Privacy Notice

Arts Thread Limited is the controller of personal data processed through Arts Thread Vault. We are registered in England and Wales under company number 06837670, with our registered office at 8 Blandfield Road, London SW12 8BG, United Kingdom.

In this notice, Arts Thread, we, us, and our refer to Arts Thread Limited. The Vault means the Arts Thread Vault website, applications, APIs, and related services.

This notice applies when you create or use a Vault account, receive an account through an Arts Thread, university, or programme integration, visit the Vault website, enter a Share room as a viewer, contact support, or buy a subscription.

Other Arts Thread services, competitions, and partner websites may provide additional privacy information. A university or programme may also be an independent controller for information it collects and sends to us.

We receive this data from you, your device and use of the Vault, people who share a Share room with you, payment and service providers, and authorised Arts Thread, university, competition, or programme integrations.

UK data protection law requires a lawful basis for each use. We rely on the following bases:

Your private creations and assets are processed to provide the features you choose. Arts Thread does not use private creative content for unrelated advertising and does not sell it.

Files may be scanned for security, converted for previews, backed up, and processed to calculate technical metadata or produce requested evidence records. Co-author details supplied by you are used to represent the authorship information you provide and to support relevant collaboration or notification features.

Certificates, reports, and audit records may need to retain identifiers, hashes, timestamps, and associated metadata so that a record remains consistent. Where possible, we minimise the personal data in those records.

A share room owner decides which creations and assets to share. When you enter a Share room, the owner may see information about access and interaction with the included content.

• For private-link access, we record entry and technical security data.
• For email verification, we process the viewer email and verification status.
• For password access, we validate the shared password in protected form.
• We may record creation opens, previews, downloads, and download attempts with timestamps and security information.

share room owners receive only the activity information provided by the interface. They must use it lawfully. Content copied or downloaded by an authorised viewer is then also subject to that viewer's handling, which Arts Thread cannot fully control.

Stripe processes subscription payments, invoices, refunds, and payment-method information. We exchange the information needed to create a customer, start or change a subscription, reconcile payment status, prevent fraud, and provide billing support.

We receive customer and transaction identifiers and payment status, but not full card numbers or card security codes. Stripe acts under its own privacy notice for payment processing.

We send essential account, verification, password-reset, billing, security, and service emails. Postmark currently delivers transactional email on our behalf and provides delivery, bounce, and complaint information.

You may be able to change optional notification and marketing preferences. You cannot opt out of messages necessary to operate or secure an active account. Support correspondence is retained as needed to resolve requests, train authorised staff, and maintain an appropriate record.

Essential cookies and local storage support sign-in, security, preferences, and your privacy choices. Optional analytics technologies are loaded only after the consent choice shown in the Vault.

Where enabled with consent, Google Analytics and Microsoft Clarity help us understand use and usability. Operational monitoring and error tools, including Sentry, may process limited technical information where necessary to diagnose faults and protect the service.

See the Cookie Policy to review or change optional analytics consent.

We disclose personal data only where needed for the purposes in this notice. Recipients may include:

• people you authorise through a Share room or collaboration feature;
• Arts Thread personnel and contractors who need access for their role;
• hosting, cloud storage, content delivery, email, payment, analytics, security, monitoring, support, and development providers acting under contract;
• an institution or programme where it provisioned your account or where the relevant service clearly involves it, limited to the agreed integration purpose;
• professional advisers, insurers, auditors, and potential purchasers or investors under appropriate confidentiality obligations;
• courts, regulators, law enforcement, or other parties where disclosure is legally required or reasonably necessary to protect rights, safety, or the service.

We do not sell personal data. We do not allow service providers to use Vault personal data for their own advertising.

Some service providers or support operations may process data outside the United Kingdom. Where required, we use an adequacy decision, the UK International Data Transfer Agreement or UK Addendum to approved contractual clauses, or another lawful safeguard. We also assess security and limit transferred data to what is needed.

We keep data only as long as reasonably necessary for the relevant purpose. The period varies by record:

• Account and active content: while the account is active and for a reasonable closure and recovery period afterwards.
• Deleted files and backups: removed from active access promptly, then from rotating backups according to operational backup cycles unless legal preservation is required.
• Certificates, reports, provenance, and audit records: retained while needed to preserve the integrity and usefulness of the requested record and to resolve disputes.
• Share room activity and security logs: retained for a limited period based on security, provenance, and operational need.
• Billing and transaction records: normally retained for the period required by tax, accounting, and fraud-prevention law.
• Support and legal records: retained while a request or claim is active and for an appropriate limitation period.

We may anonymise information so it no longer identifies a person and retain that anonymous information for statistics and service improvement.

We use technical and organisational measures designed for the nature of the service, including access controls, encrypted connections, protected credential storage, backups, logging, monitoring, supplier review, and restricted administrative access.

No internet service is completely secure. You should use a unique password, protect verification codes and Share room credentials, keep devices updated, and contact us promptly about suspected misuse.

Subject to applicable law and exemptions, you may ask us to:

• confirm whether we process your personal data and provide a copy;
• correct inaccurate or incomplete data;
• delete data in certain circumstances;
• restrict processing while an issue is considered;
• provide data you supplied in a portable format where the right applies;
• object to processing based on legitimate interests or to direct marketing;
• withdraw consent for future processing that relies on consent.

We may need to verify your identity. Rights are not absolute: for example, we may retain data needed for legal obligations, claims, security, or the integrity of a record you requested. We normally respond within one month, subject to lawful extensions for complex requests.

The Vault is not intended for individual accounts held by children under 14. Users aged 14 to 16 may use the service only through an appropriate educational or programme arrangement and with any consent required by law.

Institutions and programme partners must provide data lawfully, give participants appropriate information, and avoid sending data that is not needed for provisioning or the agreed service.

We may update this notice as the Vault, our suppliers, or legal requirements change. We will update the date above and provide notice or request a new acknowledgement where a change is material.

For privacy questions or rights requests, email support-vault@artsthread.com or use the Contact page.

You may also complain to the UK Information Commissioner's Office (ICO) or the supervisory authority where you live or work. We would appreciate the opportunity to address your concern first.