Privacy policy

Murmuse is a French platform connecting artists, venues and art lovers. This policy explains which personal data we process, why, with which providers, for how long, and how to exercise your rights. It applies to murmuse.art, its subdomains and the emails we send.

Data controller

MURMUSE, a French simplified joint-stock company (SAS), RCS Annecy 991 438 557, 3 avenue des Romains, 74000 Annecy, France. For any question about your data, write to hello@murmuse.art with "Personal data" in the subject line.

The data we process

If you visit the site: the technical data of your browsing (IP address, browser, pages viewed), your language, the country inferred from your connection, and your cookie choices. Only with your agreement, detailed audience measurement and session recordings, described in the cookie policy.

If you create an account (artist, art lover, venue or prescriber): your identity (first name, last name, email, encrypted password), your contact details (phone, city, country, address), your role, your language and what you publish (biography, career, artworks, images, links to your social networks). For artists, this also includes the artist name, the studio address, the SIRET and VAT numbers, the identifier of your Stripe payment account and, if you add it to your career, your date of birth, which is then publicly visible.

If you buy an artwork: your billing and delivery details, your phone, your email, the details of your orders and your invoices. Your card details are entered directly with Stripe and never pass through our servers.

If you fill in a form without an account: the information you provide, depending on the form (consultation request for an artwork, leasing request, visual request, event proposal, newsletter subscription, reply to a private-view invitation, callback request from an artist). For an event proposal we also keep a hashed fingerprint of your IP address and your browser, to prevent abuse.

If an artist or a venue added you to their contacts: see the dedicated section below.

If our sales team contacted you as a professional: your professional contact details, the notes of our exchanges and, when a phone appointment takes place and you were informed of it, its recording.

Why, and on which legal basis

Purpose	Legal basis
Create and manage your account, display your public profile	Performance of the contract (terms of use)
Process your orders, payments, deliveries and invoices	Performance of the contract and accounting obligations
Manage the artist subscription	Performance of the contract
Organise exhibitions, applications and private views	Performance of the contract
Answer your requests (contact, consultation, leasing, callback, event proposal)	Pre-contractual steps and legitimate interest
Send you the newsletter	Consent, withdrawable at any time
Keep the site secure, prevent fraud, detect and fix errors	Legitimate interest
Count visits anonymously, without cookies	Legitimate interest
Measure audience in detail and record sessions	Consent, through the cookie banner
Prospect professionals (artists, venues)	Legitimate interest, with the right to object at any time
Translate or extract a text at your request with an artificial-intelligence model	Performance of the contract

Recipients and processors

Your data is never sold. It is accessible to our team, within the limits of their duties, and to the following providers, who act on our instructions:

Provider	Role	Established in
Supabase	Database, authentication, file storage	Singapore
Vercel	Website hosting, cookieless audience measurement, access to artificial-intelligence models	United States
Stripe	Payments, payouts to artists, fraud prevention	Ireland
Resend	Email delivery	United States
PostHog	Audience measurement and session recordings, on servers located in the European Union	United States
Sentry	Technical error monitoring	United States
Google Maps	Address entry assistance	Ireland
OpenStreetMap	Maps and city geocoding	United Kingdom
DHL Express	Transport of sold artworks	France
name.com	Domain registration for personal sites	United States
Amazon Web Services	Rendering of videos created with our tools, Frankfurt region	Luxembourg

Artists receive the data needed to fulfil an order (name, delivery address and phone for a shipment; name, email and phone for a hand-over). Venues hosting an exhibition receive the information useful to its organisation. Authorities may obtain data where the law requires it.

Transfers outside the European Union

Some providers are established outside the European Union or transfer data there, notably to the United States, Singapore and the United Kingdom. These transfers rely on an adequacy decision of the European Commission (United Kingdom; United States for companies certified under the Data Privacy Framework) or on the European Commission's standard contractual clauses, supplemented by security measures. A copy of the applicable safeguards can be obtained by writing to hello@murmuse.art.

Retention periods

• Account: for the duration of the relationship. On closure, your profile is anonymised; a minimal log of the closure request is kept for five years, the civil limitation period, then deleted automatically.
• Orders, invoices and payments: ten years from the end of the accounting year, as required by the French Commercial Code.
• Exhibitions in progress when an account is closed: the public presentation of the exhibition stays visible until its end date, then is deleted.
• Requests without an account (contact, consultation, leasing, visual, event proposal, callback): while the request is being handled, then at most three years after the last exchange.
• Newsletter: until you unsubscribe.
• Professional prospects: three years after the last contact.
• Cookie choices: 6 months, after which you are asked again.
• Security data (verification codes, technical logs): from a few hours to twelve months depending on their nature.
• Viewing statistics for artworks, profiles and personal sites: each view is linked to your account when you are signed in, otherwise to a random session identifier, and recorded with the browser used (user agent) and the referring page; you may request their erasure.

Cookies

The cookies and local storage we use, their duration and how to change your mind are described in the cookie policy. If you refuse audience measurement, your visits are counted anonymously, without cookies.

Your rights

You have the right to access, rectify, erase, restrict and port your data, to object to its processing, and to give instructions on what happens to it after your death. Where processing relies on your consent, you may withdraw it at any time without affecting past processing.

You can edit your information and close your account from your personal space. For any other request, write to hello@murmuse.art with "Personal data" in the subject line; we answer within one month and may ask for proof of identity in case of reasonable doubt. You may also lodge a complaint with the French supervisory authority, the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

Contacts imported by artists and venues

Artists and venues may import their address book (name, email, phone, address, photo) to invite their contacts to private views. They are responsible for this data; MURMUSE acts as a processor and uses these contacts only to send the requested invitations. Every invitation contains a one-click unsubscribe link, and you can write to hello@murmuse.art to be removed from every list. One artist's contacts are never shared with another.

Artist personal sites

Sites hosted on *.murmuse.art or on their own domain are published by the artist, who is responsible for the data of their visitors and buyers; MURMUSE acts as a technical processor for hosting and for payment through Stripe. Each site publishes its own privacy policy. When an artist registers their own domain, their contact details are passed to the registrar, with directory privacy enabled where the extension allows it.

Processing assisted by artificial intelligence

Some studio features send, at your request, the text you provide or the public page you ask to import to a language model: translation of your profile, import of an existing website, help writing an application, synthesis of exhibition themes. These transmissions serve only to produce the requested result and lead to no automated decision about you. You remain free not to use these features.

Emails

We send service emails (account confirmation, orders, exhibitions, invoices, security), the newsletter you subscribed to, and the invitations requested by artists and venues. Invitations carry an unsubscribe link; service emails are necessary for your account to work. Some emails contain an open indicator provided by our delivery provider, used only to check that they were delivered.

Security

Exchanges with the site are encrypted (HTTPS), passwords are stored hashed, access to data is limited to those who need it, and our team's access to the administration is protected by strong authentication.

Minors

The platform is reserved for adults. We do not knowingly collect data about minors; should that happen, write to us to have it deleted.

Changes

This policy may evolve with our services. The update date appears at the top of the page; in case of a substantial change, account holders are informed by email.