Privacy notice

Who runs Studio Suite

Studio Suite is where art galleries keep their artists, works, exhibitions and contacts. It is run by Dupree Art.

Each gallery's records belong to the gallery. The gallery decides what goes in them, and Dupree stores them for the gallery and does nothing else with them. Dupree's people cannot see inside any gallery's records. For the logins of gallery staff and of Dupree's own people, Dupree Art is responsible.

What is stored

Your login, if you work at a gallery

Your email address; your password, which is stored only in scrambled form that nobody can read back; which gallery you belong to and whether you are one of its gallery admins; when you joined; when you last signed in; and, from your invitation, the email address of the colleague who invited you (or "Dupree" if Dupree set up your gallery) and the gallery's name.

Each gallery's records

• Artists: name, nationality, year of birth, biography, CV, exhibition history, press, market value and notes.
• Works: title, year, medium, size, edition, stock number, status and price, with a history of every price change and the email address of the person who made it.
• Exhibitions: title, venue, dates, description, and the artists and works in them.
• Contacts: name, organisation, email, phone, address, notes, the categories they are in, and the artists and works they are interested in.
• Images of works, artist portraits and certificates.
• The gallery's own About text and its public email, phone and address.
• For each artist, work, exhibition, contact, contact category and file: when it was added, when it was last changed, and the email address of the person who last added or changed it.

Dupree's own people

Their email address, password (scrambled as above), whether they are a Dupree owner or Dupree staff, when they were added, and, if they were invited, the email address of the person who invited them.

A record of what Dupree's people do

Each time one of Dupree's people onboards, removes or restores a gallery, or invites, changes the level of or removes one of Dupree's people, Studio Suite keeps a record of it: who did it (their email address), what they did, to which gallery (its short web name) or to which of Dupree's people (their email address), when, and whether it worked. Dupree owners can read it. It never holds the email address of anyone at a gallery.

Nothing else

Apart from what is described above, Studio Suite keeps no history of what anyone does in it, and none of what you look at. When something goes wrong, its server functions log the login's and the gallery's internal ids, never an email address or a password. Supabase and Cloudflare keep their own technical logs of requests to run and protect their services.

Where it is kept, and who helps

• Supabase holds the records, the logins and the files, in the EU, in Frankfurt (Germany). Supabase says that some of its supporting services, such as logs, can run outside the region.
• Cloudflare serves the pages of this site. Your gallery's records go directly between your browser and Supabase, not through Cloudflare.
• Resend sends Studio Suite's emails (invitations and links to set a password), from its EU region in Ireland. It sees the address an email goes to and what the email says.

Dupree uses these companies to run Studio Suite, and they act on Dupree's instructions.

What is public

A gallery's own website can show its artists, works and exhibitions by reading Studio Suite's public feed, which anyone can read. Today the feed shows every artist, every exhibition and every work that is not archived, with web-sized images, and the gallery's About text and public email, phone and address. There is no switch yet to keep a single artist or exhibition off the feed.

The feed never shows prices, market values, stock numbers, a work's status, notes, the contact list, certificates or the original image files.

The web-sized images are kept at public addresses that cannot be guessed. Anyone who has an image's address can open it, even after the work is archived or the gallery is removed, until the image is deleted.

Cookies and your browser

Studio Suite sets no cookies. When you sign in, your browser keeps your sign-in in its local storage for this site, so you stay signed in until you sign out. Without it you could not use Studio Suite, so it is strictly necessary and needs no consent banner.

Dupree's own admin screen also remembers, in that browser tab until it is closed, a gallery removal or restore that did not finish.

There are no analytics, no adverts and no tracking, and the pages load nothing from any other site.

How long things are kept

• While a gallery is a customer, its records are kept until the gallery changes or deletes them. A work that has had a price is archived rather than deleted, so its price history stays.
• When Dupree removes a gallery, its staff can no longer sign in and its records and public feed are switched off. Nothing is deleted, so the gallery can be restored.
• Deleting a removed gallery for good is a separate, deliberate step by a Dupree owner. It will delete all of the gallery's records, files and images, and its staff's logins. This step is planned and not built yet, so until it is, a removed gallery's records are kept.
• How long a removed gallery's records are kept before they are deleted for good has not been decided yet.
• When a gallery admin removes a colleague, that colleague's login is deleted straight away. Their email address stays in the gallery's price history, next to the price changes they made, until they ask for it to be erased. It also stays on the records they were the last to add or change, until someone changes them, and on the logins of anyone they invited.
• When a Dupree owner removes one of Dupree's people, that person's login is deleted straight away. The record of what Dupree's people do keeps their email address.
• How long the record of what Dupree's people do is kept has not been decided yet. Until it is, it is kept.

Asking for a copy, a correction or deletion

Email privacy@demoart.online. Dupree will answer within one month.

Placeholder: this address is not a real mailbox yet. Before Studio Suite goes live it will be replaced by Dupree's own address.

About your login

You can ask for a copy of what is stored about your login, for it to be corrected, or for it to be deleted. If you have left a gallery, you can also ask for your email address to be erased from its price history. If you are one of Dupree's people, you can ask for your email address to be erased from the record of what Dupree's people do.

About a gallery's records

• Anyone at the gallery can correct its records in Studio Suite at any time, and delete contacts, exhibitions, images and works that have never had a price.
• A full copy of everything a gallery holds, its records and its files, is planned: Dupree will be able to make one on the gallery's request. It is not built yet.
• Deleting a gallery's records for good happens after Dupree has removed the gallery, as described above. It is planned and not built yet.

If you are an artist or a contact in a gallery's records

The gallery decides what it keeps about you, so ask the gallery first. Dupree's people cannot see inside a gallery's records, but Dupree will pass your request on to the gallery if you write to the address above.

Your rights

You have the right to see the personal data held about you, to have it corrected, to have a copy to take elsewhere, and to have it erased. Where the data is part of a gallery's records, the gallery answers your request, and Dupree helps it.

If you are unhappy with how your data has been handled, you can complain to the Information Commissioner's Office in the UK (ico.org.uk) or to the data protection authority where you live.