Privacy Policy

This policy covers the Artisorto website and its subdomains. When you use the platform we collect, process and use your personal data in accordance with Taiwan's Personal Data Protection Act. If you do not agree with this policy, please stop using the service.

Depending on which features you use, we may collect:

• Account data: email address, display name and avatar. If you sign in with Google, that basic profile comes from Google. We never receive your Google password.
• Content you provide: artwork images, project descriptions, commission form entries, chat messages, attachments and reports.
• Commission and transaction data: request details, quotation and order status, schedules, and the conversation between both parties. We do not handle payments, so we never receive your card number or banking credentials; if you share a payment account in chat, it is stored along with that message.
• Technical and connection data: IP address, country or region, browser information (User-Agent), device identifiers, referring domain (which site you arrived from — the domain only, never the full URL), sign-in times and action timestamps.

• To provide registration, sign-in and identity verification
• To provide commission matching, quotations, order tracking and in-platform messaging
• To send notifications about your account and commission status by email and push
• To keep the service secure: blocking bots, rate limiting requests, detecting unusual sign-ins
• To handle reports, disputes and fraud investigations, and to comply with formal requests from the authorities
• To understand how the service is used so we can improve it (in aggregated, de-identified form)

We use cookies and browser storage for the following. You can refuse them in your browser settings, but some features will stop working:

• Sign-in session (necessary): keeps you signed in, valid for 30 days
• Preferences (necessary): language, light/dark theme
• Traffic statistics: we use Vercel Analytics for page view counts. It does not use cross-site tracking cookies and does not build advertising profiles
• On-site traffic and conversion statistics: we store a marker in your browser’s sessionStorage so a single visit is not counted twice. The statistics themselves are kept only as daily counts per step and per referring source — no visitor identifier, IP address or timestamp is recorded

We do not sell your personal data. We share it only in these cases:

• With the other party to a transaction: when you submit a commission request, your name, contact email and request details go to that creator. The creator also sees the country or region of the submission, but never your IP address.
• With service providers: the cloud and communication vendors needed to operate the platform (see below), processing data only as far as providing the service requires.
• Where the law requires: when served with a formal request from the police, prosecutors or a court, or where legislation otherwise requires it.

In fraud cases the data we may disclose includes the registered email, account identifier, and the IP address and timestamp recorded when the commission request was submitted. See the fraud prevention notice for details.

We use the following vendors to process parts of your data. Their servers may be located outside Taiwan; by using the service you understand and agree to this international transfer:

• Account data: until the account is deleted
• Commission requests, quotations and orders: until the record is deleted. When a creator "removes" a request it is hidden rather than destroyed, so the record remains available for dispute or law-enforcement investigation
• Submission IP, country/region and browser information: the same lifetime as the commission request they belong to
• Sign-in session records: expire when the session ends or you sign out
• Rate-limiting records: held briefly in cache and cleared automatically on expiry

Under Article 3 of Taiwan's Personal Data Protection Act, you have the following rights over the personal data we hold:

• To enquire about and review it
• To request a copy
• To request supplementation or correction
• To request that we stop collecting, processing or using it
• To request deletion
• To opt out of marketing messages

How to exercise them: most account data can be changed yourself on the Profile page. For anything else, email support@artisorto.com and we will act on it once we have verified your identity. Note that where data relates to an ongoing dispute, a fraud investigation, or a statutory retention period, we may be unable to delete it immediately — we will explain why.

This service is not for anyone under 16. If we learn that an account holder is under 16, we will disable the account and delete the associated data. If you are a guardian and find that a minor is using the service without your consent, please contact us.

• Traffic is encrypted with HTTPS
• Sign-in credentials are stored in HttpOnly cookies that page scripts cannot read
• Sensitive fields such as the submission IP are excluded at the database query layer, so they are never returned to creators or other users
• We cannot guarantee absolute security; if a breach affects your rights, we will notify you as the law requires

When this policy changes we update the date at the top of this page. For significant changes we will also notify you in-platform or by email. Continued use after a change means you accept it.

For questions about this policy, or to exercise the rights above, email support@artisorto.com.