Record
Privacy Policy
# Privacy Policy — Conventional Art
**Effective date:** 14 May 2026
This Privacy Policy explains how Conventional Art (operated by Conventional Art LLC, "we", "us", "our") collects, uses, shares, and retains personal information.
It covers two contexts:
1. Visitors and customers of our website at https://conventionalart.com (the "Site").
2. Our internal Broadcast Layer application, an in-house tool we use to publish content about our own artworks to our own social media accounts via official platform APIs.
We are committed to handling personal information responsibly, only collecting what we need, and giving you clear ways to exercise your rights.
---
## 1. Information we collect
**From customers and visitors of the Site:**
- Order information you provide when buying a print: name, email, shipping address, billing address, items ordered.
- Payment information processed by our payment processors (Shopify Payments, Stripe, or PayPal). We do not store full payment card numbers on our servers.
- Email address if you subscribe to our mailing list.
- Standard log data: IP address, browser type, pages visited, referring URL. Collected by Shopify's hosting infrastructure for security and basic analytics.
**From our own Broadcast Layer application:**
The Broadcast Layer is an internal tool. The only "user" of the Broadcast Layer is Conventional Art itself. It does not collect data from members of the public, and members of the public cannot sign in to it.
When we authorize the Broadcast Layer to access our own social media accounts (Instagram, Facebook, Threads, TikTok, Pinterest, LinkedIn, Bluesky, X, Klaviyo), it processes:
- Product information from our Shopify store: artwork titles, descriptions, images, prices, inventory.
- Content we generate and publish from our accounts: post text, captions, scheduled times, published URLs.
- Engagement statistics on our own posts: impressions, likes, reposts, replies, click-through. Aggregate numbers only — no information about individuals who engaged with the posts is retrieved, stored, or processed by us through the Broadcast Layer.
---
## 2. How we use information
**Customer and visitor information** is used to:
- Process and fulfill your orders, including print production, shipping, and customer service.
- Send you transactional emails about your order.
- Send marketing emails about new artworks or collections, if you have opted in.
- Improve the Site and our operations.
- Comply with legal obligations such as tax reporting.
**Broadcast Layer information** is used solely to generate, schedule, and publish promotional content about our own artworks across our own social media accounts. The application is operated by Conventional Art for Conventional Art's first-party use only. It is not offered as a service to third parties, and the data it processes is not used for any purpose other than publishing our own content from our own accounts.
---
## 3. Sharing with third parties
We share information with the following service providers, only to the extent necessary to operate Conventional Art:
- **Shopify Inc.** — hosting and storefront platform. https://www.shopify.com/legal/privacy
- **Shopify Payments / Stripe / PayPal** — payment processing.
- **Klaviyo, Inc.** — email marketing. We send your email and consent status (if you opted in) so we can deliver newsletter and promotional emails. https://www.klaviyo.com/legal/privacy
- **Print and fulfillment partners** — we share your shipping name and address so they can produce and deliver your order.
- **Anthropic PBC** — provider of the Claude AI models we use inside the Broadcast Layer for content generation. The Broadcast Layer sends Anthropic the artwork image and metadata we want copy generated for; it does not send any customer data. https://www.anthropic.com/legal/privacy
- **Social media platforms named below** — when we publish to our own accounts via their official APIs, the post content (which we authored) is sent to them. We do not transmit your personal information to these platforms through the Broadcast Layer.
We do not sell, rent, or resell personal information. We do not share personal information for advertising purposes beyond what is necessary for the platforms above to provide the services we use them for.
---
## 4. Platform-specific provisions
This section describes the specific ways the Broadcast Layer interacts with each social platform's API, so that platform reviewers and users can clearly understand the scope of access.
### Meta Platforms (Instagram, Facebook, Threads)
The Broadcast Layer connects to our own Conventional Art Instagram Business account, Conventional Art Facebook Page, and Conventional Art Threads Business account using OAuth via the Meta Graph API and Threads API.
The application requests the following permissions:
- `instagram_business_basic`, `instagram_business_content_publish` — to publish content to our own Instagram Business account.
- `pages_show_list`, `pages_read_engagement`, `pages_manage_posts`, `pages_manage_metadata` — to publish posts and read engagement statistics on our own Facebook Page.
- `threads_basic`, `threads_content_publish` — to publish content to our own Threads account.
Data retrieved is limited to: our own Page and account metadata, the content we ourselves publish, and the aggregate engagement statistics on that content. We do not access information about commenters, followers, or other users beyond what Meta's standard aggregated insights provide. We do not resell Meta data. Access can be revoked by us at any time via the Meta Business Settings page.
### TikTok
The Broadcast Layer connects to our own Conventional Art TikTok account via the TikTok Content Posting API using OAuth.
The application requests the following scopes:
- `user.info.basic`, `user.info.profile` — to verify the authenticated TikTok account and display the creator's username and profile photo to the Conventional Art operator before each post is submitted, as required by TikTok's content sharing guidelines.
- `video.upload`, `video.publish` — to upload draft videos and publish content to our own TikTok account.
Each post submitted through the Broadcast Layer is reviewed by the Conventional Art operator and includes a privacy-level selection (public, friends, or private) made by the operator. The Broadcast Layer does not add watermarks, branding, or promotional overlays to content. Preset captions and hashtags are editable by the operator before posting.
Access can be revoked at any time via TikTok account settings. Any data deletion request can be sent to the contact email below.
The Broadcast Layer connects to our own Conventional Art Pinterest Business account via the Pinterest API v5 using OAuth.
Scopes requested: `boards:read`, `pins:read`, `pins:write` — to read our own boards and publish pins to our own boards. We do not access or process Pinterest user information.
The Broadcast Layer connects to our own Conventional Art LinkedIn Company Page using OAuth via the LinkedIn API.
Scopes requested: `w_member_social`, `w_organization_social` — to publish content to our own LinkedIn Company Page.
### Bluesky (AT Protocol)
The Broadcast Layer connects to our own Conventional Art Bluesky account using an App Password generated by us in our Bluesky account settings. No personal information about other Bluesky users is accessed or stored.
### X (formerly Twitter)
The Broadcast Layer does not use the X API to post. It generates draft post variants, which the Conventional Art operator copies and pastes into the X interface manually. Engagement counts on our own published posts are retrieved using the public oEmbed endpoint, which returns only the public, aggregate count of likes and reposts and does not include identifying information about other X users.
### Klaviyo
The Broadcast Layer uses a Klaviyo Private API Key, scoped to template read/write and campaign read access, to generate and store email template drafts in our own Klaviyo account.
---
## 5. Data retention
- Customer order records: retained for as long as required by applicable tax, accounting, and consumer-protection law (typically 7 years).
- Mailing-list subscriber records: retained until you unsubscribe, after which we retain a record of your unsubscribe request.
- Broadcast Layer records (artwork analyses, generated content drafts, published-post engagement statistics): retained indefinitely for our internal analytical purposes. These records do not contain customer or third-party personal information.
---
## 6. Your rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you.
- Correct inaccurate personal information.
- Request deletion of your personal information.
- Object to certain processing, including direct marketing.
- Withdraw consent at any time.
- Lodge a complaint with a supervisory authority.
To exercise any of these rights, contact us at the email below. We will respond within 30 days, and sooner where required by law.
---
## 7. Security
We use commercially reasonable safeguards to protect personal information, including HTTPS encryption on the Site, secure credential storage for our service-provider API keys, and access controls limiting who in our operation can view personal data. No system is perfectly secure; if a breach occurs that affects you, we will notify you as required by law.
---
## 8. Children
The Site is not directed to children under the age of 13 (or under 16 where applicable). We do not knowingly collect personal information from children. If we learn that a child has submitted personal information, we will delete it promptly.
---
## 9. International data transfers
Conventional Art operates from Canada. Our service providers, including Shopify, Anthropic, Klaviyo, and the social media platforms named above, may process personal information in the United States and other countries. Where required by law, we rely on Standard Contractual Clauses or equivalent mechanisms to safeguard those transfers.
---
## 10. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" at the top. Material changes will be announced on the Site at least 14 days before they take effect, where required by law.
---
## 11. Contact
Privacy questions, data deletion requests, and any other inquiries related to this policy:
**Email:** info@conventionalart.com