Privacy

Open Museum is an open-access art platform operated from Basel, Switzerland. This page explains what information we handle, why, and the choices you have. We have written it to describe what we actually do, not what is conventional to claim. If a practice changes, we update this page.

We are the controller of the information described here. You can reach us about anything on this page at pramod@open-museum.art.

What we collect, and when

Browsing and searching the collection. You can search every connected open collection and read the rights record for any work without creating an account or signing in. (As with any website, our infrastructure sees the IP address your request comes from; how we use it is described under “Keeping the service available” below.)

A theme preference. If you switch between light and dark, your browser remembers that choice in local storage on your own device. It is never sent to us.

Joining the waitlist. If you ask to be notified, we store the email address you give us and which page you signed up from, so we can write to you when there is something to share. We store nothing else against your waitlist signup.

Ordering a print (available once print ordering is enabled). When you order a print, we collect the email address, name, and delivery address you enter, and the details of the work and size you chose. We use these to take payment, produce your print, deliver it to you, and contact you about the order.

What we do not do

We do not use Google Analytics, Plausible, Cloudflare Web Analytics, or any other third-party tracking. We set no advertising or analytics cookies. We do not sell, rent, or trade your information, and we do not build advertising profiles.

Keeping the service available

To keep search and the clearance interface working for everyone and to limit abuse, our infrastructure counts how many requests come from a given IP address within a short window. Cloudflare passes us the connecting IP address, and we hold a short-lived request count against it. That count expires automatically when the window passes. We do not use it to identify you, we do not attach it to your waitlist signup or any order, and we do not keep it beyond the window.

Payments: we never see your card

When you pay, you enter your card details on a page hosted by Stripe, our payment processor. Your card number reaches Stripe directly. We never see or store your card details. We receive only a confirmation that payment succeeded, a payment reference, and the email you gave Stripe so we can match it to your order.

Who we share information with, and why

We share only what a given task needs, with these processors:

• Stripe, to take and confirm payment. Stripe receives your email and the order amount. (Payment processing.)
• Prodigi, to produce and ship your print. Prodigi receives your name and delivery address and the print specification. It does not receive your email address or any payment information. (Print fulfilment.)
• Cloudflare, to host the site and store order records. (Hosting and infrastructure.)
• Once order email is enabled, an email delivery provider, to send order confirmations and clearance records. We will name that provider here before that feature goes live. (Order confirmation and clearance records.)

Each provider handles your information under its own privacy terms, which you can read on their sites. We do not share order or contact information with anyone else, except where the law requires it.

The rights records are public by design

The clearance record for a work, the rights verdicts, and any public verify page describe the artwork and its open-access rights status. They carry no information about you, the buyer. A print’s per-order reference is kept separate from the public rights record.

How long we keep things

• Order records, including the contact and delivery details above, are kept for as long as needed to fulfil the order and then for the period Swiss accounting and tax law requires, which is generally ten years for invoicing and business records. After that, they are deleted.
• Waitlist emails are kept until you ask to be removed, or until the thing you signed up for has happened and the list is no longer needed.
• Theme preference stays on your device until you clear it; we never hold a copy.

Your rights

Under the Swiss Federal Act on Data Protection and, where it applies, the EU General Data Protection Regulation, you can ask us to show you the information we hold about you, correct it, delete it, restrict or object to how we use it, or provide it in a portable form. Write to pramod@open-museum.art and we will act on your request. We handle these requests ourselves; there is no automated tool, and that is deliberate while we are small.

You may also complain to a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, your national data protection authority.

Where your information is handled

Open Museum is operated from Switzerland, and our hosting and order records sit with Cloudflare. To take payment and produce prints, your information may be processed by Stripe and Prodigi in the countries where they operate, including outside Switzerland and the EU, under the safeguards those providers maintain for international transfers, including standard contractual clauses where they apply.

Contact

Questions, requests, or corrections: pramod@open-museum.art. Open Museum is an operating name based in Basel, Switzerland; we will name the registered legal entity here as the business is formalised.