Little data, all of it in plain sight.

No accounts, no tracking, no advertising. What follows is everything the ArtFirma app and website keep or send.

Who is responsible

123Automate, Sergey Evstegneev, autónomo, Carrer de Narcís Macià i Domènech, 44, 17310 Lloret de Mar, Girona, Spain. contact@artfirma.com.

On the artist's phone (the app)

The twelve words (the signing key) are stored only on the phone, encrypted with a key held by the phone's secure hardware (Android Keystore). They are never sent anywhere and are excluded from phone backups.
Records of works the artist creates, and copies in a folder the artist chooses.
Settings: the artist's name, website, verification address.

Sent to ArtFirma's servers

When	What	Why, and who sees it
An artist registers	chosen name, website or profile page, public key, and the key that checks chip codes (stored encrypted)	to confirm the key and check seals; name, website and public key are public
An artist publishes a work	the work's record (title, year, size, medium, description) and photos; if the artist adds them, more photos and videos of the work and a photo of each signed copy	public by design: anyone checking the seal sees them; copied to a permanent public archive
Anyone checks a seal online	the chip's serial number, its reading counter and code	to confirm the chip is the original; we keep only the serial number, the last reading and two dates, not who checked or where
Someone orders seals	name, email, delivery address, the order, and the IP address it came from	to deliver, ask for payment and invoice; seen only by ArtFirma, emailed to us and a copy to you; kept as long as Spanish tax and commercial law requires (6 years)

No accounts, no cookies, no analytics, no advertising, no data about buyers of artworks. Connections are encrypted (HTTPS).

Services we use

Cloudflare runs the online chip check and the registry of records.
Arweave is the permanent public archive that receives published records, photos and videos 30 days after publishing; what is archived there cannot be deleted.
Internet Archive (purl.org): the permanent address on every seal redirects through it.
Resend delivers the order emails; PayPal takes payment for seals.
Our own server in the EU hosts this website; its web server keeps standard access logs for a short time.

Your rights

Write to contact@artfirma.com to see, correct or delete what we hold about you. We can remove a registration and records from our servers. Records reach the permanent public archive (Arweave) only 30 days after publishing; copies already there cannot be removed by anyone, but the verification page stops showing them. Complaints about published content: Published content.
Uninstalling the app deletes everything it stored on the phone. You may also complain to the Spanish data protection authority (AEPD).