Privacy
In short: I keep what it takes for a work to find its client and arrive safely. Nothing more, and nothing that is ever sold to anyone.
01What I keep
Your email address and artist name, the works and messages you post, your orders and their meetings, your receipts, and - the day identity checking is switched on - its result. The town you give is used to show nearby works and to say where the artist hands over theirs. If you sell, I also keep the availability you give for handovers: place, town, days and times, and your address if you give it. If you allow the map to locate you, your approximate position is used to centre the map, on your phone only: it is neither sent nor kept, and I do not track you. I do not ask for your national register number: no law requires it of me today, and I do not collect anything just in case. If you sell as a professional, I keep your company number, what the European register of VAT numbers (VIES) says about it - whether it knows it, and under what name -, and your business details: your legal name, your business address, a contact email and a contact phone number. After a handover, both people rate each other: the score and the words the artist writes about you show publicly on your profile, just like the ones you write about them. You can reply publicly underneath, and I do not remove a review because it is bad. If you joined the site’s waiting list, I keep your email address, whether you come as an artist or a client, your town and your language - and, if you arrived through an artist’s link or QR code, that link’s code. And if you arrived through an Arvel link carrying a word that says where you came from - an event, a place, a card, a flyer, a post - I keep that word with your entry on the list: it says which way you came in, never who you are. If an artist brought you to Arvel - you opened their link or QR code in the app, or picked them from the list when you signed up -, I keep which artist, and whether it was through their link or your choice, once. And when someone opens an artist’s link or QR code, I count one more opening for that day: a number, and nothing about the person who opens it goes into that count - no internet address, no device. This link sets no cookie. And when you write a message or report something, I note the internet address you connected from that day: one line per day and per address, never one per action. It is the only thing that lets me find someone hiding behind a throwaway account, and it is used for nothing else. And if one of your messages invites someone to leave Arvel, I keep the excerpt that triggered the flag, nothing more - and it is erased three months after the case is closed. And, from the day identity checking is switched on - it is not yet -, if you want to publish a work, buy, or write to someone: the proof that you are 18. It will happen at my payment provider, who will look at your ID document and ask for a photo of you to check it is the same person. The images will stay with them: I will only receive the result, your legal name, and whether you are of age. Your date of birth itself is never kept by me. If you create your account with Apple, I also keep the token Apple gives me for your account, in a part of the database the app does not read: it only serves to ask Apple to cut the link when you delete your account. If you sign in with Google or Apple, they pass on your email address - with Apple, a relay address if you chose to hide yours -, the identifier of your account with them and, when they give it, your name; Google adds the link to your profile photo. I only use them to sign you in: you find them in the copy of your data, and they leave with your account. If you allow notifications, I keep the token your phone gives me to make it ring, with the type of phone and the sign-in session that registered it. And if you report a problem to me from the app, I keep what you write, the screenshots you attach, the part of the app concerned, and the versions of the app and of your phone’s system: you find them in the copy of your data. If you buy on the spot from an artist with the bank’s QR code, without an account, I keep with the sale the name, the last four digits of the account and the name of the bank, as your bank passes them on to me for this payment; with an artist who sells as a professional, I also keep the email address you gave them to receive your receipt, and I only write to you there about that sale. I keep them for as long as the sale itself.
02Why, and on what legal ground
Every piece of data is kept for a reason, and that reason has a legal name. Your account, your artworks, your orders, your meet-ups and your messages: because I cannot provide the service without them - that is the contract between us. The counters that curb spam, the blocks, the reviews, the moderation decisions and the error reports: because Arvel has to stay liveable and be able to defend itself - that is my legitimate interest, and it never comes before your rights. Receipts and sales history: because the law requires it; what proves them - the claims, the record of the meet-ups and of the handover code - because I must be able to defend myself if a sale is contested: that is my legitimate interest. A sold artwork that stays among its client’s purchases when the artist deletes their account: so that the client keeps a record of what they bought - that is my legitimate interest. Your company number and your business details as a professional seller: because your client must know who they are buying from before they pay (Code of Economic Law, art. VI.45) - that is your obligation as a seller, and the contract between us tasks me with meeting it on your behalf. Checking that number against the European register: so that nobody sells as a professional with someone else’s number - that is my legitimate interest, and it does not come before your rights. The fingerprint of the address of a sanctioned account whose holder deleted it: because I must be able to enforce a sanction - that is my legitimate interest, and it is erased when the sanction ends, after one year at most. The fingerprint of an address I have refused: because I must be able to stop someone I have refused from signing up anyway - that is my legitimate interest, and it is erased the day I lift that refusal. Audience measurement and news emails: only because you said yes - and you can say no at any time, just as easily as you said yes. The detail, processing by processing, is kept up to date in my internal register; write to me if you want to see it. The internet address noted when you write or report: because I must be able to find someone who abuses Arvel, and to answer an authority if it asks me - that is my legitimate interest too, and it does not come before your rights either. The detection of messages that invite someone to leave Arvel, and the count of how many different artists one account approaches: because I must be able to protect artists from being poached - my legitimate interest again, and it does not come before your rights either. The detail of the works you open, kept for ninety days: because I must be able to count the views of a work without counting the same person twice - my legitimate interest too; no one can read that detail, and it does not come before your rights. The artist who brought you, and the openings of each artist’s link: because I must be able to show an artist how many people they bring in, without ever telling them who - my legitimate interest too, and it does not come before your rights. The link code kept with the waiting list: to know which artists bring people in before launch - my legitimate interest; it is shown to no one. The word that says how you reached the waiting list: to know what brings people in before launch - my legitimate interest too; it is shown to no one. The proof that you are 18, from the day it is asked for: because I want no minors on Arvel, and because two people who do not know each other are going to meet in person. An ID document compared with a face is sensitive data under the law: I only ask for it with your explicit consent, which you give by starting the check, and which you can withdraw - you then lose those three actions, not your account. Buying on the spot, with the QR code the artist displays for a work, does not require that proof: the two of you are face to face. The fact that a check found you to be under 18, kept after you withdraw your consent (chapter 4), rests on my legitimate interest: that no minor buys on Arvel.
03What I don’t keep
Neither your card number nor the image of your ID: your card goes only to my payment provider, and your ID will go there only the day identity checking is switched on. It will never send me back more than your legal name, your date of birth - to know whether you are of age, without keeping it - and a yes or a no. No data is sold, rented out or passed to an advertiser. No administration receives your sales or your identity from me: nothing requires it of me today, and I do not do it. The only exception would be an official request from a judge or an authority, which the law requires me to answer (see “Who works for me”). Nothing knowingly from anyone under 18 either. Arvel is not meant for them: you confirm you are 18 or older before you come in, and I ask no one for a date of birth, because collecting one only to check it would be one more piece of data for no guarantee at all. An account can be reported to me as belonging to someone under 18; if I restrict that account, it can no longer sell anything nor buy anything, and its holder can delete it from their settings.
04Who sees your details
Everything is handed over in person: the artist does not get your address, you agree on a place in the order, and you give only what you choose to give. If you sell, your availability (place, town, days and times) is shown only to the client of one of your ongoing orders; your address, if you give it, only once the meeting is agreed. Your family name stays hidden behind your artist name, except on the receipt of a sale. The artist who brought you never sees your name: they only see how many times their link was opened, how many people they brought in and how many of them made a first purchase from them - and only from five upwards. No one but you sees which artists you follow: the artist knows you follow them, others only see their number of followers. If you sell as a professional, your legal name, your company number and the address, email and phone number you gave are shown to the signed-in person about to pay for one of your works for sale, and they are copied onto the receipt of each sale: the law requires your client to know who they are buying from before they pay. They never appear in your gallery, or in any list.
05Who works for me
Named providers, and nothing else. Your account, your artworks and your messages are hosted with Supabase, in Frankfurt. Payments go through Stripe Payments Europe, in Ireland; when Stripe transfers data outside the Union, it does so under standard contractual clauses. Sign-in codes go out through Cloudflare Email Service and, if Cloudflare fails, through Resend; the other emails the app sends you go out through Resend, from Ireland. The mail you write to me lands in a Google mailbox - covered by the Google Workspace data protection agreement. If you sign in with Google or Apple, you prove who you are with them: they pass on to me what the chapter “What I keep” says, and what they do with your sign-in follows their own rules, not mine. Cloudflare serves the site and its anti-robot check, Turnstile, which also protects the sign-in code request in the app. Identity verification will go through Stripe, my payment provider, from the day it is switched on. If you sell as a professional, your company number is sent to the European VIES register, run by the European Commission, which replies whether it knows it and under what name: nothing else is sent. The alerts that make your phone ring go through Expo, in the United States, then through Firebase Cloud Messaging (Google) on Android or Apple’s service on iPhone: they carry only a short sentence I write myself - never a person’s name, the title of a work or the content of a message. Map backgrounds are now my own: I draw them myself from freely reusable public data, and Cloudflare serves them, like the rest of the site - no other company sees that you are looking at a map. When the app crashes, the technical report goes to Sentry, in Europe: it says which line of code broke, never who was using it. Each of them works on my instructions and may do nothing else with it. Beyond them, no administration receives your sales or your identity - except for an official request from a judge or an authority, which the law requires me to answer. European directive DAC7 covers companies only; Arvel is not one today, and so has nothing to report. The day that changes, I will tell you before asking you for anything. Your data stays in Europe - with a few unavoidable exceptions: the app is distributed by Apple and Google, two American companies; the site and the public photos of the works are copied by Cloudflare’s worldwide network to show faster; the alerts on your phone go through Expo, then Firebase Cloud Messaging or Apple’s service, American too; it is again Google that keeps the mail you write to me, without the country being guaranteed to you; Cloudflare, whose network is worldwide, sends your sign-in codes without the country being guaranteed to you either; and Stripe may transfer payment data outside the Union, under standard contractual clauses.
06For how long
Your account, for as long as it exists. As soon as you delete it, nothing public is left: not your name, not your gallery, not your messages. One exception, and it protects people: what was reported does not go with your account. If one of your messages was reported, it stays, and so does the conversation it was written in. And if you yourself were reported, all your messages stay: a report targets the person, not one sentence. It is the only proof the person who reported still has, and the law lets me keep it to defend a right in court. Your name leaves those messages: they stay, attributed to a deleted account. But if it was your profile itself that was reported, the copy of what it showed at that moment - your name, your username and your bio - stays with the report for five years, and your profile photo and your cover until the decision: without it, nothing would prove that an account was pretending to be someone else. Who looked at which artwork is erased after ninety days, and audience measurements too, if you had switched them on. The record of emails I sent you and the alerts you have read are erased after a hundred and eighty days. Your conversations do not erase themselves today: they stay for as long as your account exists, because they are the only evidence of what was agreed for a handover - and your messages go with it; the thread itself stays with the other person. Receipts and sales history are kept until the end of the tenth year after the year of the sale, with what proves them - the claims, the record of the meet-ups and of the handover code, the ownership history of each work: Belgian tax law requires accounting records to be kept for ten years, and that is also how long a sale can be contested. If you delete your account, the artworks you have already sold stay, with their photo, among their client’s purchases: each one is now visible only to that client, and is erased together with the receipt for the sale. A receipt carries the names of both parties: it is the proof of who sold what to whom, and a document in my accounts; what disappears is the account, not the document. At the handover, a copy of the messages exchanged around that sale and of the work’s photo is frozen, with the names of both parties, the client’s email address, the amount and the place of the meetings, and kept a hundred and fifty days after payment, to answer a bank dispute; it survives the deletion of the account during that period, then it is erased. The site’s waiting list is kept until opening, then six months. The artist who brought you is kept as long as your account exists, and goes with it; you can also remove them in your settings, and they don’t come back; if they delete their own account, I remove them from yours. The number of times an artist’s link was opened is kept as long as their account exists, and goes with it. The form’s anti-robot fingerprint - a hashed IP address - is erased after two days. And when you change your artist name, the old one is kept for thirty days: long enough for links carrying it to keep leading to you. If you delete your account while a sanction applies to it - buying or selling closed, account suspended -, I keep the fingerprint of your email address, a calculation that cannot be read back, never the address itself, until the sanction ends, and one year at most - the same for your old address if you change it during a sanction: if you come back with the same address before the end, the sanction resumes, until the same end date; then the fingerprint is erased. If I decide to refuse an email address - for example after an abusive message - I keep its fingerprint, a calculation that cannot be read back, never the address itself, with a short reason and the date: with that address, sign-up does not go through, whether on the waiting list or when an account is created. I keep it for as long as that refusal stands: the day I lift it, all of it is erased. The internet address noted when you write or report is erased after six months. A case I open in order to decide - a report, or a message that was flagged - is kept for as long as an appeal or a legal action remains possible, five years for a report: it is the record of my decision. The proof that you accepted the Terms and confirmed you are 18 is kept for ten years. The replies I send you when you write to me are kept for three years. The excerpt of the message that gave rise to it leaves three months after the case is closed, and at the latest one year after it was opened. The result of the identity check - yes or no, your legal name, and the fact that you are of age - is kept as long as your account exists: without it you would have to start over at every action. If the check found that you are under 18, that fact alone and its date are kept even if you withdraw your consent, until your account is deleted - nothing from your document or your face: without it, withdrawing your consent would be enough to buy. Your verification attempts - the day of each attempt, nothing else - are kept for thirty-one days: that is what counts the three attempts. The Apple token of an account created with Apple goes with that account: I ask Apple to revoke it, then I erase it - thirty days after your account is deleted at the latest, even if Apple has not revoked it. The token that makes your phone ring is kept as long as that phone stays signed in to your account: it goes when you sign out - at the latest at the next notification -, when the uninstalled app can no longer receive it, and in any case with your account. A problem you report to me from the app - what you write, your screenshots and the rest - is kept as long as your account exists, and goes with it. Your business details as a professional seller are kept for as long as you sell as a professional: they are erased when you go back to being a private seller or delete your account; the copy on the receipt of a sale stays with that receipt, for ten years. Your company number and the European register’s answer are kept for as long as that number is the one on your account. The images of your document and your photo are never with me: my provider keeps them, and deletes them under their own rules.
07A decision taken without me
Here are all the decisions on Arvel that are taken on their own, with no human reading them over - each with what enters the calculation, what it changes, and how to ask a person to take it up again. The first counts silences: when an artist declares they handed you an artwork and you do nothing - no code, no claim -, that silence is counted, and on the second one buying closes. On a purchase paid before you accepted the Terms of 11 October 2026, you are refunded anyway, minus the payment fees (see below), and the silence is counted on its own; since then, someone at Arvel decides, and the silence is only counted if they find for the artist. The second counts cancellations: three paid orders cancelled in thirty days close buying for the thirty days after the third, and three paid sales cancelled in thirty days close selling the same way. Bringing a paid sale down by blocking the other person counts as a cancellation by whoever blocks. For those two, nothing but silences or cancellations enters the calculation. What it changes: you can no longer buy, or no longer sell, as the case may be; the rest of your account is untouched. Each time, a reasoned email gives you the reason, the date, and how to ask for a human to review the decision, give your side, and contest it. Two other steps concern claims, and are also decided on their own: a claim opened before your code is refunded in full five days after it was opened, whether the artist replied or not, unless you withdraw it in the meantime - or, since the Terms of 11 October 2026, if the artist says they handed you the work: a human then decides; and after your code the sale is concluded - no further claim is taken. One closure is also decided on its own, and lasts thirty days: selling, after two paid sales for which the artist arranged nothing within the ten days. What enters the calculation: those sales, nothing else - only what happens after you accepted these rules, and the count starts again from zero after a closure. A reasoned email gives you the reason and the end date; a human reviews the closure on simple request to bonjour@arvel.be, and lifts it earlier if they find you are right. One last thing is decided on its own: when a paid sale falls through, the payment fees the bank keeps go to whoever let it fall through - whoever cancels, whoever brings it down by blocking the other person (unless a human upholds their report about the other), or whoever did not do something the app had asked of them in writing. What enters the calculation: who cancelled, who blocked the other and what became of their report, the meet-ups proposed and the answers to them, the declared handover, the claim and the answer given to it, and whether the seller is a professional - nothing else. In one case a person steps in: when an artist declares a handover that the client contests and nothing else singles anyone out, a human reads both versions and decides whether these fees go to the artist. They tell the artist in writing, with their reason. What it changes: at most 1.5 % of the amount paid + €0.25, held back from your refund if you are the client, or from your next sales if you are the artist. When nothing shows who let the sale fall through, no one is singled out. A human reviews that decision on simple request to bonjour@arvel.be, and these fees are returned to you if they find in your favour. Two reservation limits are also decided on their own, work by work: you cannot hold the same work for more than one hour in total over twenty-four hours, and if two of your reservations of the same work lapse without payment within twenty-four hours of each other, you cannot reserve it again until twenty-four hours after the second. What enters the calculation: your reservations of that work, their length and how they ended, nothing else. What it changes: you cannot reserve that work during that time; it stays open to others, and the rest of your account does not move. These limits lift by themselves, within twenty-four hours at most; if one seems wrong to you, write to bonjour@arvel.be and a person looks at it. Two one-day closures are also decided by themselves, when a payment arrives while the sale can no longer happen, and it is refunded in full. That refusal counts against the client who paid after their reservation ended, or who had blocked the artist while paying; and against the artist who had blocked the client while the client was paying. What enters the calculation: those refusals, counted per day, nothing else. What it changes: at the second refusal of the day, you can no longer buy anything if you are the client, or your works can no longer be bought if you are the artist, until midnight universal time (1 or 2 a.m. in Belgium); the rest of your account does not move. These closures lift by themselves at that hour; if one seems wrong to you, write to bonjour@arvel.be and a person looks at it. A closure is also decided on its own when payment fees from a sale cancelled on your side are due, under the Terms of 11 October 2026 that you accepted. What enters the calculation: those fees, and whether they have been paid or deducted from a sale, nothing else. What it changes: you cannot put a new work up for sale as long as they are not settled; those already on display stay on sale, and a sum under €0.50 closes nothing. It lifts as soon as the fees are paid from your studio, or deducted from a sale; if it seems wrong to you, write to bonjour@arvel.be and a person looks at it. Moderation decisions are made by a person, and you can contest them from your reports.
08Your rights
See, correct, take with you or erase: everything is in your settings, no need to write to me - your email address included: you change it in the app, and a code sent to the old and the new address confirms the change. You can also object to what I keep on the basis of my legitimate interest (chapter “Why, and on what legal ground”): write to vieprivee@arvel.be, and I stop, unless a serious reason, which I tell you, outweighs it - for example the proof of a sanction under way. You can also ask me to set a piece of data aside while something is checked. And faced with a decision taken on its own, you can always ask a person to take it up again, give your point of view, and contest it. The full file of your data is put together on the spot, in the app: you choose yourself where to send or save it.
09Trackers
Only one is required: the one that keeps you signed in. Another one only serves before you sign up: if you open an artist’s link or QR code without being signed in, the app keeps their name and code on your phone, so it can suggest when you sign up that they brought you - you keep them or remove them. They are forgotten when you sign up, when you sign in to an existing account, when you sign out, and at the latest the first time you open the app after thirty days. If you sign out without a network, the app also keeps, encrypted, the key of that session, until it can close it with me once the network is back - thirty days at most. Next to it there is an audience measurement, and it is optional: I offer it when you sign up, you find it again in your settings, and it stays off until you turn it on. When it is on, it counts the screens opened, the device and the language - never your name, never an artwork, never a message, nothing that points to you. Those counts are deleted after ninety days. They stay at Arvel: nothing goes to an advertising third party. On the site, only one page signs you in: the one that lets you pay for a work on the spot when you do not have the app. It keeps your session in your browser, as the app does on your phone, until you close the tab or sign out. It also loads Stripe’s payment module, which sets its own cookies to secure the payment and detect fraud; they serve no other purpose, and the rest of the site sets no cookies.
10Writing to me, complaining
A question about your data: vieprivee@arvel.be, answer within thirty days. If my answer does not satisfy you, you can turn to the Data Protection Authority, Rue de la Presse 35, 1000 Brussels.