your account exists, or until you delete them. When you delete your account they are deleted at once; anything that cannot be deleted at once is deleted within 30 days (see Deleting your account and your data).
• Messages: as long as your account exists. After you delete your account, the messages you sent stay, without your name, in the conversation of the other member until they delete their account.
• Sign-in: app sessions 30 days or until you sign out; website sign-in cookies up to 14 days.
• Codes we email you: 10 minutes.
• The digests used to count artwork views: one hour. The counts themselves are not personal data.
• Abuse-limit counters: the length of their time window, at most one day.
• The Instagram connection: until you disconnect it or delete your account.
• Reports, notices, moderation decisions, statements of reasons and complaints: 12 months after the report or the decision is closed, which keeps them longer than the six months in which a decision can be challenged. After an account is deleted they are kept for that time without the link to the account.
• Contact form messages and emails you send us: 12 months after the conversation ends.
• Server logs: 30 days.
• Error reports: 90 days.
• Security and fraud records: as long as the investigation needs, and at most 12 months, unless they are needed for legal claims.
• Backups: copies of the database and files are overwritten within 30 days. If we ever restore a backup, we apply again the deletions made since it was taken.
• Records of orders made on the earlier version of the website: seven years, as the Estonian Accounting Act requires.

We may keep data longer only where the law requires it, or for as long as it is needed to establish, exercise or defend a legal claim.

8. Deleting your account and your data

You can delete your Leona Creo account, and the data linked to it, yourself, at any time:

• In the app: open Profile, then Settings, then Delete account.
• On the website: sign in, open My account, Account details, and use the Delete account section at the bottom of the page.

To confirm, tick the box and enter the code we email to your account’s address. Your account is then deleted at once, and you are signed out everywhere. If a deletion cannot finish at once, we complete it within 30 days and email you when it is done.

What is deleted: your account and profile, your artworks with their photos and videos, every file you uploaded, your comments and reviews (with the replies to them), your follows, applause, saved artworks and blocks, your notifications, your sessions, your links to Google, Apple and Facebook, and your Instagram connection.

What is kept, and for how long:

• messages you sent stay in the other member’s conversation, without your name, so that they keep their own conversation;
• reports you filed, or that were filed about you, and the moderation records about them stay with our moderators for 12 months after they are closed, without the link to your account;
• records of past orders, for the seven years accounting law requires;
• backups and logs, until they are overwritten or expire (within 30 days).

If you cannot sign in, write to [email protected] from your account’s email address and ask us to delete your account. We will confirm that the account is yours before deleting it, and answer within one month.

Removing a sign-in provider or Instagram

• Facebook: on the website, open Account details, go to Sign-in methods and choose Unlink next to Facebook (you confirm with your current password). We then ask Facebook to end its access to your account. You can also remove Leona Creo in Facebook, under Settings and privacy, Apps and websites. Deleting your Leona Creo account removes the link too.
• Google and Apple: choose Unlink next to the provider in the same Sign-in methods section. You can also remove Leona Creo from the apps connected to your Google account or your Apple Account. When you delete your account, we also ask Apple to revoke Sign in with Apple.
• Instagram (artists): disconnect it on your account’s Import page, or remove Leona Creo in Instagram’s settings, under Apps and websites. When Instagram tells us you removed it or asked for your data to be deleted, we delete the connection data we received from Instagram. Artworks you already imported stay yours until you delete them.

You can also delete single artworks, comments or reviews, or change your profile, at any time without deleting your account.

9. Your rights

Under Articles 15 to 22 of the GDPR you have the right to:

• access your personal data and get a copy of it (Article 15);
• have inaccurate data corrected (Article 16); most of it you can change yourself in your account;
• have your data erased (Article 17);
• restrict how we process your data (Article 18);
• receive the data you gave us in a structured, machine-readable format and have it sent to another service (portability, Article 20);
• object at any time, on grounds relating to your situation, to processing based on our legitimate interests (Article 21); we then stop unless we have compelling legitimate grounds or need the data for a legal claim;
• withdraw a consent you gave, at any time, as easily as you gave it (on the website, with “Cookie settings” in the footer of every page), without affecting what was done before;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (Article 22; see Automated decisions).

To exercise a right, write to [email protected]. It is free. We answer within one month, which we may extend by two more months for complex requests, telling you why. We may ask you to confirm that the request comes from you.

You also have the right to lodge a complaint with a data protection authority: in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee, or the authority of the EU country where you live, work or where you believe the infringement happened.

10. Automated decisions

We make no decision based solely on automated processing, including profiling, that has legal or similarly significant effects on you. Automatic filters may hold back or refuse a comment that contains listed words or too many links, or that looks like spam; every artwork, every review and every report is decided by a person, and you can ask a person to review any decision about your content (see the Terms and Conditions).

11. Children

You must be at least 16 years old to create a Leona Creo account. If you are under 18, you also need the permission of a parent or guardian where the law of your country requires it. We do not knowingly collect personal data of anyone under 16. If we learn that an account belongs to someone under 16, we delete it and its data. If you believe a child has given us personal data, write to [email protected].

12. Security

Every connection to Leona Creo is encrypted (HTTPS). Passwords are stored only as secure hashes, provider and Instagram tokens are kept on the server and encrypted where they are stored, and only the people who run Leona Creo can reach its servers. No system is perfectly secure; if a personal data breach is likely to put you at risk, we will tell the Data Protection Inspectorate within 72 hours and tell you without undue delay, as the GDPR requires.

13. Changes to this policy

We may update this policy when Leona Creo changes or the law requires it. The date at the top shows the current version. If a change is significant, we will tell you by email or in the app before it applies. When a change needs your consent, we will ask for it.

14. Contact

Leona Creo OÜ, Sakala tn 7-2, Tallinn 10141, Estonia. Email: [email protected].