Privacy Policy

1.About this policy

This policy explains what we collect when you browse the marketplace, buy a piece, or sell as an artist or artisan, why we collect it, and what control you have over it. It applies to the TAF Marketplace website and to the emails we send you.

If you do not agree with this policy, please stop using the marketplace. Where a specific law gives you stronger rights than this policy describes, that law applies.

2.Information we collect

We collect three kinds of information.

• Information you give us. Your name, email address, password, shipping and billing address, phone number, and the contents of messages you send us. If you apply to sell, we also collect your seller profile, the story and provenance details you write for your work, product photographs, and the identity or business details we need to verify you.
• Information we record as you use the marketplace. As an order moves through fulfillment we keep an audit record of each step: what changed, which account made the change, and when. Administrative access to a seller’s payout details is recorded the same way. The record of what changed is stored encrypted. We use these records to resolve disputes about who did what and to investigate fraud.
• Information from our partners. Our payment processor tells us the reference, amount, currency, and status of each payment. It does not pass us your card number or any part of it. Our shipping partner tells us the carrier and tracking number for a parcel and where it has reached, and our email provider tells us whether a message was accepted for delivery.

3.How we use your information

We never sell your personal information. We use what we collect to:

• Create and secure your account, and verify sellers before their work goes live.
• Process orders, take payment, arrange delivery, and settle seller payouts.
• Send transactional email such as email verification, password resets, order confirmations, and fulfillment updates.
• Answer your questions and resolve disputes between buyers and sellers.
• Detect, investigate, and prevent fraud, abuse, and activity that breaks our Terms of Service.
• Improve the marketplace and decide what to build next.
• Meet our legal, tax, and accounting obligations.

4.Payments

We do not take or store your full card details. Payments are handled by our payment provider, which collects your card or bank information directly and processes it under its own privacy terms and its own security certifications.

We keep a record of the payment reference, the amount, the currency, and the status of each transaction so that we can confirm your order, issue refunds, and settle sellers.

5.When we share information

We share personal information only where it is needed, and only with:

• Sellers, who receive the name, delivery address, and order details needed to fulfill the order you placed with them.
• Buyers, who see the public parts of a seller profile, including the seller name, story, and listings.
• Service providers that host our infrastructure, process payments, deliver email, and carry shipments on our behalf. They may use your information only to provide that service to us.
• The National Gallery of Art and other cultural partners, where a program requires it and only in the form the program needs.
• Regulators, law enforcement, or advisers, where we are legally required to share, or where sharing is necessary to protect our rights, our users, or the public.
• A buyer or successor, if the business is ever merged, acquired, or reorganized. We will tell you before your information becomes subject to a different policy.

6.Cookies and browser storage

TAF Marketplace uses one cookie: the sign-in cookie that keeps you signed in. It is set by our API, is sent only to our API, and cannot be read by scripts on our pages or by other websites. The storefront and the seller app share it, so a seller who signs in to one can open the other without signing in again. It lasts for a fixed period set by the platform, and using the site does not extend it; after that you sign in again.

Signing out from either the storefront or the seller app ends that sign-in for this browser in both apps. Other devices where you are signed in stay signed in. Resetting your password signs you out everywhere, on every device, and you then sign in with the new password.

The site also keeps a small amount of data in your own browser, none of which signs you in: a cart you build before signing in, in local storage; a short-lived marker in session storage that tells us that cart still needs your review; and, while you complete a payment, the order being paid in session storage, so we can show its result when you return from the payment provider. The seller app also saves unfinished listing and seller-application drafts in the browser, so work in progress is not lost. That data stays on your device, is sent to us only as part of a request you make, and is never used to track you across other websites.

Signing out does not empty a cart you built before signing in — that stays in your browser so it is still there when you return. To remove it, empty the cart yourself or clear site data in your browser settings, which deletes everything the site has stored. We do not run third-party advertising or analytics trackers on the marketplace.

7.How long we keep information

We keep your account information for as long as your account is open. After you close it we keep what we need to meet legal, tax, accounting, and dispute-resolution obligations, and then delete or anonymize the rest.

Order and payment records are typically kept for the retention period required by tax and financial regulation. Server logs are kept for a short period and then discarded.

8.Your rights and choices

Depending on where you live, you may have the right to:

• Ask for a copy of the personal information we hold about you.
• Correct information that is wrong or out of date. You can edit most of it yourself in your profile.
• Ask us to delete your account and the information tied to it, subject to the records we must keep by law.
• Object to or restrict certain processing.
• Withdraw consent where we relied on it, without affecting anything done before you withdrew it.
• Know what we will send you. We send transactional email only — email verification, password resets, order confirmations, and fulfillment updates. We do not run a marketing mailing list.

9.How we protect information

We protect accounts with hashed passwords, sign-in sessions that are checked on every request and can be revoked, encrypted connections, and role-based access controls that limit which staff can reach which records. Payment credentials never reach our servers.

No system is perfectly secure. Please use a strong and unique password, keep it private, and tell us straight away if you believe your account has been accessed by someone else.

10.International transfers

TAF Marketplace serves buyers and sellers in different countries, so your information may be stored or processed outside the country you live in. When we move personal information across borders, we do so under contractual protections that require our providers to hold it to the standards described in this policy.

11.Children's privacy

The marketplace is not intended for children under 18, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.

12.Changes to this policy

We update this policy when our practices change or the law requires it. The date at the top of this page shows the current version. If a change materially affects how we use your information, we will tell you by email or through a notice on the site before it takes effect.

13.Contact us

For privacy questions, requests about your information, or complaints about how we handled your data, write to support@tafmarketplace.com. We aim to respond within 30 days.