ARZHANG PRIVACY POLICY Version V10 Effective date: 5 October 2026
1. WHO IS THE DATA CONTROLLER ARZHANG is operated from Denmark by Basaamad Co, CVR 36612266 (Danish personally owned small business / PMV), operating ARZHANG (the “Operator”, “ARZHANG”, “we”, “us” or “our”), which is the controller of personal data processed for the ARZHANG Service unless stated otherwise.
Physical address: Ståbyvej 22, 2740 Skovlunde, Denmark Privacy/support email: support@arzhang.art Website: https://arzhang.art
Data controller/operator: Basaamad Co. CVR: 36612266. Legal form: Personligt ejet Mindre Virksomhed (PMV).
2. SCOPE This Privacy Policy applies to the ARZHANG mobile applications, arzhang.art, go.arzhang.art, account and support flows, artist/Place/venue/exhibition functionality, purchase-request coordination, private purchase conversations and general artist direct messaging, reviews, QR services, notifications, moderation and related ARZHANG services (together, the “Service”).
This Policy does not govern independent processing carried out by Apple, Google, artists, buyers, venues, payment providers, shipping providers or other third parties under their own privacy notices.
3. PERSONAL DATA WE PROCESS Depending on how you use ARZHANG, we may process the following categories.
A. Account and authentication data - email address; - account/user identifiers; - display name; - email-verification status; - authentication/session information and security metadata; - account status, locale, time zone and country; - selected account/profile roles such as buyer, artist or venue member; - legal-document acceptance records; - local device session/configuration data necessary to keep you signed in or preserve app settings.
B. Artist, artwork, venue and exhibition content - artist name, biography, artist statement, career stage and professional preferences; - artwork titles, descriptions, medium, dimensions, year, price, availability and related listing information; - images and other media that you choose to upload; - Place/venue and organisation information, display areas/spaces and exhibition details; - public website, public email address and public phone number that a Place owner chooses to publish; - public location information selected for artist/artwork discovery and venue/exhibition addresses where provided; - moderation status, moderation feedback, publication status and revision history.
Much of this information is intended to become public when you choose to publish a profile, artwork, venue, exhibition or review.
C. Location data If you choose location-based features, ARZHANG may process device coordinates, city/country selections, saved locations, geocoding results and location precision settings. Device coordinates may be used to determine or coarsen an approximate public location. Precise device coordinates are used only when needed for a location-based feature and are not intentionally published as an artist's precise public location.
Artist discovery locations may be displayed approximately or at city level depending on settings and product rules. Venue/exhibition addresses may be more precise because physical attendance requires a usable venue location.
You can decline device-location permission and use manual location entry where supported. ARZHANG is not an emergency or navigation service.
D. Selected device media When you choose to upload an artwork or profile image, ARZHANG processes the image or media file you select and associated technical metadata needed to upload, resize, optimise, display and moderate it. Access to photos/media is requested through system pickers or permissions where applicable. ARZHANG does not need access to unrelated media that you do not select for an ARZHANG feature.
E. Purchase-request and transaction-coordination data - artwork and user identifiers linked to a purchase request; - request status and status history; - reservation, payment-arranged and completion coordination states; - buyer messages submitted with a purchase request; - private purchase-conversation messages exchanged between the buyer and artist after reservation, including message content, sender/recipient identifiers and timestamps; - purchase-chat read state and limited messaging metadata needed to operate the conversation; - completion confirmations and review eligibility; - limited records needed to prevent abuse, handle disputes and demonstrate workflow history.
ARZHANG does not process or store payment-card details, bank-login credentials or the user-to-user purchase price as a payment processor. Payment and the binding sale agreement take place outside ARZHANG between the users.
Purchase conversations are private to the participating buyer and artist in ordinary use, but message content and related metadata are stored and processed by ARZHANG and its service providers to provide, secure and support the feature. ARZHANG does not represent purchase conversations as end-to-end encrypted. ARZHANG does not provide a general-purpose administrator inbox for browsing private purchase conversations. Access may occur where reasonably necessary for security, troubleshooting, legal obligations, or when a message is reported for safety or Terms enforcement.
If a purchase-conversation message is reported, ARZHANG may process and review the reported message, the report reason/details and a limited snapshot of the message as reasonably necessary for safety, moderation, fraud/abuse prevention, Terms enforcement, legal claims or legal obligations. Users may voluntarily type contact, pickup/delivery or payment-arrangement details in a purchase conversation, but should not send full payment-card details, banking passwords, one-time authentication codes, crypto seed phrases, government identifiers, medical information or other unnecessary sensitive credentials. - versioned purchase-safety acknowledgement records, including the purchase request, workflow stage, user/role, notice version and acceptance timestamp; - purchase-related cancellation, problem, safety or support information that a user chooses to submit.
These records document ARZHANG workflow actions and user statements. They do not establish that an off-platform payment, delivery, inspection, refund or other event actually occurred. ARZHANG does not routinely collect receipts, card details, bank-login credentials or shipping evidence as part of the purchase workflow. If a user voluntarily provides transaction-related evidence to support, ARZHANG may process it only as reasonably necessary for safety, Terms enforcement, fraud/abuse prevention, legal claims or legal obligations; this does not make ARZHANG a payment processor or transaction arbitrator.
General artist direct messaging ARZHANG may also provide private direct conversations that a user can start from an eligible public Artist profile. For this feature we may process thread and participant identifiers, message text, sender and recipient identifiers, timestamps, read state, unread counts, limited delivery/notification metadata, the Artist's direct-messaging preference, and safety/report records connected with a message.
An Artist can turn general direct messaging off. When it is off, new direct conversations cannot be started and existing general direct conversations may become read-only until the Artist turns the feature back on, subject to blocking, account status and other safety controls. Existing message history may remain available in the Service in accordance with this Policy.
General direct messages are private to the participating accounts in ordinary use, but message content and related metadata are stored and processed by ARZHANG and its service providers to provide, secure and support the feature. ARZHANG does not represent general direct messages as end-to-end encrypted and does not provide a general-purpose administrator inbox for browsing private conversations. Access may occur where reasonably necessary for security, troubleshooting, legal obligations, Terms enforcement, or when a message is reported for safety or moderation.
If a general direct message is reported, ARZHANG may process and review the reported message, report reason/details and a limited snapshot of the message as reasonably necessary for safety, moderation, fraud/abuse prevention, Terms enforcement, legal claims or legal obligations. Users may voluntarily type contact or other personal information in a direct conversation, but should not send full payment-card details, banking passwords, one-time authentication codes, crypto seed phrases, government identifiers, medical information or other unnecessary sensitive credentials.
F. Exhibition and venue coordination data - exhibition applications and their status; - artworks associated with applications/exhibitions; - venue/organisation membership and contact context; - operational messages or metadata required for application handling.
Binding venue/exhibition arrangements and payments take place outside ARZHANG unless expressly stated otherwise.
G. Reviews, saves, reports and interactions - artist reviews, ratings, review text and moderation status; - historical artwork-review records retained for compatibility where they already exist; - artwork favourites/saves; - artwork-detail view events and aggregate artwork view counts used for artist Insights; - user blocks; - content and user reports, moderation appeals and related evidence; - support requests and correspondence; - QR code creation/deactivation and QR scan events where collected.
H. Notifications and communications - push-notification device identifiers/tokens; - OneSignal subscription identifiers and the ARZHANG account identifier used for push routing when push is enabled; - device/platform information needed for push delivery; - notification preferences; - notification delivery and interaction records where available; - service emails, verification emails and support correspondence.
I. Technical, security and usage data We may process IP address, device/app information, operating-system/platform information, device or installation identifiers used for service functionality, timestamps, request logs, session events, search/filter requests, AI-search queries, artwork-detail opens, notification opens/interactions, error/security events, authentication events, abuse indicators, rate-limit information and similar technical or app-interaction data needed to operate, secure, troubleshoot and improve the Service.
For artwork-view counting, the ARZHANG app may create a random installation/session identifier and store it locally on the device. When an eligible Artwork Detail page is opened, the app may send that identifier and the artwork identifier to ARZHANG. The view-recording service stores a SHA-256-derived pseudonymous key rather than the raw local identifier in the artwork-view event table, and applies deduplication rules such as one counted view per artwork and pseudonymous viewer key per UTC day. When the viewer is authenticated, the account identity may be used transiently to exclude an artist's own views. Artists receive aggregate view counts only and are not shown viewer identities through the Insights feature.
ARZHANG does not currently use personal data for third-party behavioural advertising and does not currently include a third-party advertising SDK.
4. SOURCES OF PERSONAL DATA We obtain personal data: - directly from you when you create an account, edit a profile, upload media, submit a request, review, report or support message, or change settings; - from your device and operating system when you permit features such as location, push notifications or media selection; - from other ARZHANG users when they interact with you, review you, include you in an exhibition or purchase workflow, or submit a report involving your content or account; - from service providers that return technical, delivery, security or geocoding information; - from public sources where necessary to investigate rights, safety, fraud or legal issues.
If we receive personal data about you from another person, this Policy applies to our processing of that data.
5. WHY WE PROCESS PERSONAL DATA AND OUR LEGAL BASES We process personal data only where we have a lawful basis under applicable data-protection law.
A. Contract and steps requested before a contract We process account data, profiles, content, purchase requests, private messages, exhibition applications, favourites, QR codes, reviews, account settings, support information and requested AI-assisted search/tagging functionality as necessary to provide the Service you request and administer your ARZHANG account.
B. Legitimate interests We may process data where necessary for legitimate interests such as service security, fraud and abuse prevention, content moderation, illegal-content handling, enforcement of Terms, protection of users and intellectual-property rights, maintenance of auditability, documenting versioned safety acknowledgements and transaction-workflow history, troubleshooting, reliability improvement, first-party service analytics and aggregate artist engagement insights (including deduplicated artwork-detail view counts), handling platform/safety reports, account integrity and prevention of duplicate or manipulated reviews, provided those interests are not overridden by your rights and interests.
C. Consent Where consent is required, we rely on consent for optional device permissions such as precise device location, optional push permissions, and future marketing or non-essential tracking. You may withdraw consent through device/app settings or by contacting us, without affecting prior lawful processing.
D. Legal obligations We may process and retain information where necessary to comply with legal obligations, regulatory requests, court orders, tax/accounting requirements that apply to ARZHANG, data-protection obligations, illegal-content handling duties, consumer-protection duties or law-enforcement requirements.
E. Legal claims We may retain or use relevant information where necessary to establish, exercise or defend legal claims.
6. REQUIRED AND OPTIONAL DATA Some data is required to provide a feature. For example, an email address is required to create and secure an account; listing information is required to publish an artwork; and certain identifiers/status records are required to operate purchase, moderation or exhibition workflows.
Other data and permissions are optional, including device-location access, optional push permission and information you choose to add to public profiles beyond required fields. If you do not provide required information, the relevant feature may not be available. Refusing an optional permission will not prevent access to unrelated core features, although the specific optional feature may work differently or require manual input.
7. PUBLIC DATA AND VISIBILITY Published artist profiles, artwork listings, Place/venue/exhibition pages, selected public locations, approved reviews and related media may be visible to guests and other users and may be accessible through ARZHANG public web/deep-link pages.
Where a Place owner chooses to publish contact details, its public website, email address and phone number may also be visible to guests and other users.
Do not publish personal information that you do not want to make public. In particular, artists should avoid publishing home addresses, personal financial information or private contact information in public profile text or images. ARZHANG may automatically block, redact, reject or moderate certain direct-contact or sensitive information in public content as a safety measure.
Making content private, unpublishing it or deleting an account may not remove copies that another person previously saved, printed, screenshotted or lawfully obtained outside ARZHANG.
8. SHARING WITH OTHER USERS ARZHANG shares personal data with other users only as needed for the features you use. Examples include public profile/listing information, artist reviews, venue/exhibition information, private purchase-conversation messages, general artist direct messages, and contact, delivery or other information that a user voluntarily sends to another user through a private conversation. ARZHANG does not automatically expose a buyer's or artist's private phone number or email address through the current purchase workflow or general direct-messaging feature.
Buyers, artists and venues that receive personal data from another user for an off-platform transaction or exhibition may become independently responsible for how they use that information. ARZHANG does not control their independent processing outside the Service.
9. SERVICE PROVIDERS AND OTHER RECIPIENTS We use service providers to operate ARZHANG. Depending on current configuration, these include:
- Supabase for authentication, database, server functions and file/media storage; - OneSignal for push-notification orchestration, delivery status and related device/subscription-identifier processing. When service push is enabled, ARZHANG may provide a pseudonymous ARZHANG account identifier (external ID) and OneSignal subscription identifier for routing. ARZHANG's current mobile configuration disables sharing device location with OneSignal; - Apple Push Notification service and Google/Firebase push infrastructure as applicable to route mobile notifications through the operating-system platform; - Resend for transactional email delivery; - Geoapify for forward and reverse geocoding when location lookup is used; - Vercel for hosting ARZHANG public/admin web services and related request/security logging; - OpenAI for AI-assisted artwork search, semantic embeddings and optional Smart Tag/short-description suggestions. Depending on the feature, ARZHANG may send search text, coarse country/currency context used to interpret a search, artwork descriptive text, or an artwork image to OpenAI for processing. ARZHANG does not intentionally include account passwords, payment-card details, banking credentials or precise device coordinates in these AI requests; - Apple and Google for app distribution, operating-system services, store review, platform security and other functionality provided by their ecosystems.
We may also disclose data to professional advisers, insurers, authorities, courts or law-enforcement bodies where legally required or reasonably necessary to establish, exercise or defend legal claims.
Processors acting on our behalf are required to process personal data under appropriate contractual, confidentiality and security obligations. Where Apple App Store rules apply, we require third parties acting on our behalf to provide the same or equivalent level of protection for user data that ARZHANG promises in this Policy and that applicable rules require.
Some providers, including Apple and Google, may also process certain data as independent controllers under their own privacy policies.
Our provider list and technical architecture may change as the Service evolves. We will update this Policy where a change materially affects your privacy.
10. INTERNATIONAL DATA TRANSFERS ARZHANG’s primary backend is currently configured in the European Union/European Economic Area where available. Some service providers or their subprocessors may process personal data outside the EEA.
Where personal data is transferred to a country without an applicable European Commission adequacy decision, we use or require an appropriate transfer mechanism where legally required, such as Standard Contractual Clauses and supplementary safeguards. Where applicable, a valid adequacy framework such as the EU-U.S. Data Privacy Framework may also be relied upon for a certified recipient.
You may contact us for more information about the transfer safeguards applicable to your data, subject to protection of confidential security and contractual information.
11. DEVICE PERMISSIONS ARZHANG may request operating-system permissions only when needed for a feature. Depending on your device and use, these may include: - location permission for nearby discovery or location setup; - notification permission for push notifications; - photo/media access or a system media picker for user-selected uploads.
You can change permissions in your device settings. Where a meaningful alternative is available, ARZHANG aims to offer manual input or another method rather than requiring an unrelated permission.
12. PUSH NOTIFICATIONS, SERVICE EMAIL AND MARKETING You can control optional push permissions through your device and notification preferences through the Service where available.
Service push notifications may contain limited purchase-request, messaging, exhibition, moderation or account context and deep-link identifiers so that tapping a notification can open the relevant ARZHANG screen. For purchase-chat and general direct-message notifications, ARZHANG's current design indicates that a new message is available and links to the relevant conversation without including the private message body in the push-notification text.
Some service communications, such as security, verification, account, legal, purchase-request, exhibition, moderation or deletion notices, may be necessary to operate your account and may be sent where permitted even if optional promotional notifications are disabled.
ARZHANG does not currently send third-party behavioural advertising. If marketing communications are introduced, ARZHANG will send them only where a lawful basis exists and will provide consent/opt-out controls required by data-protection and electronic-marketing law. Marketing consent can be withdrawn without affecting service messages that remain necessary for your account.
13. COOKIES, WEB STORAGE, LOGS AND SIMILAR TECHNOLOGIES ARZHANG’s websites may process essential request logs, security information, session data and strictly necessary storage needed to provide pages, protect the Service and maintain authenticated sessions where applicable.
The mobile application may also use local storage for strictly functional or first-party service purposes, including a random identifier used to deduplicate artwork-detail view counts as described above. This identifier is not used by ARZHANG for third-party behavioural advertising.
If ARZHANG later introduces non-essential analytics, advertising cookies or similar tracking that requires consent, an appropriate consent mechanism and updated disclosure will be provided before such use.
14. QR CODES AND SCAN EVENTS ARZHANG may create opaque QR identifiers linked to public entities. When QR codes are scanned or resolved, ARZHANG may process the code, timestamp and limited technical/request information for routing, security, reliability and aggregate usage measurement.
QR scan information is not intended to reveal the identity of a passer-by unless that person is otherwise authenticated, provides information through the Service, or identification is necessary for security or legal reasons.
15. MODERATION, TRUSTED AUTO-APPROVAL AND AUTOMATED PROCESSING ARZHANG uses moderation states, validation rules, user reports and technical controls to decide whether content can be published, must be reviewed, should be restricted or should be removed.
Some trusted artist accounts may be given an internal auto-approval setting by an authorised administrator. For those accounts, artist-profile or artwork submissions or revisions may be published automatically after technical validation without prior human review. The setting is not public, does not certify the user or artwork, and may be removed at any time. Published content remains subject to later moderation and reports.
Other automated rules may flag, hide, reject or prevent content or activity. Significant moderation actions may also involve human review or an appeal process where appropriate.
ARZHANG also uses AI-assisted tools to interpret artwork-search queries, generate semantic embeddings, and optionally suggest artwork tags or a draft short description. These outputs support discovery or user editing; they are not intended to determine legal rights, account eligibility or similarly significant outcomes. Artists can review whether to use optional Smart Tag or description suggestions.
ARZHANG does not currently make decisions based solely on automated processing that produce legal effects or similarly significant effects on a user within the meaning of Article 22 GDPR. If that changes, this Policy will be updated and applicable safeguards will be provided.
16. SPECIAL-CATEGORY DATA AND DATA ABOUT OTHER PEOPLE ARZHANG does not intentionally require health information, biometric identification data, political opinions, religious beliefs, sexual-orientation data or other special-category personal data for ordinary use of the Service. Do not upload such information unless it is genuinely necessary, lawful and specifically requested through an appropriate process.
Do not upload unnecessary personal data about other people. If an artwork image, biography, exhibition listing, review, report or other content identifies another person, you are responsible for having a lawful basis and any permissions required to provide or publish that information.
Do not submit banking passwords, one-time authentication codes, full card details, crypto seed phrases, government identifiers or medical information through public content or ordinary support fields unless specifically requested through a secure lawful process.
17. CHILDREN ARZHANG account-based, transactional and professional features are intended for adults aged 18 and over. ARZHANG does not knowingly offer accounts for children.
If we learn that a child has provided personal data contrary to this Policy or our Terms, we may restrict the account and take steps to delete the data where appropriate. Contact us if you believe this has occurred.
18. RETENTION We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, taking account of the type of data, account status, user requests, security needs, limitation periods, legal obligations and the need to establish or defend claims.
In general: - active account/profile data is retained while the account is active and as needed to provide the Service; - public content is retained while published and until removed, deleted or anonymised under applicable product/legal rules; - temporary authentication, verification and security data is retained only for the period reasonably required for authentication, fraud prevention and troubleshooting; - purchase-request, purchase-conversation, general direct-message, versioned purchase-safety acknowledgement, moderation, consent/legal-acceptance, security and audit records may be retained after account deletion where necessary to prevent fraud, document compliance, handle safety/platform reports, establish or defend legal claims, protect other users or meet legal obligations; - private-message content and messaging state may be retained for service continuity, safety, dispute context and legal claims. Purchase-conversation content may be retained with the relevant purchase record; general direct-message history may be retained with the relevant conversation. The period during which users can send new messages is separate from the retention period, and reported-message evidence may be retained for the purposes described above; - artwork-view events may be retained for as long as reasonably necessary to provide aggregate artist Insights, measure service use, prevent manipulation and troubleshoot the feature; ARZHANG may later aggregate, anonymise or delete those events when detailed pseudonymous records are no longer needed; - records required by tax, accounting or other mandatory law may be retained for the applicable statutory period; - deleted data may remain temporarily in backups or disaster-recovery systems until those copies are overwritten in the normal backup cycle and are not ordinarily restored except for recovery purposes; - where continued identification is no longer necessary, ARZHANG may irreversibly anonymise records rather than retain identifiable personal data.
19. ACCOUNT AND DATA DELETION ARZHANG provides an in-app account deletion path and an external web deletion request at https://arzhang.art/delete-account. For safety, fraud prevention and continuity of active user-to-user workflows, immediate self-service account deletion may be temporarily unavailable while the account is involved in an unresolved purchase request or purchase-resolution flow, an active exhibition application, or an active exhibition managed by the account. The Service will require those active workflows to be closed, resolved, withdrawn, completed or cancelled before immediate self-service deletion can proceed. This does not remove your right to make a privacy or erasure request through ARZHANG support; such requests are assessed under applicable data-protection law, including any lawful need to retain or restrict particular records.
You may also request deletion of particular personal data without closing the entire account where applicable, for example through a privacy/support request, subject to lawful retention and to data that is necessary to keep an active feature or account functioning.
When an account is deleted, ARZHANG deletes or irreversibly anonymises associated personal data that is no longer necessary, subject only to lawful exceptions such as fraud/abuse prevention, legal claims, required records, moderation integrity, protection of other users and legal obligations. For private messaging, message content sent by the deleted account is removed or anonymised from the live conversation where applicable, including purchase conversations and general direct-message threads. If a message was reported before deletion, limited report evidence such as a message snapshot may be retained where reasonably necessary for safety, Terms enforcement, fraud/abuse prevention, legal claims or legal obligations.
Public user-generated content associated with the account, including uploaded media and reviews, is deleted or irreversibly anonymised where it is no longer necessary to retain it. If a legal obligation requires preservation of a particular record, ARZHANG will retain only what is necessary and, where possible, separate or remove identifying information that is not required.
Deletion is intended to be permanent and is not the same as account suspension or freezing. Some off-platform copies created by other people, lawful records held independently by counterparties, and data in temporary backup cycles may remain outside the live Service.
20. YOUR DATA-PROTECTION RIGHTS Subject to applicable law and exceptions, you may have the right to: - obtain access to your personal data; - correct inaccurate data; - request erasure; - request restriction of processing; - object to processing based on legitimate interests; - object to direct marketing at any time if marketing is introduced; - receive certain data in a portable format; - withdraw consent where processing is based on consent; and - complain to a supervisory authority.
You may use available account settings, the account deletion flow, data-export tools where provided, or contact the address in Section 1.
We may request information reasonably necessary to verify your identity before acting on a rights request. We will respond within the period required by applicable law, subject to lawful extensions or exceptions.
If ARZHANG is established in Denmark, the relevant supervisory authority is Datatilsynet (the Danish Data Protection Agency). You may also have the right to contact the supervisory authority in your EEA country of habitual residence, place of work or place of the alleged infringement.
21. SECURITY AND PERSONAL-DATA INCIDENTS ARZHANG uses technical and organisational measures intended to protect personal data, including authenticated access controls, database policies, private media storage with time-limited access links where appropriate, encryption in transit, role-based administrative access, moderation/audit controls and credential/secrets separation. Private purchase conversations and general direct-message threads use authenticated participant access controls and encryption in transit, but ARZHANG does not represent either messaging feature as end-to-end encrypted.
No method of storage or transmission is completely secure. You are responsible for keeping account credentials confidential and for using secure payment and communication methods outside ARZHANG.
If ARZHANG becomes aware of a personal-data breach, we will assess it and notify the competent supervisory authority and affected individuals where required by applicable law.
22. SALE OF PERSONAL DATA, ADVERTISING AND TRACKING ARZHANG does not sell personal data.
ARZHANG does not currently use personal data for third-party behavioural advertising, cross-context behavioural advertising or advertising based on sensitive personal data. ARZHANG does not currently require App Tracking Transparency permission for an advertising-tracking purpose.
The first-party artwork-view counting, aggregate Insights, search and AI-assisted service functionality described in this Policy are used to provide, secure, measure or improve ARZHANG and are not used by ARZHANG for third-party behavioural advertising.
If the business model or SDK configuration changes in a way that materially affects these statements, this Policy and applicable app-store privacy disclosures will be updated before such processing begins, and consent/opt-out rights will be provided where required.
23. OFF-PLATFORM TRANSACTIONS AND INDEPENDENT CONTROLLERS When ARZHANG connects a buyer with an artist or an artist with a venue, those parties may exchange information outside ARZHANG. Their subsequent emails, payments, shipping records, contracts or other off-platform processing are controlled by those parties and their providers, not by ARZHANG, unless ARZHANG expressly participates in that processing.
Payment providers, carriers, insurers, venues and other independent third parties may require their own personal data and are responsible for providing their own privacy information.
If you send ARZHANG a safety, fraud, abuse or platform-support report about an off-platform transaction, we may process the information you choose to provide to assess the platform issue, enforce these Terms, protect users or establish or defend legal claims. Do not send unnecessary financial credentials, full card details, banking passwords or other sensitive information. ARZHANG support does not become the controller of the counterparty’s independent payment or delivery systems merely because a report is submitted.
24. APP-STORE PRIVACY DISCLOSURES Apple App Store privacy information and Google Play Data Safety disclosures are summaries of ARZHANG’s current app data practices and must be kept consistent with this Policy and the actual SDKs/features in the app. Depending on the feature used, relevant categories can include account identifiers and contact information, location, photos/media, user-generated content including purchase-conversation and general direct-message content, purchase/workflow information, search queries, artwork-detail interactions, AI-assisted feature inputs, and device/installation identifiers.
ARZHANG is responsible for keeping those store disclosures accurate, including data handled by integrated third-party SDKs such as push-notification services. If a store disclosure and this Policy appear inconsistent, contact us so the information can be reviewed and corrected; mandatory law and the actual rights available to you are not reduced by a store label.
25. CHANGES TO THIS POLICY We may update this Privacy Policy to reflect changes in law, the Service, providers, SDKs or data practices. Material changes will be communicated in a reasonable manner.
Where ARZHANG’s legal-acceptance system or applicable law requires renewed acceptance or acknowledgement, account-based use may be paused until the new documents are acknowledged.
A new version applies from its stated effective date. Previous versions may be retained for compliance and audit purposes.
26. CONTACT For privacy questions, rights requests, security concerns or complaints, use the in-app support/data tools where available or contact support@arzhang.art.
END OF PRIVACY POLICY