Privacy Policy
Version 1.1 · Last updated 14 September 2026
The short version
- There is no tracking here. No analytics, no advertising, no pixels, no third-party fonts — nothing following you around.
- We ask for one thing: your email address, so you can sign in. That's the whole account.
- Your data lives in the EU — Ireland — and artwork is delivered through a cache that spans the world.
- Nothing is ever sold or shared for anyone else's purposes.
- You can see it, correct it, take it, or have it deleted by sending one email.
The sections below are the full account, including the parts that are less convenient.
1. Who is responsible
visitmy.art is run by Michal Chermak, an individual based in Slovakia. Under the GDPR I am the data controller for the personal data described here. There's no company — it's a personal project.
For anything in this policy, including requests about your data: michalchermak@gmail.com.
2. Two kinds of people
This policy covers both, because what's collected is quite different:
- Artists — people with an account, who build and publish a gallery.
- Visitors — anyone who opens a published gallery. Visitors need no account and give us nothing directly.
3. What we collect from artists
| What | Why |
|---|---|
| Email address | It is your account. Sign-in works by sending a link to it. |
| Sign-in records — when the account was created, when you last signed in | Operating the service, and spotting abuse. |
Your gallery name (slug) — the yourname in visitmy.art/yourname | It's your public address. You choose it. |
| Everything you put in your gallery — its title, your artist name, bio, links, artwork titles, artists, years, descriptions | To build and show the gallery. Some of this is personal data you're deliberately publishing. |
| Files you upload — images, video, audio | They are the gallery. Note that photos can carry embedded metadata such as camera details or location; we don't read it, but we don't strip it either. |
| How much storage you're using | Enforcing the account limit. |
We don't ask for your real name, address, phone number or payment details, because the service doesn't need them and is free.
4. What we collect from visitors
If you're just looking at someone's gallery, you aren't asked for anything and no account is created. Two things still happen, as they do on any website:
- Server and delivery logs. Our hosting provider (Cloudflare) and our backend (Supabase) record technical request data including IP addresses, roughly when the request happened, and what was requested. This is ordinary infrastructure logging, used for security and to keep the service running. We don't build profiles from it and we don't look at it except when investigating a problem or abuse.
- YouTube, but only if you press play. Some galleries contain a video kiosk. If an artist has linked a YouTube video and you choose to start it, the video is loaded from YouTube, and at that point Google receives your IP address and may set its own cookies, under Google's privacy policy rather than ours. Nothing is loaded from YouTube unless you start a video.
- Enquiries, which we pass on but don't keep. Some artworks let you send the artist a message. If you do, your email address and what you wrote are forwarded to that artist as an email, and a copy is sent to you. We store nothing: there is no database record, and the message is never written to a log. Delivery is handled by our email provider (Resend), which retains sent messages on its own systems for a limited period. The artist's address is never shown to you, and yours is given only to the artist you wrote to.
- A spam check, only on that form. Opening the enquiry form loads Cloudflare Turnstile, which looks at browser and device signals to judge whether you're a person rather than a script. It runs only when you open that form — never while you're simply looking at a gallery — and it exists to stop artists' inboxes being flooded. It sets no advertising cookies and doesn't track you across sites.
5. What we don't do
No analytics. No advertising. No tracking pixels or beacons. No third-party fonts. No profiling, no automated decision-making. We never sell your data, and we never share it so that someone else can use it for their own purposes.
Only two things are ever loaded from somewhere else, and both wait for you to act first: a YouTube video, if you press play on a kiosk, and the Cloudflare Turnstile spam check, if you open an artwork's enquiry form. Walk a gallery without doing either and nothing third-party is requested at all.
6. Why we're allowed to use it
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Running your account and showing your gallery | Contract — it's what you signed up for, and we can't do it without this data. |
| Keeping the service secure, preventing abuse, moderating content | Legitimate interests — a service that anyone can publish to has to be able to protect itself and the people using it. |
| Loading a YouTube video you chose to play | Consent — your decision to press play. |
| Responding to legal obligations, such as a valid copyright complaint | Legal obligation. |
7. Who else handles it, and where
We use a small number of providers, each bound to process data only on our instructions:
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, file storage, sign-in, and delivery of sign-in emails | Project hosted in Ireland (EU). Supabase's parent company is in the United States and its staff may access systems for support. |
| Cloudflare | Hosting the website and caching artwork so galleries load quickly | Edge servers worldwide, so cached copies of published artwork may sit on servers outside the EU. |
| Google / YouTube | Only when a visitor plays a video in a gallery | United States. |
Where data reaches a provider outside the EU, that transfer is covered by the standard safeguards in those providers' data processing agreements, including the European Commission's Standard Contractual Clauses.
We may also disclose data if the law genuinely requires it — for example a valid order from a court or authority.
8. Storage in your browser
visitmy.art uses no tracking cookies, and shows no cookie banner because it doesn't need your consent for anything it stores. What we do keep in your browser:
| What | Where | Why |
|---|---|---|
| Your sign-in token | Local storage | Keeps you signed in. Strictly necessary — without it you'd sign in on every page load. Artists only. |
| Your access code | Local storage | While the service is invitation-only, so you aren't asked for it twice. Artists only. |
| Whether you've seen the "press E to examine" hint | Session storage | So the tip isn't repeated at you. Cleared when you close the tab. |
None of these identify you to anyone else, none are sent to third parties, and all can be cleared through your browser's settings at any time.
9. Who can see your gallery
Your gallery is private until you publish it. Before that, only you can see it.
When you publish, it becomes visible at your address to anyone who has it, and search engines may index it. Anything you put in a published gallery — your artist name, bio, links, the work itself — is public by your choice.
Administrator access. As the person running the service, I can see the list of accounts with their email addresses and usage, and I can open a gallery — including an unpublished draft — where that's necessary to investigate a problem, respond to a complaint, or moderate content. I don't browse people's drafts out of curiosity, but you should know the ability exists.
10. How long we keep it
| What | Kept for |
|---|---|
| Your account, gallery and uploads | Until you delete them, or ask us to. |
| Backups containing your data | Up to 90 days, then deleted on a rolling basis. |
| Cached copies of published artwork | Until the cache expires or is purged after you unpublish or delete. |
| Server and delivery logs | According to our providers' own retention periods — short, and measured in days to weeks. |
This means a deletion request is honoured immediately in the live service, and works its way out of backups within 90 days.
11. Your rights
Under the GDPR you can ask to:
- See what personal data we hold about you;
- Correct anything inaccurate — most of it you can edit yourself in the editor;
- Delete your account and everything in it;
- Get a copy in a portable form — your gallery is a structured document and we can export it;
- Restrict or object to how we use it, including anything based on legitimate interests;
- Withdraw consent where consent is the basis — for example, simply don't play embedded videos.
Email michalchermak@gmail.com and we'll respond within 30 days, normally much sooner. There's no charge.
If you think we've handled your data badly, please tell us first — but you have every right to go straight to the Slovak supervisory authority, Úrad na ochranu osobných údajov Slovenskej republiky (dataprotection.gov.sk). If you live elsewhere in the EU, you can complain to your own country's authority instead.
12. Security
Everything is served over HTTPS. Galleries are separated at the database level, so one account cannot read another's private draft. Uploads are written to a per-account area that only that account can write to. Administrative credentials are never present in the browser — the admin tools work through permission-checked functions on the server.
That said: this is a small project run by one person, not a company with a security team. We've taken the precautions we reasonably can, and we can't promise more than that.
13. Children
You must be 18 or older to create a gallery, so the service isn't intended for children and we don't knowingly collect their data. If you believe a child has created an account, tell us and we'll remove it.
14. If you publish other people's personal data
If you're an artist and your gallery includes personal data about someone else — a recognisable person in a photograph, someone named in a description — then that's your responsibility, not ours. Make sure you have the right to publish it. If someone asks us to remove such material, we'll contact you about it.
15. Changes to this policy
If this policy changes in a way that materially affects you, we'll tell you by email or in the editor before it takes effect. The version and date at the top show when it last changed.
16. Contact
Anything at all about your data: michalchermak@gmail.com.