Privacy Notice

1. Who is responsible

Juan Pablo Briñez ("Galry"), with address for notices at Manuel Ávila Camacho 9, Jesús del Monte, Huixquilucan, Estado de México, C.P. 52764, México, is responsible for the processing of your personal data. Contact for privacy matters: privacidad@mygalry.com.

2. Data we collect

From artists (account holders):

• identification and contact data: name, email address, language;
• account security data: password (stored only as a hash by our authentication provider) and, if enabled, an authenticator-app factor;
• billing data: plan, amounts and payment status (card details are handled by Stripe, never by Galry);
• portfolio content you choose to publish: biography, location, links, artworks, images and texts;
• feedback you send us from your dashboard during the beta: your message, an optional rating, the dashboard page you sent it from and your device type (phone, tablet or computer).

From people who join the waitlist or apply to the beta:

• waitlist: email address and language;
• beta application: name, email address, WhatsApp number, language and, if you share them, your Instagram or portfolio link, what kind of work you make and who referred you.

From visitors of portfolios:

• data you send through contact, commission or report forms: name, email, message, and reference images;
• technical data needed for security: a keyed hash of the IP address (never the IP itself), browser type, and anti-bot verification;
• anonymous usage statistics without cookies: page visited, referring website, country and device type, counted with an identifier that changes every day.

We don't request sensitive personal data.

3. Purposes

Primary purposes (necessary for the service):

• review beta applications, send invitations, and tell people on the waitlist when they can join;
• contact beta testers by WhatsApp or email about the beta, if they agreed to it when applying;
• create and manage your account and verify your email;
• process plan payments, refunds and receipts;
• host and publish your portfolio and deliver messages and commission requests to the artist;
• provide support, security, fraud and abuse prevention, content moderation, and legally required records;
• improve Galry with the feedback testers send us.

We don't use your data for secondary purposes such as advertising or marketing, and we don't sell personal data.

4. Artists and their visitors

When a visitor writes to an artist through a portfolio, the artist decides how to use that information to reply; Galry processes it on the artist's behalf to deliver and store it.

5. Service providers and transfers

We rely on providers that process data on our behalf and under our instructions, some of them outside Mexico (mainly in the United States): Supabase (database and authentication), Cloudflare (hosting, file storage and anti-bot checks), Stripe (payments), Resend (email), Sentry (error monitoring) and Upstash (rate limiting). When we message a beta tester on WhatsApp, the conversation goes through WhatsApp (Meta Platforms), only with people who agreed to it. These processor relationships don't require your consent. We only disclose data to authorities when legally required.

6. Retention

• account and portfolio data: while your account exists; deleted when you delete your account;
• contact messages and commission requests: up to 24 months, or earlier if the artist deletes them;
• waitlist entries: 12 months after joining;
• beta applications: 12 months after we decide on them (or after applying, while still under review); an approved tester's account follows the rule above;
• beta feedback: while the account that sent it exists;
• anonymous analytics: 13 months;
• security and audit records: 24 months;
• payment records: kept by Stripe for the periods required by tax laws.

7. Your ARCO rights

You can access, rectify, cancel or object to the processing of your personal data (ARCO rights), revoke your consent, or limit the use of your data by writing to privacidad@mygalry.com. Include your name, the email of your account, a copy of an official ID (or proof of representation), and a clear description of your request. We'll reply within 20 business days and, if the request is valid, apply it within the following 15 business days.

Artists can also download a copy of their data and delete their account directly from their account settings.

8. Cookies

Galry only uses cookies that are strictly necessary. See the Cookie Policy for details.

9. Security

We apply administrative, technical and physical measures such as encryption in transit, access controls isolated per portfolio, optional two-step verification, rate limiting and audit logs.

10. Changes and complaints

We'll publish any change to this notice on this page and, for material changes, notify artists by email. If you believe your rights have been violated, you can contact the competent Mexican data protection authority.