This Privacy Policy explains what ArtMax (“we,” “us”) collects, how we use it, and who we share it with when you use the ArtMax application and website (the “Service”). We’ve tried to write it plainly.
1. What we collect
Your email address, if you sign in — we use it to send you a sign-in link or code and to keep your saved objects and reports tied to your account.
An anonymous account, if you use the Service without signing in. So that research and saved objects work before you give us an email, the app may create an anonymous account on our servers. If you later sign in with an email, that account becomes your regular account.
The content you submit to research an object — listing links, documents and photos you upload, and details you type such as maker, title, date, and asking price. In professional workspaces this also includes your inventory: item photographs and close-ups, item names and descriptions, sale and booth details, and the research attached to each item. This is what a report is built from.
The reports we generate for you, including the research and its review, and a record of when you accepted the in-app research disclaimer.
Wants and Alerts, if you use them — the artists you ask ArtMax to keep looking for, the limits you set on each Want, whether you have turned Alerts on, and which findings you have seen, dismissed or added. To find works, Discovery and Alerts send only the artist’s name to our search provider (OpenAI); your limits, max bids and notes are never sent. Wants are deleted with your account and included in your data export.
Basic technical data that any web service receives — such as your IP address and request headers — which we use to keep the Service running, apply rate limits, and protect against abuse.
Web billing information, if you purchase Full Research reports on artmax.art. Web payments are handled by Stripe; we receive a record of your purchases and payment status, but we never receive or store your full card number — Stripe holds that.
Photos you add for research are reduced in size on your device before they are uploaded. We store that reduced copy so your saved objects can show it, and we send it to our AI providers to identify and research the object. We do not keep the full-resolution original on our servers unless you choose to save it as a document in an object’s file.
Do not submit financial-account numbers, government IDs, or passwords as research content.
Report-credit records include complimentary grants, web purchases, temporary research reservations, and credits used for saved reports. We retain these records to keep your balance accurate and prevent duplicate grants or credit use.
2. How we use it
We use your data to provide the Service: to research and review your reports, to keep your saved objects and account working across visits, to operate share links you create, to protect the Service from abuse, and to communicate with you about the Service. We do not sell your data, and we do not use it to serve you third-party advertising.
3. Who processes your data (subprocessors)
Running the Service means sending some of your data to a small set of trusted providers. Importantly, the content you submit to research an object — including listing text, photos, uploaded documents, and details — is sent to AI providers for processing so that a report can be researched and reviewed. Our providers are:
- OpenAI, which researches your report, and Anthropic, which reviews the completed research. Content you submit is sent to them to produce the report.
- Google — the Gemini vision model used to identify an object from a photo you upload. A photo submitted for identification is sent to Google to produce that identification.
- Supabase — our database and authentication provider, which stores your account, saved objects, and reports.
- Vercel — our hosting provider, which serves the application and processes requests.
- Stripe — the payment provider for one-time Full Research purchases on artmax.art.
- PostHog (privacy-preserving product analytics, with IP anonymization and no session recording) and Sentry (error monitoring) — which help us understand usage and catch failures. We configure both to minimize personal data.
- When you submit a public listing link, we fetch that page (and, for some pages, use a reader service) to read its contents.
Each provider handles data under its own terms and privacy practices. We share only what is needed to operate the Service. These providers are based in the United States, and your data is processed there. Neither we nor our AI providers use your content to train AI models — our providers process it under API terms that do not permit training on customer data, and we make no use of it beyond running the Service for you.
4. Connected platform credentials
If the Service offers publishing to a third-party platform (such as an estate sale or auction listing site) using an API key or credential from your own account there, that credential is stored encrypted, used only to carry out transfers you initiate, and never shared with anyone else. Disconnecting the platform in the app — or asking us by email — deletes the stored credential. We recommend creating a dedicated API key for ArtMax where the platform supports it, so you can revoke it on their side at any time.
5. Cookies
We use a small number of strictly necessary cookies — for example, to keep you signed in. We do not use third-party advertising or cross-site tracking cookies.
6. Share links and tag pages
If you create a public share link for a report, that report becomes viewable by anyone who has the link, without signing in. The same is true of the per-item pages behind the QR codes on printed ArtMax tags: anyone who scans a tag sees that item’s buyer-facing research page. These pages are reachable only by long, unguessable addresses, show a single item — never your saved objects or account — and stop working if you delete the item. Only share links and print tags for research you intend others to see.
7. Help requests
On an artwork or a Want you can choose Request help to ask Jonathan Wolf, who runs ArtMax (ArtMax Art Advisor LLC), for help. A request is created only when you review it and tap Send request; nothing you do elsewhere in ArtMax — saving objects, entering a max bid, creating Wants, running research, viewing Discovery or receiving Alerts — creates one or is shared this way.
A request shares only what the screen shows you before you send it: for an artwork, its artist, title and date, the listing link, the seller or auction house, sale and lot details, the public estimate or asking price, its status and, only if you tick it, your ArtMax report; for a Want, the artist and the limits you leave ticked. It also includes what you would like help with, any note you write, and your account email so we can reply. It does not include your max bid or limit, other artworks, documents, notes, other Wants or research photos. Anything you type in the note is shared because you wrote it there.
Requests are read by a person. They are not sent to any seller, gallery or auction house, are never sent to the AI services that run research, and are not used to train any model. They are kept until you delete your account, which deletes them too; your data export includes them. ArtMax is not currently paid by any seller, gallery or auction house. If that ever changes, it will be stated here and before it affects a request you’ve made.
8. Retention and your choices
We keep your saved objects, reports, and uploaded documents while your account is active, so they’re there when you come back. You can edit or delete any saved object in the app at any time, which removes it from your account.
How long we keep things: account and research data are kept until you delete them or close your account. If you ask us to delete your account, we remove your account data — your saved objects, reports, acquisition files, and uploaded documents — from our live systems within 30 days; copies in routine encrypted backups age out on our provider’s normal cycle and are not restored. Technical data such as IP-based rate-limit records is kept only briefly (about 30 days). Web billing records are retained by Stripe and by us only as long as tax and accounting law requires. Anonymous usage metrics that carry no identity may be kept to run the Service.
To delete your account, open your account screen (tap your initials, top right) and choose Delete my account — it permanently removes your account, saved objects, acquisition files, and uploaded documents right away. You can also Export my data there first to keep a copy. Prefer we handle it? Email us at the address below and we’ll take care of it within 30 days.
9. Security
Here is specifically how your data is protected — these are the measures actually in place, not aspirations:
- Encrypted in transit. Data moving between your device, the app, and every provider it talks to is encrypted with TLS.
- Encrypted at rest. Our database and storage provider (Supabase) encrypts stored data with AES-256, and is SOC 2 Type 2 and ISO 27001 certified. Our hosting provider (Vercel) is independently SOC 2 compliant.
- Documents live in private storage, tied to your account. Uploaded documents are stored in a private bucket — never a public folder. Viewing or deleting one requires being signed in as its owner, and every link used to view a document is generated on demand and expires within minutes.
- Your data is isolated at the database level. Your saved objects, acquisition files, and account data are scoped to your account by row-level access rules enforced by the database itself — not just by app logic.
- A report built from your private document stays yours. Reports generated from a public listing alone are shared research — two people researching the same public listing benefit from the same record. A report generated using a document you attached is keyed to that document and is not served to anyone else’s lookup of the same listing.
- No card numbers on our servers. Stripe processes web payments directly; full card numbers never reach us.
No online service can be perfectly secure, but this is the honest shape of what protects your information today.
10. Children
The Service is intended for adults (18+) and is not directed to children. We do not knowingly collect data from children.
11. Changes
We may update this Policy. When we make material changes we’ll update the date above. Continued use of the Service after a change means you accept the updated Policy.
12. Contact
Questions, or want your data deleted? Contact us at Jonathan@artmax.art.
See also our Terms of Service.