Privacy Policy

The data controller for personal data processed through Exhibo is BARS AI LTD, a company registered in England and Wales (Company No. 16732165), trading as Exhibo.

This policy applies to:

• Visitors browsing the public catalogue, press room, blog, and editorial pages.
• Registered gallery and museum operators using the dashboard to manage listings, commerce, and press.
• Collector accounts saving works, following galleries, and submitting enquiries or purchases.
• Buyers who complete card checkout or deposit-gated inquiries on Exhibo.
• Individuals whose profiles appear in the people registry (artists, curators, advisors) when linked to published content.

The categories of personal data we may process include:

We use personal data to:

• Create and administer accounts; authenticate users and maintain sessions.
• Display public listings, search results, editorial collections, and press releases.
• Route enquiries to the correct gallery or museum and, where enabled, mask buyer contact until deposit payment.
• Process subscriptions, press distribution fees, artwork checkout, and commission calculations.
• Operate optional payout modes (Stripe Connect and Exhibo Checkout held funds).
• Moderate content, verify institutions, review press releases, and resolve ownership claims.
• Send transactional emails: account verification, inquiry notifications, purchase receipts, payout updates, and watchlist alerts.
• Send optional marketing or digest emails where permitted.
• Detect fraud, abuse, and security incidents; enforce our Terms of Service.
• Comply with legal, tax, and regulatory obligations.
• Improve Exhibo through aggregated usage analysis where configured.

We do not use automated decision-making that produces legal or similarly significant effects without human review, except where necessary for fraud prevention (for example, Stripe Radar).

Where UK or EU data protection law applies, we rely on the following bases:

• Performance of a contract — to provide the account, dashboard, and paid features you sign up for.
• Legitimate interests — to operate a secure marketplace, prevent misuse, maintain the people registry, and improve the platform, where those interests are not overridden by your rights.
• Consent — for non-essential cookies, optional marketing emails, and certain collector alert preferences where required.
• Legal obligation — to retain financial records, respond to lawful requests, and meet tax or regulatory duties.

You may object to processing based on legitimate interests by contacting us. We will assess your request in line with applicable law.

We do not sell personal data. We disclose information only where necessary to operate Exhibo:

• Stripe — payment processing, subscriptions, Connect onboarding, and fraud prevention.
• Resend — delivery of transactional and notification emails.
• Cloud hosting, database, and object storage providers — application and media hosting.
• Image transformation and CDN services — delivery of optimised artwork and press imagery.
• Cloudflare — security, caching, and performance (where traffic is proxied).
• Galleries and museums — buyer enquiry details (subject to deposit rules) and purchase information relevant to a transaction.
• Professional advisers, insurers, or authorities — where required by law or to protect our rights.

Processors are bound by contracts requiring appropriate technical and organisational measures. A list of sub-processors may be provided on request for enterprise customers.

Personal data may be processed in the United Kingdom, the European Economic Area, the United States, and other countries where our infrastructure or service providers operate. Where data is transferred outside the UK or EEA to a country without an adequacy decision, we implement appropriate safeguards — such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or equivalent mechanisms — together with supplementary measures where assessed as necessary.

We retain personal data only for as long as necessary for the purposes described in this policy:

• Account data — for the life of the account plus a reasonable period after closure for backup and dispute resolution.
• Listing and editorial content — while published or until you delete it, subject to soft-delete and moderation logs.
• Commerce and ledger records — typically up to seven years where required for tax, accounting, or legal claims.
• Server logs — for a limited rolling period unless needed for a security investigation.
• Marketing preferences — until you withdraw consent or unsubscribe.

You may request erasure of your account. We may retain certain records where we have a legal obligation or overriding legitimate interest (for example, open chargebacks, unpaid commission invoices, or regulatory enquiries).

We implement technical and organisational measures appropriate to the risk, including encrypted transport (TLS), access controls, hashed credentials, tenant isolation for gallery data, and restricted access to production systems. No method of transmission or storage is completely secure; you are responsible for maintaining the confidentiality of your login credentials.

If we become aware of a personal data breach likely to affect your rights, we will notify you and/or the relevant supervisory authority as required by law.

Depending on your location, you may have the right to:

• Access a copy of the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure in certain circumstances.
• Restrict or object to certain processing.
• Data portability for information you provided in a structured, commonly used format.
• Withdraw consent at any time where processing is consent-based (without affecting prior lawful processing).
• Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

To exercise your rights, email privacy@exhibo.art. We may ask for information to verify your identity. We aim to respond within one month, extendable where permitted by law.

Transactional messages (inquiries, purchases, account security, payout status) are necessary to provide the service and are not marketing. Optional emails — such as weekly follow digests, saved-work alerts, or platform announcements — are sent based on your account settings or, where required, your consent.

You can unsubscribe from non-essential emails using the link in each message or by updating collector notification settings in your dashboard. Gallery operators receive operational emails related to their tenant account even if marketing is opted out.

Exhibo is designed for professionals and adult collectors in the art market. It is not directed at children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will take steps to delete it.

We may update this Privacy Policy to reflect product changes, legal requirements, or processor updates. The “Last updated” date at the top of the page will change accordingly. For material changes we will post a notice on Exhibo or email registered account holders where appropriate.

Questions about this policy or our data practices: privacy@exhibo.art

Postal correspondence may be sent to the registered office above, marked for the attention of Data Protection.