The institution postures; the privacy controls do not.

Last updated: 10 June 2026

1. Who we are

This website and service are operated by Richard Moore trading as Unremarkable Art. In this policy, "we", "us", and "our" mean Unremarkable Art.

Data controller: Richard Moore trading as Unremarkable Art, 6 Farm Lane, Send, Woking, Surrey, GU23 7AT, United Kingdom.

For privacy questions, data rights requests, moderation concerns, or account support, contact us at hello@unremarkableart.com.

2. What data we collect

We collect the information needed to operate the service, create generated artworks, process orders, prevent misuse, and provide support.

• Account information, such as name, email address, profile image, sign-in provider, account role, and session data.
• Uploaded images, filenames, image metadata, generated artwork previews, print-ready files, artwork titles, sharing settings, and provenance links.
• Digital e-card dispatch information, including sender details, recipient name and email address, occasion, message, card link, open counts, and conversion counters.
• Order information, including selected products, quantities, shipping details, recipient details, order status, payment status, and fulfilment status.
• Payment-related identifiers from Stripe, such as checkout session IDs and payment status. We do not store full card details.
• Support and email information, including messages you send us and transactional email delivery records.
• Moderation, takedown, and security records, including reports, ban status, ban reason, admin actions, IP-derived request metadata, suspected illegal-content records, and abuse-prevention logs.
• Usage and analytics data, such as pages visited, events, device/browser details, referral information, and cookie consent preferences.

3. Uploaded images and generated art

The service transforms images you upload into generated artworks. Uploaded source images and generated assets may be stored so you can view, manage, share, download, order, or generate certificates for them.

Source images are private by default. Public provenance pages, gallery display, source-image reveal, and sharing features are controlled by the choices available in your account. If an account is banned for illegal, harmful, or unacceptable content, public sharing for that account's artworks may be disabled.

4. Why we use your data

We use personal data to provide the service, manage accounts, generate artwork, operate galleries, provenance pages, and digital cards, process orders, send transactional emails, provide support, detect abuse, enforce our terms, comply with legal obligations, and improve the product.

• Contract performance: account access, artwork generation, checkout, downloads, certificates, and order management.
• Legitimate interests: security, fraud prevention, moderation, service improvement, customer support, and protecting our platform from misuse.
• Legal obligation: accounting records, tax records, legal requests, and illegal-content handling.
• Consent: analytics and non-essential cookies, where required.

5. Payments, cards, print fulfilment, and email

Payments are processed by Stripe. Physical print orders may be fulfilled by print partners such as Prodigi. Transactional emails may be sent through Resend, including magic links, e-card dispatches, order confirmations, reminders, and admin order notifications. We share only the information needed for those services to perform their role.

6. Cookies and analytics

We use essential cookies for authentication, security, session management, and consent preferences. With your consent, we may use Google Analytics to understand how visitors move through pages such as the studio, gallery, checkout, and support areas. See the Cookie Policy for more detail.

We do not sell personal data, source images, generated artworks, or order records.

7. Service providers

We use trusted third-party providers to operate the service, including hosting, database, storage, authentication, payments, print fulfilment, email delivery, analytics, and error monitoring. These providers process data only as needed to provide their services to us.

• Vercel for hosting and application infrastructure.
• Supabase or other PostgreSQL infrastructure for database storage.
• Vercel Blob or equivalent object storage for source images, generated artwork previews, print files, and supporting media.
• NextAuth/Auth.js, Google, and Resend for account sign-in and magic-link email.
• Stripe for checkout and payment processing.
• Prodigi or other print partners for fulfilment of physical products.
• Resend for transactional email delivery.
• Google Analytics, where analytics consent is granted.

8. International transfers

Some providers may process data outside the United Kingdom. Where that happens, we rely on appropriate safeguards such as adequacy regulations, standard contractual clauses, or provider commitments designed to protect personal data.

9. Retention and deletion

We keep data only for as long as needed for the purpose it was collected, including account management, fulfilment, support, accounting, fraud prevention, chargeback handling, moderation, legal claims, and legal obligations. Unordered assets may be scheduled for deletion after the retention window. Ordered print assets, payment records, and fulfilment records may be kept longer. See the Data Retention page for the practical storage policy.

Account deletion does not necessarily remove records we must retain for tax, accounting, fulfilment, chargeback, fraud prevention, moderation, illegal-content handling, dispute, or legal reasons.

10. Moderation, safety, and bans

We may review reports or account activity where content appears illegal, harmful, abusive, exploitative, infringing, or otherwise unacceptable. If we ban an account, we may record the ban time, reason, and admin action, revoke active sessions, block access to protected features, and hide public artworks associated with that account.

If content appears to involve child sexual abuse, non-consensual intimate imagery, credible threats, terrorism, fraud, or other serious illegality, we may preserve relevant records and report or disclose information to law enforcement, regulators, hosting providers, payment providers, or other appropriate bodies.

11. Your rights

Depending on your location and the circumstances, you may have rights to access, correct, delete, restrict, object to, or export your personal data. You may also withdraw consent for analytics cookies. To exercise these rights, email hello@unremarkableart.com.

We may need to retain certain records where required for legal, accounting, fraud prevention, moderation, dispute, or safety reasons.

If you ask us to delete or restrict content that has been ordered, reported, disputed, or flagged for safety or legal review, we may limit public access while retaining internal records needed to handle the issue.

12. Security

We use technical and organisational measures intended to protect personal data, including authenticated access, protected asset routes, secure payment providers, access controls, and HTTPS. No internet service can guarantee perfect security, but we take reasonable steps to protect the collection.

13. Children

The service is not intended for children. You must be at least 18 years old, or old enough to enter a binding contract in your jurisdiction, to use Unremarkable Art.

14. Complaints

If you believe we have not handled your data properly, please contact us first. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.

15. Copyright, privacy, and abuse reports

To report copyright infringement, privacy violations, impersonation, illegal content, or abusive use of the service, email hello@unremarkableart.com with the relevant URL, your contact details, the rights or concern involved, and enough information for us to investigate.

16. Changes to this policy

We may update this policy from time to time. The latest version will be posted on this page with an updated date.