Privacy Policy

1. Overview

1.1 The Back Room (“we”, “us”, “our”) operates a secondary marketplace for the sale and purchase of fine art between collectors (“Members”, “you”). This policy explains what personal information we collect, how we use it, who we share it with, and the choices and rights you have.

1.2 We handle personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

2. Information We Collect

2.1 Account and profile information. Your email address (used to sign in and for notifications), and the profile details you choose to add: your collector handle, avatar, city, bio, and focus tags. Your handle is pseudonymous by design — your real identity is never displayed alongside it on the Platform.

2.2 Contact number (optional). You may add a phone number from your profile settings so our admin team can reach you about a valuation, certification, or logistics. This is stored separately from your public profile and is visible only to you and to us — never to other Members.

2.3 Identity verification. To receive payouts as a Seller, you must complete identity verification through Stripe Connect. This information (including government ID and bank account details) is collected and verified directly by Stripe — we do not receive, store, or have access to your government ID or bank account details ourselves.

2.4 Transaction and payment information. Stripe processes all payments, payouts, and Instalment Plan collections on our behalf. We retain a record of each transaction (amount, commission, status, dates) but never your card details or bank account number.

2.5 Shipping information. If a sale requires handover, the relevant Member(s) provide a delivery address and phone number at that point — this is not collected or stored ahead of time, and is visible only to the other party to that specific transaction (and to us, only where we're coordinating a Back Room–arranged courier).

2.6 Content you provide. Work listings (including images, descriptions, condition notes, and provenance information), your Wall layout, watchlist activity, and messages you send to other Members through the Platform.

2.7 Usage information. Standard technical information generated by using the Platform, such as log and device data, for security and troubleshooting purposes.

3. Cookies & Analytics

3.1 The Platform uses one essential cookie, set by our authentication provider (Supabase), to keep you signed in. This cookie is required for the Platform to function and can't be disabled while remaining signed in.

3.2 We use Vercel Web Analytics to understand overall traffic to the Platform — page views, visit counts, referring sites, and general device information, in aggregate. This doesn't use cookies, doesn't identify you individually, and can't be linked back to your account or used to track you across other websites.

3.3 We don't use third-party advertising or tracking cookies, and don't sell or share information for cross-site advertising purposes.

4. How We Use Your Information

We use the information above to:

• operate the Platform, including creating and managing your account and Collector Profile;
• verify Member eligibility and process the identity checks required for payouts;
• process sales, Instalment Plans, and commission;
• review and moderate Listings before they go live;
• contact you about a Valuation or Certification request, or to arrange handover logistics;
• respond to disputes between Members, in accordance with our Terms of Service;
• detect and prevent fraud, and protect the security of the Platform; and
• comply with our legal and regulatory obligations.

5. What's Public vs Private on the Platform

5.1 Public (visible to other Members, and to visitors for works marked for sale or on your Wall): your collector handle, avatar, city, bio, focus tags, approved Listings, your Wall, and the Provenance Passport entries associated with your works.

5.2 Private (visible only to you, and to us where necessary): your real identity and any information verified through Stripe, your email address, your contact phone number, shipping addresses, your messages, and any Listing that hasn't yet been approved.

6. Who We Share Information With

6.1 We do not sell your personal information. We share it only where necessary to operate the Platform:

• Stripe Payments Australia Pty Ltd — identity verification, payment processing, payouts, and Instalment Plan collection;
• Supabase — our database and hosting provider, which stores Platform data on infrastructure located in Sydney, Australia;
• Resend — our transactional email provider, used to deliver account, notification, and Instalment Plan emails;
• Sentry — our error-monitoring provider, used to detect and diagnose technical faults on the Platform;
• Independent valuers — if you request a Valuation, we share the relevant work's details with the valuer you're connected with, and — where needed for them to arrange to inspect the work or discuss it with you directly — your contact details. This is limited to what's needed to complete that specific Valuation;
• Law enforcement or regulators, where we're required to by law; and
• Other Members, but only to the extent described in clause 4.1 above (your public profile and approved Listings) — never your private information.

7. Where Your Information Is Stored

7.1 Our primary infrastructure (via Supabase) is located in Sydney, Australia.

7.2 Stripe processes payments through Stripe Payments Australia Pty Ltd, but as part of Stripe's global infrastructure, payment and identity data may also be processed and stored in the United States, and — for specific functions such as customer support and identity verification — by Stripe's other regional entities and sub-processors, including in Ireland, India, the Philippines, Colombia, Malaysia, and the United Kingdom. Stripe maintains a current list of its sub-processors and their locations at stripe.com/legal/service-providers.

7.3 Resend, our transactional email provider, stores all account data — including email metadata, logs, and delivery records — in the United States, regardless of which regional server is used to send a given email.

7.4 Sentry, our error-monitoring provider, stores technical error reports — including request details and, where relevant, code-level values present at the time of the error — in the United States.

7.5 Where your information is processed or stored outside Australia, we take reasonable steps to ensure it continues to be handled in a manner consistent with the Australian Privacy Principles, including engaging service providers who are contractually bound to appropriate data protection standards.

8. Data Security

8.1 We apply access controls at the database level so that Members can only see their own private information (or, where relevant, the other party to a specific transaction), and use industry-standard security practices to protect Platform data. No method of storage or transmission is completely secure, and we can't guarantee absolute security.

9. Data Retention

9.1 We retain your information for as long as your account is active, and for a further period afterwards where needed to meet our legal, tax, and record-keeping obligations, resolve disputes, and enforce our agreements. You can ask us to delete your account at any time; some information may need to be retained or de-identified rather than deleted outright where we're required to keep it by law.

10. Your Rights

10.1 You can access and correct your profile information at any time from your account settings. You can also ask us to provide a copy of the personal information we hold about you, or to correct or delete it, by contacting team@backroom.art. We'll respond within a reasonable period and, where we can't action a request (for example, because we're required to retain certain records), we'll explain why.

11. Children's Privacy

11.1 The Platform is intended for Members 18 years of age and older, in line with our Terms of Service. We don't knowingly collect personal information from anyone under 18.

12. Changes to This Policy

12.1 We may update this policy from time to time. Material changes will be notified to Members by email at least 14 days before taking effect, consistent with how we notify changes to our Terms of Service.

13. Complaints

13.1 If you have a concern about how we've handled your personal information, contact us first at team@backroom.art so we can try to resolve it. If you're not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

14. Contact

Questions about this policy can be directed to team@backroom.art.