Privacy Policy

Last Updated: [Date] Effective Date: [Date]

NOTE FOR LEGAL REVIEW: GDPR (EU), CCPA (California), PDPA (Singapore/Thailand), DPDP (India) considerations included. Verify with qualified counsel before publication.

1. Introduction

This Privacy Policy explains how [Legal Entity Name] ("WAG", "we", "us") collects, uses, and protects your personal data when you use the W/\NG service.

We comply with:

• GDPR (General Data Protection Regulation) for EU users
• CCPA/CPRA for California residents
• PDPA for Singapore and Thailand users
• Other applicable data protection laws

2. Data Controller

[Legal Entity Name] [Registered Address] Contact: privacy@wag.gallery Data Protection Officer (if applicable): dpo@wag.gallery

3. Data We Collect

3.1 Account Information

When you register, we collect:

• Email address
• Password (hashed, never stored in plain text)
• Display name / artist pseudonym
• Profile photo (optional)
• Bio and portfolio links (optional)
• Country and city base
• Role (Viewer/Artist/Gallery/Curator/etc.)

3.2 Content You Upload

• Artworks (images, videos, 3D files)
• Metadata (titles, descriptions, dimensions, year)
• Submissions to Open Calls
• Comments and messages within the Service

3.3 Usage Data

• App interactions (screens viewed, features used)
• Artwork views and engagement metrics
• Device information (model, OS version, app version)
• Crash and error logs

3.4 Location Data

We collect location data only when:

• You actively use AR features (precise location during session)
• You enable proximity notifications (geofence checks on device, results sent only when triggered)
• You browse the map (approximate city-level)

We do not:

• Track your location continuously
• Store your full location history
• Sell location data to third parties
• Share precise locations with advertisers

3.5 AR-Specific Data

• Camera access for AR rendering (images NOT transmitted to our servers)
• VPS localization queries to ARCore Geospatial API (handled by Google)
• AR session statistics (duration, success rate)

3.6 Communications

• Email correspondence with our team
• Support tickets
• Notification preferences

4. How We Use Your Data

We process your data for:

4.1 Service Operation (Legal basis: Contract)

• Provide and maintain the Service
• Authenticate you
• Process submissions and curation
• Display artworks via AR
• Send transactional emails (account updates, submission status)

4.2 Service Improvement (Legal basis: Legitimate Interest)

• Analyze platform usage
• Debug and fix issues
• Develop new features
• Aggregate analytics for artists (de-identified)

4.3 Communications (Legal basis: Consent / Legitimate Interest)

• Notify you of relevant Open Calls (opt-out anytime)
• Send weekly digests (opt-in)
• Push notifications for nearby works (granular consent)
• Marketing emails (opt-in only)

4.4 Legal Compliance (Legal basis: Legal Obligation)

• Respond to law enforcement requests
• Tax and accounting records
• Fraud prevention

5. Data Sharing

We share data with:

5.1 Service Providers (Data Processors)

All providers are bound by Data Processing Agreements.

5.2 Public Information

The following information is public on the Service:

• Artist profiles (name, bio, portfolio)
• Published artworks and their metadata
• Gallery profiles
• Public comments

5.3 Legal Requirements

We may disclose data when required by law, court order, or to:

• Protect our rights and safety
• Prevent fraud or abuse
• Respond to government investigations

5.4 Business Transfers

In case of merger, acquisition, or sale, your data may transfer to the acquirer with appropriate notice.

5.5 We Do NOT Sell Your Data

We do not sell personal data to advertisers, data brokers, or third parties.

6. International Data Transfers

Data may be transferred to and processed in countries outside your residence. For EU users, we rely on:

• Standard Contractual Clauses (SCCs) with non-EU providers
• Adequacy decisions where applicable
• Explicit consent for specific transfers

7. Data Retention

8. Your Rights

You have the right to:

8.1 Access

Request a copy of all data we hold about you. Available via in-app "Export My Data" or email request.

8.2 Rectification

Correct inaccurate data via profile settings.

8.3 Erasure ("Right to be Forgotten")

Request deletion of your account and associated data. Available via in-app "Delete Account" or email request.

Note: Some data may be retained for legal compliance (e.g., transaction records).

8.4 Data Portability

Receive your data in machine-readable format (JSON export).

8.5 Object to Processing

Opt out of marketing, analytics, or specific processing activities.

8.6 Restrict Processing

Limit how we process your data while disputes are resolved.

8.7 Withdraw Consent

Where processing is based on consent, you may withdraw it anytime.

8.8 Lodge a Complaint

File complaints with your local Data Protection Authority:

• EU: Your country's DPA
• UK: ICO (ico.org.uk)
• Singapore: PDPC (pdpc.gov.sg)
• Thailand: PDPC (pdpc.or.th)
• California: CCPA enforcement

To exercise rights, email: privacy@wag.gallery We respond within 30 days (GDPR) or as required by law.

9. Children's Privacy

The Service is for users 16+ years old. We do not knowingly collect data from children under 16. If we learn we have, we delete it immediately. Parents/guardians can contact privacy@wag.gallery.

10. Security Measures

We implement technical and organizational measures including:

• TLS 1.3 encryption in transit
• AES-256 encryption at rest
• Multi-factor authentication for privileged accounts
• Row-Level Security in database
• Regular security audits
• Incident response procedures
• Employee access controls
• Penetration testing (annual)

In case of a data breach, we notify:

• Affected users within 72 hours
• Relevant DPAs as required by law

11. Cookies and Tracking

The mobile app does not use traditional cookies. The web platform uses:

• Essential cookies (authentication, session) — no consent required
• Analytics cookies (PostHog) — opt-in
• No advertising cookies

You can manage preferences in our cookie banner or via browser settings.

12. Third-Party Links

Our Service may link to third-party websites. We are not responsible for their privacy practices. Read their policies separately.

13. AR-Specific Privacy Considerations

13.1 Camera Access

• Camera feed is processed locally on your device
• Images are NOT transmitted to our servers
• AR rendering happens in-device

13.2 VPS (Visual Positioning System)

• ARCore Geospatial API may send anonymized image features to Google for localization
• Google's privacy policy applies to this processing
• We do not access raw camera data through VPS

13.3 Geofencing

• Proximity checks happen locally on your device
• Only triggered events (arrival at zone) are reported to us
• No continuous location tracking

14. Changes to This Policy

We may update this Policy. Material changes will be communicated via:

• Email to registered users
• In-app notification
• Banner on the website

Continued use after changes constitutes acceptance.

15. Contact

Privacy Inquiries: privacy@wag.gallery Data Protection Officer: dpo@wag.gallery General Support: support@wag.gallery Legal: legal@wag.gallery

Postal Address: [Legal Entity Name] [Registered Address]

Effective Date: [Date] Version: 1.0