Privacy Policy

Last updated: September 28, 2026

Provenance Guru, Inc. ("we," "us," or "our") operates https://provenance.guru and related services, including creator websites on subdomains, certificates of authenticity, and subscription features. This Privacy Policy explains how we collect, use, and share personal information when you use our platform.

Account information: email address, password (hashed), username, and profile details you provide (name, bio, location, website, medium, profile photo).

Authentication data: if you sign in with Google, we receive your email address, display name, and profile photo URL from Google. See the "Information from Google Sign-In" section below for full details. If you sign in with Apple, we receive a stable Apple user identifier and, if you choose to share them, your name and email address (which may be an Apple private relay address).

Content you upload: artwork images, titles, provenance records, exhibition details, press links, CVs, and other materials you submit to the platform.

Creator site data: handle, template choices, hero images, logos, taglines, and section visibility settings for your public artist or gallery website.

Billing information: subscription role, plan interval, and payment status. On the web, payment card details are processed by Stripe; in the iOS app, subscriptions are purchased through Apple In-App Purchase and we receive a signed transaction record (product, purchase and expiry dates, and a transaction identifier) but no payment details. We do not store full card numbers on our servers.

Usage and analytics: pages visited, features used, referral data, and advertising performance metrics collected via Google Tag Manager and related analytics tools on our website, subject to your cookie consent choices. Our iOS app does not load these analytics or advertising tools and does not track you across other companies' apps or websites.

Location: if you allow it, we use your device location when you scan an artwork or collectible certificate so the owner can see where it was scanned. When you add an artwork or collectible, we also read the GPS coordinates saved in the photo (if any) to pre-fill its location, which you can edit or remove. To turn coordinates into a city and country name, we send them to BigDataCloud's reverse-geocoding service.

Technical data: IP address, browser type, device information, cookies, and localStorage entries (including language, theme, and consent preferences).

When you choose "Sign in with Google," Google provides us with the following information from your Google account: (1) your email address, used as your account identifier and for transactional emails; (2) your display name, shown on your profile and artworks; and (3) your profile photo URL, displayed as your avatar.

We do not receive your Google account password. We do not request access to, and do not use, your Gmail messages, Google Drive files, Google Calendar, Google Contacts, or any other Google service or data beyond the identity information listed above.

This limited use of Google user data is governed by the Google API Services User Data Policy, including its Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy). In particular: (a) data obtained from Google APIs is used only to provide and improve the features described in this policy; (b) we do not transfer or sell this data to third parties for advertising, data brokering, or credit-related purposes; and (c) humans do not read your Google-sourced data except as necessary for security purposes or as required by law.

Google-sourced identity data (email, name, profile photo URL) is stored in our authentication system (Supabase) and in your account record. You may update your display name and avatar from your profile settings at any time. If you delete your account, this data is removed from our systems subject to any legal retention obligations.

Provide and operate the platform, including certificates, registries, exhibitions, operations tools, and creator websites.

Authenticate users, prevent fraud, and enforce our Terms of Service.

Process subscriptions and trials through Stripe (web) and Apple In-App Purchase (iOS).

Provide optional AI features, with your permission, as described in "AI features and third-party AI" below.

Send transactional emails (welcome messages, notifications, billing confirmations).

Measure and improve product performance, including ad and analytics measurement where you have consented.

Comply with legal obligations and respond to lawful requests.

Service providers: we use Supabase (database and authentication), Stripe (payments), Apple (Sign in with Apple and In-App Purchase), Vercel (hosting), OpenAI (AI features, only with your permission), BigDataCloud (turning location coordinates into place names), Google (OAuth and analytics/tag management), and email delivery providers to operate the service. These providers process data on our behalf and are required to protect it to the same standard described in this policy.

Public content: artwork, profiles, exhibitions, and published creator sites may be visible to other users and the public according to your visibility and publish settings.

Legal requirements: we may disclose information if required by law, court order, or to protect the rights, safety, and security of our users and the platform.

We do not sell your personal information for money. Where applicable law defines "sale" or "sharing" to include certain analytics or advertising uses, you may contact us to exercise opt-out rights.

Some features use artificial intelligence provided by OpenAI, L.L.C.: the Taco assistant, the grants and opportunities assistants, CV import, exhibition checklist scanning, press article search, provenance valuations, and AI-selected grants in the weekly digest email.

We only send your data to OpenAI after you give explicit permission. We ask the first time you use an AI feature, and you can give or withdraw permission at any time in Settings → Privacy. If you do not give permission, AI features stay off and the rest of the platform works normally.

When you use an AI feature, we send OpenAI only the information that feature needs. Depending on the feature, that can include your messages and any images or documents you attach; profile details such as your name, role, medium, location, and bio; the text of an uploaded CV or exhibition checklist; and details of your artworks, collection, exhibitions, and provenance records. We never send your password or payment details.

OpenAI processes this data to generate a response and returns it to us. Under OpenAI's API terms, data sent through its API is not used to train its models, and it may be retained by OpenAI for up to 30 days for abuse monitoring before deletion. AI output can be inaccurate; valuations and recommendations are estimates, not professional appraisals or advice.

Some AI features search the public web for information about artists, galleries, and artworks (for example, press coverage or auction results). These searches use names and details from your profile or artwork records only when you start the feature.

We use essential cookies for authentication, security, and site functionality. Non-essential analytics and advertising cookies are used only after you accept them via our cookie consent banner. See our Cookie Policy for details.

We retain account and content data while your account is active and as needed to provide the service. You may delete content or request account deletion subject to technical and legal retention requirements (e.g. billing records, fraud prevention, dispute resolution).

Depending on your location, you may have rights to access, correct, delete, or export your personal data, object to or restrict certain processing, and withdraw consent for cookies/analytics and for AI data sharing (Settings → Privacy).

You can delete your account at any time from Settings → Account Actions, including in the iOS app. Deleting your account permanently removes your profile, artworks, and other content, subject to the retention requirements described above. Subscriptions purchased through Apple must be cancelled separately in your Apple ID settings.

To exercise these rights, contact us at privacy@provenance.guru. We will respond within the timeframes required by applicable law.

We may process and store information in the United States and other countries where our service providers operate. We take steps designed to protect your information consistent with this policy and applicable law.

Our services are not directed to children under 13 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children. Contact us if you believe a child has provided us data.

We may update this Privacy Policy from time to time. We will post the revised version with an updated "Last updated" date. Continued use after changes constitutes acceptance of the updated policy where permitted by law.

Provenance Guru, Inc.

Email: privacy@provenance.guru

Website: https://provenance.guru