Privacy Policy

Last updated: 21 October 2026

ToBuyFrom connects artists, venues and collectors so art can be shown and sold in real spaces. This page explains what personal information we hold, why, who we share it with and what you can ask us to do. Questions: hello@tobuyfrom.co.uk.

1. What we collect

• Your account: email address, name, and anything you add to your profile (location, bio, photo, website, Instagram).
• Artists: your artworks, and the seller details buyers must see: legal seller name, whether you sell as an individual or business, and your VAT status.
• Venues: venue name, type, address, description and photos.
• Buyers: for each order, your name, delivery address and email, and the order's delivery and refund status. If you buy without an account, we create one for the email you checked out with so you can follow your order.
• Activity: artworks you like, art walls you build, displays you arrange, and notifications we send you. We count how often artworks are viewed.
• Payments and payouts: card details go straight to Stripe and never reach us. For payouts, Stripe collects identity and bank details; we keep only your Stripe account reference and its status.

2. What is public

Artist and venue profiles, artworks, published art walls and the number of likes an artwork has are public. A venue's address is shown so visitors can find the art. Who liked an artwork is not public.

3. Why we use it

• To run the service you signed up for: your account, displays, orders, delivery and payouts.
• To meet legal duties, such as keeping sales and tax records.
• To keep the service safe, for example security checks on sign-in forms and preventing fraud.
• To send emails about your orders and account. We don't send marketing without your consent.

4. Who we share it with

• The artist or venue sending your order sees your name and delivery address so they can send or hand over the artwork.
• Stripe: payments, refunds and payouts.
• Supabase: our database, sign-in and server code.
• Resend: sends our order emails.
• Cloudflare: stores images and backups, and runs the security check on sign-in forms.
• Google: only if you choose to sign in with Google.
• postcodes.io: looks up an address when you type a postcode into an address form.

Some of these providers handle data outside the UK, with the safeguards UK data protection law requires. We don't sell your personal information.

5. How long we keep it

We keep your account until you ask us to delete it. Records of sales are kept for six years, because tax law requires it; if you delete your account, your name and address are removed from them. Database backups are kept for a limited time and then deleted.

6. Your browser

Your browser stores your sign-in session and, if you arrived through a venue's QR label or link, which venue referred you, so the venue is credited if you buy. We don't use advertising trackers.

7. Your rights

You can ask for a copy of your information, ask us to correct it or delete it, and object to how we use it. To make a request, email hello@tobuyfrom.co.uk. We reply within one month. If you're unhappy with how we handle your information, you can complain to the Information Commissioner's Office at ico.org.uk.