Privacy Notice

1. Who we are and the scope of this notice

GenMoMA (“GenMoMA”, “we”, “us”) operates a platform for virtual galleries, timed exhibitions, ticket sales, private invitations, and creator payouts. Our contact address is British Columbia, Canada.

This notice applies to visitors, ticket buyers, gallery creators, curators, and people who contact us. It does not replace the privacy notices of independent gallery creators or third-party services that act as separate controllers.

2. Information we collect

• Account and profile information, including name, email address, authentication identifiers, preferences, and account status.
• Creator and gallery information, including gallery profiles, exhibition schedules, artworks, descriptions, uploads, invitations, and collaborators.
• Transaction information, including ticket orders, prices, quantities, visit dates, refunds, payout status, and Stripe identifiers. GenMoMA does not receive or store complete payment-card numbers entered in Stripe Checkout.
• Usage and device information, including IP address, browser type, device information, referring pages, timestamps, security events, and interactions with galleries or artworks.
• Communications, privacy requests, support messages, reports, and other information you choose to provide.
• Information received from service providers such as Stripe, Supabase, hosting, analytics, email, fraud-prevention, and monitoring providers.

3. Why we use personal information

• To create and secure accounts, authenticate users, and provide the requested platform services.
• To publish galleries, operate exhibitions, sell tickets, grant access, process refunds, and facilitate creator payouts.
• To prevent fraud, abuse, infringement, unauthorized access, chargebacks, and violations of our agreements.
• To comply with accounting, tax, payment-network, legal, regulatory, and dispute-resolution obligations.
• To maintain, troubleshoot, measure, and improve the platform.
• To send transactional messages and, only where permitted, marketing communications that users can unsubscribe from.

4. Legal grounds and consent

Depending on location and context, we process information to perform a contract, comply with legal obligations, pursue legitimate interests such as security and service improvement, or with consent. Consent is not bundled with acceptance of the Terms where the law requires a separate choice.

You may withdraw consent for optional processing at any time. Withdrawal does not affect processing already performed lawfully and may not apply to information we must retain for legal, fraud-prevention, or transaction-record obligations.

5. How we disclose information

• Stripe and its affiliates for Checkout, fraud screening, connected-account onboarding, payments, refunds, disputes, and payouts.
• Supabase for authentication, database hosting, and file storage.
• Hosting, analytics, communications, security, support, and monitoring providers acting under contract.
• Gallery creators where necessary to fulfil a ticket, manage an exhibition, answer a visitor request, or address a dispute.
• Professional advisers, regulators, courts, law enforcement, or counterparties where legally required or reasonably necessary.
• A buyer, successor, or adviser in connection with a financing, reorganization, merger, or sale, subject to appropriate safeguards.

6. International transfers

GenMoMA and its providers may process information outside your province, country, the European Economic Area, or the United Kingdom. Those jurisdictions may have different privacy laws and public-authority access rules.

Where required, we use contractual, organizational, and technical safeguards for international transfers and provide information about applicable safeguards on request.

7. Retention

• Account and gallery information: while the account is active and for a reasonable period after closure.
• Orders, refunds, payouts, and financial records: generally seven years, or longer where required by law or an active dispute.
• Security and access logs: generally up to two years unless needed for an investigation.
• Unsuccessful uploads and temporary checkout reservations: deleted or expired on a shorter operational schedule.
• Privacy requests and legal acceptances: retained as necessary to demonstrate compliance and resolve disputes.

8. Security

We use role-based database controls, private storage, time-limited media URLs, encryption in transit, payment tokenization through Stripe, access logging, and other safeguards appropriate to the sensitivity of the information.

No service is completely secure. Users must protect their credentials and notify us promptly of suspected unauthorized access.

9. Your choices and rights

Submit a request through our Privacy Request page. We may verify identity before acting and will respond within the timeframe required by applicable law.

• Request access to, correction of, or a portable copy of eligible personal information.
• Request deletion or restriction where applicable, subject to legal retention and dispute requirements.
• Object to certain processing or withdraw optional consent.
• Unsubscribe from marketing without losing transactional messages.
• Complain to us or an applicable privacy regulator, including the Office of the Information and Privacy Commissioner for British Columbia.

10. Children

The platform is not directed to children under 13, and we do not knowingly collect their personal information. A person who is not old enough to enter a binding agreement in their location must use the platform only with a parent or legal guardian. Creator and payout accounts require legal capacity and may be subject to Stripe age requirements.

11. Changes and contact

We may update this notice and will identify the effective date and version. Material changes will be highlighted or otherwise communicated where required. Contact the privacy lead at privacy@genmoma.com or British Columbia, Canada.