Last updated: July 6, 2026
We collect information you provide directly, such as your name, email address, and phone number when you create an account or contact us. Some authentication methods (Google, Apple, Instagram) may also provide your profile picture and the email address associated with that account. When you upload artwork, we collect the image itself along with the title, description, dimensions, medium, pricing, and any other details you provide.
We also collect usage data automatically, including browsing behavior, device information (model, operating system, language), session timestamps, and aggregate analytics signals.
When you use the in-product reporting and blocking features, we record the content or user reported, the reason category you selected, the timestamp, and any free-text details you submit. We retain blocked-user lists per account so that blocked artists' content remains hidden from you. These records are used to operate the moderation system and may be shared with law-enforcement or regulatory authorities where required by law.
We also collect your date of birth to verify that you meet the minimum age described under Children's Privacy, and your country of residence to determine which consumer-protection and data-protection rules apply to your account. When you purchase a subscription, our payment processors collect and process your payment and transaction data: on the web, payments are handled by Stripe; on iOS, purchases are handled by Apple In-App Purchase. We do not store full payment-card numbers.
The controller responsible for your personal data is Marcelo Moraes Motta de Mattos, an individual entrepreneur (MEI) registered under CNPJ 24.550.478/0001-53, doing business as Pllay or Pllay AI, at Avenida Juscelino Kubitschek de Oliveira 5000, 93 C — Integrato Iguatemi, São José do Rio Preto, SP 15093340, Brasil.
We have not appointed a formal Data Protection Officer. Privacy questions and data-subject requests should be sent to privacy@galleria.art, which serves as our data-protection point of contact (the encarregado for LGPD purposes).
We process your personal data under the following legal bases (GDPR Article 6; LGPD Articles 7 and 11):
Where processing relies on your consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
For users in Brazil, we also observe the Marco Civil da Internet (Lei 12.965/2014), which sets out the rights of internet users and the rules for handling connection and application-access records.
We do not sell your personal information. We may share data with trusted third-party service providers who assist in operating our platform or delivering services — always under strict confidentiality agreements.
The third-party processors that support the platform include Supabase (database and storage), Vercel (web hosting), Apple (iOS distribution and in-app payments), and Stripe (web payments). These providers process personal data on our behalf under confidentiality and data-protection commitments and are not permitted to use it for their own purposes.
When you contact an artist about an artwork — for example, by selecting a contact method such as email, phone, SMS, WhatsApp, or Instagram — we ask for your consent before sharing your details. Only after you agree do we share your name, email address, and phone number (where available) with that artist, so they know who is interested in their work and can respond to you directly.
The artist does not receive a separate notification about your contact, and Galleria Art takes no part in, and assumes no responsibility for, any communication, negotiation, or transaction that follows between you and the artist. We share this information solely to facilitate your request; we do not sell it. You provide this consent at the moment of contact, and it applies to subsequent contacts with the same artist. To withdraw a consent you have previously given, contact privacy@galleria.art.
We keep personal data only for as long as necessary for the purposes described in this Policy or as required by law. Account and profile data are retained while your account is active and are deleted or anonymized after account deletion, subject to short backup-retention windows kept for disaster recovery. Uploaded artworks are removed from public access when deleted and purged from our active systems thereafter.
Moderation and reporting records — reports, blocks, takedown notices, and enforcement actions — are retained for as long as needed to operate the moderation system, resolve disputes, and meet our legal obligations. Where we are legally required to keep certain records (for example, tax or transaction records), we retain them for the period the applicable law requires.
We use reasonable technical and organizational measures to protect personal data, including encryption in transit, access controls, and reliance on infrastructure providers with recognized security practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify you and the competent authorities — such as the ANPD or your EU supervisory authority — where required by applicable law.
You have rights over your personal data. Depending on your location and applicable law — including the EU/UK GDPR and the Brazilian LGPD (Article 18) — these include the rights to: confirm whether we process your data and access it; correct incomplete, inaccurate, or outdated data; request deletion or anonymization; request portability of your data to another provider; object to or request restriction of certain processing; withdraw consent at any time (without affecting prior processing); obtain information about the entities with which we share your data; be informed of the possibility of denying consent and the consequences of doing so; and not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
You may delete your account at any time — in the mobile app via the menu under Account Settings, then Delete Account — or exercise any of these rights by contacting us at privacy@galleria.art. You also have the right to lodge a complaint with a supervisory authority: the Brazilian National Data Protection Authority (ANPD) or your local data-protection authority in the EU/EEA.
Galleria Art uses artificial intelligence and automated processing to operate certain platform features, including:
What data is processed. Automated processing operates on your publicly visible artwork content — the images you upload, plus their titles, descriptions, dimensions, medium, and aggregate engagement signals (likes, saves, view counts). We do not feed your account credentials, email address, phone number, profile data, private messages, or payment information into AI systems.
Third-party AI providers. We use OpenAI's GPT-4o Vision, text-embedding, and moderation APIs to perform AI analysis. When your artwork is processed, the image and associated metadata are sent to OpenAI for inference. OpenAI does not retain customer API data beyond thirty days and does not use it to train its models, per OpenAI's API data-usage policy (https://openai.com/policies/api-data-usage-policies/).
No model training on your work. Pllay does not train any artificial intelligence model on your uploaded artwork, descriptions, or other content, and does not authorize any third-party processor to do so.
Automated decisions and the right to human review. Some moderation decisions — such as automatic flagging of severe content — may temporarily restrict the visibility of an artwork without a human reviewing each case in advance. If your artwork is flagged or restricted by automated means and you believe the decision was incorrect, you have the right to request human review by emailing abuse@pllay.ai. We will reconsider the decision and, where appropriate, restore the content. Where required by applicable law — including Article 22 of the EU General Data Protection Regulation and Article 20 of the Brazilian Lei Geral de Proteção de Dados — you also retain the right to contest decisions made solely by automated processing that produce legal or similarly significant effects on you.
International transfers. AI processing involves transferring your artwork data to OpenAI's infrastructure, which is operated from the United States. See the International Transfers section for the safeguards that apply to such transfers.
Galleria Art is intended for users aged 16 and older. During onboarding we verify age from your date of birth and do not permit anyone under 16 to create an account, anywhere in the world. We do not knowingly collect or process personal data from anyone under 16. If a parent or legal guardian believes that a child has provided us with personal data, please contact privacy@galleria.art; if we discover that we have collected personal data from someone under 16, we will delete it promptly and close the associated account.
This section reflects our compliance with the U.S. Children's Online Privacy Protection Rule (COPPA, 16 CFR Part 312), Article 8 of the EU General Data Protection Regulation (which sets the digital-consent age between 13 and 16 depending on the country — our global age-16 gate satisfies every EU member state), and Article 14 of the Brazilian LGPD (Lei 13.709/2018). Because we exclude everyone under 16, we do not process the personal data of children (crianças, under 12) and do not operate a parental-consent flow; for adolescents aged 16 and 17 who use the platform, we process personal data in their best interest and apply age-appropriate content filtering together with 16-and-over feature and subscription gating.
Galleria Art is operated from Brazil by Pllay. We use trusted infrastructure providers — including Supabase (database and storage), Vercel (web hosting), and Apple (iOS app distribution and in-app payment processing) — that operate data centers in multiple regions, including the United States, the European Union, and others. As a result, your personal information may be processed in countries outside your country of residence, including in jurisdictions whose data-protection laws differ from your own.
We rely on appropriate transfer mechanisms recognized under applicable data-protection law, including the European Commission's Standard Contractual Clauses for transfers from the European Economic Area and, for transfers of personal data collected in Brazil, the international-transfer bases permitted under Article 33 of the LGPD (Lei 13.709/2018), such as contractual guarantees of compliance and, where relevant, your specific consent. We take reasonable steps to ensure that processors handling your data adopt confidentiality and security commitments equivalent to those described in this Privacy Policy.
If you have questions about international transfers of your data, contact privacy@galleria.art.
This section describes data practices specific to the Galleria Art mobile app.
Camera & Photo Library. When you add an artwork through the app, you may capture an image directly with your device's camera or choose an existing image from your photo library. Camera access is requested only when you tap the camera surface in the artwork wizard; you may decline and continue with photo-library imports only. We process the resulting image to upload it as part of your artwork; we do not access your photo library beyond the single image you explicitly pick.
Sign in with Apple. If you sign in with Apple, you may choose to share your real email address or use Apple's private email relay. When you choose the relay option, we receive only the relay address; Apple forwards any messages we send to your real address. We treat the relay address as your primary account email until you change it.
On-Device Caching. To keep the app responsive, we cache thumbnails and artwork images on your device. These caches live entirely on your device, are never transmitted back to our servers, and are evicted automatically as you use the app. Signing out of the app clears caches tied to your session.
In-App Account Deletion. You may delete your account directly from within the app at any time. Open the menu, then Account Settings, then Delete Account, and follow the confirmation prompts. Deletion is permanent and removes your profile, artworks, and associated content from our active systems. Backups retained for disaster recovery are purged according to standard retention schedules.
We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date and, for material changes, notify registered users by email and through an in-product notice. Your continued use of Galleria Art after an update takes effect constitutes acceptance of the updated Policy, except where additional consent is required by law.