ArtfulYo - Privacy Policy

Last Updated: May 12, 2026

This Privacy Policy describes how Shomaa Creatives LLP collects, uses, shares, and protects personal data when you use ArtfulYo and Open Mic by ArtfulYo (collectively, "the Platform"). The Platform is for users aged 18 and above only. This Policy supplements the Shomaa Master Privacy Policy at shomaa.org/privacy and does not apply to PollPrint — see shomaa.org/pollprint/privacy.

1. Data We Collect

1.1 Data You Provide

Identity: Full name, username, profile photo, date of birth.
Contact: Email address, phone number.
Profile: Bio, artist tags, genre, social media links, ArtLogs, ArtfulProjects.
ArtfulEvents: Submissions including venue, date, time, images, descriptions.
Credentials: Password (encrypted; never stored in plaintext).
Messaging: In-event chat content (Artists performing at a show) and 1:1 message content (Pro users only). See Section 4.
Support: Messages sent to our support team.

1.2 Data Collected Automatically

Usage data: Features used, session duration, interactions.
Device data: Device type, OS, browser, device identifiers, IP address.
Location data: Precise geolocation (lat/lng) when you grant permission — used for ArtfulEvent discovery and venue matching only. Revocable anytime via device settings.
Log data: Server logs, error reports, timestamps.

1.3 Data from Third Parties

Social login: Name, email, and profile photo from Google, Facebook, Instagram, Twitter/X, or LinkedIn when you choose to sign in via those services.
Referrals: Referrer identifier when you join via a referral link.

1.4 What We Do NOT Collect

Device contacts list or phonebook.
Payment card details (handled by PCI-DSS compliant third-party processors).
Personal data from anyone under 18.

2. How We Use Your Data

Verify age (18+) and manage your account.
Provide ArtfulEvent discovery, submissions, check-ins, and messaging features.
Match duplicate ArtfulEvent submissions and create canonical listings.
Generate personalized recommendations and improve the Platform.
Process referrals and manage referral program eligibility.
Investigate abuse reports and enforce our Terms.
Send account and Platform communications.
Send marketing messages where you have consented (opt out anytime).
Detect fraud and violations of our Terms.
Comply with applicable legal obligations.
Analyze usage patterns to improve the Platform.

3. Geolocation Data

Precise geolocation is collected only when you grant permission and is used solely to show nearby ArtfulEvents, match submissions to venues, and power proximity filters. It is not sold to third parties or used for advertising. You may revoke location permission at any time via device settings without affecting general Platform use.

4. Messaging Data

4.1 In-Event Chat (Artists Performing at a Show)

In-event chat is available to Artists registered as performers at a specific show. Chat content for a given show is stored on our servers for the duration of the event and for a period of 30 days afterward, after which it is deleted. Chat content is not used for advertising and is not sold to third parties. It may be reviewed by our trust and safety team if a report is filed or if required by valid legal process.

4.2 1:1 Direct Messages (Pro Users Only)

1:1 direct message content is stored on our servers for message delivery and conversation continuity. It is retained for 12 months from creation, or longer if required by an investigation or legal obligation. Message content is not used for advertising and is not sold to third parties. It may be reviewed by our trust and safety team when a report is filed or when required by valid legal process.

Neither in-event chat nor 1:1 messages are end-to-end encrypted. By using messaging features, you acknowledge that content may be accessed by Shomaa Creatives LLP for trust, safety, and legal compliance purposes.

5. Public Content

ArtfulEvents, ArtLogs, ArtfulProjects, and public profile fields are visible to other users and, where applicable, to the general public. Please be mindful about personal information included in public content. When your ArtfulEvent submission is merged into a canonical listing, your submitter identity may be retained internally for audit purposes but will not necessarily be publicly attributed.

6. Cookies and Tracking

Essential cookies: Required for session management and authentication. Cannot be disabled.
Analytics cookies: Activated only with your consent where required by law.
Push notifications: Opt-in only. Opt out via device notification settings or in-app settings at any time.

7. How We Share Your Data

We do not sell your personal data. We share data only with: service providers assisting Platform operations under strict data processing agreements; our trust and safety team or law enforcement in connection with abuse investigations or valid legal process; successor entities in a business transfer with prior notice; and third parties only with your explicit consent.

8. International Data Transfers

Your data may be transferred to India and countries where our service providers operate. We protect transferred data with appropriate contractual safeguards. By using the Platform, you consent to transfer as described in this Policy.

9. Data Retention

Account data: Until deletion plus 30 days for recovery, then permanently deleted.
ArtfulEvents submissions: Life of the listing plus applicable legal hold periods.
In-event chat: 30 days after the event concludes, then deleted.
1:1 message data: 12 months from creation, or longer if required by investigation or legal obligation.
Usage and analytics: Up to 24 months in identifiable form, then anonymized.
Legal compliance data: As long as required by applicable law.

10. Data Security

We implement TLS/HTTPS encryption, encrypted password storage, role-based access controls, and periodic security reviews. In the event of a breach likely to result in harm, we will notify affected users and relevant authorities within the timeframes required by applicable law and in any event within 72 hours where feasible.

11. Your Privacy Rights

Contact privacy@shomaa.org to access, correct, delete, or port your data; withdraw consent; or object to certain processing. We respond within 30 days or any shorter period required by your local law.

11.1 California (CCPA/CPRA)

Right to know, delete, and opt out of sale (we do not sell data). No discrimination for exercising rights.

11.2 EU and UK (GDPR / UK GDPR)

Rights to access, correct, delete, port, restrict, and object. Right to lodge complaints with local supervisory authority.

11.3 Australia

Access and correct personal information. Lodge complaints with OAIC at oaic.gov.au.

11.4 India (DPDPA 2023)

Access processing information, correct and erase data, nominate a representative, and lodge complaints with the Data Protection Board of India.

12. Age Verification

The Platform is strictly for users 18 and above. Accounts found to belong to users under 18 will be terminated and data deleted promptly. Report underage users to support@shomaa.org.

13. Marketing Opt-Out

Opt out of marketing at any time by clicking Unsubscribe in any marketing email, adjusting notification settings in the app, or contacting privacy@shomaa.org. Transactional messages are not affected.

14. Changes to This Policy

We will notify you of material changes via email or in-app notice at least 14 days before they take effect. Continued use after the effective date constitutes acceptance.