Privacy Policy
Semirare hosts portfolios for artists. We collect what we need to run that, and not much else. This policy explains what we collect, why, who helps us process it, and how you stay in control.
1. Summary
- We don’t sell personal data, and we don’t let anyone train AI models on your work.
- We use your email to run your account and send you service emails. Newsletters only if you opt in.
- Payments go through Paddle, our reseller. We never see your card details.
- We use strictly necessary cookies. Analytics and advertising tools (Google Analytics, Google Ads, PostHog) only run on the Semirare website with your consent, and never on artists’ portfolios without it.
- You can export everything and close your account yourself, at any time, in Settings.
2. Who is responsible
The controller of your personal data is Initial condition s.r.o., Urxova 436/10, Karlín, 186 00 Prague 8, Czech Republic, IČO 10953035, registered in the Commercial Register of the Municipal Court in Prague, file C 351251 (“we”, “us”). Write to [email protected] with any privacy question or request.
For personal data that artists put on their portfolios, or that visitors send them through a contact form, the artist is the controller and we process it on their behalf (see section 4).
3. What we collect and why
| Data | Why we use it | Legal basis (GDPR) |
|---|---|---|
| Account data: email address, password (stored only as a secure hash), sign-up date, the date you accepted our terms | Create and secure your account, sign you in, reset your password | Contract, Art. 6(1)(b) |
| Portfolio content: images and their metadata, titles, descriptions, your name, bio, portrait, logo, contact details and social links you add | Host and publish your portfolio as you set it up | Contract, Art. 6(1)(b) |
| Image metadata: uploaded files may contain EXIF data such as camera model, date and GPS location | We keep originals as uploaded so your export is complete. Resized versions shown on your site have metadata removed. | Contract, Art. 6(1)(b) |
| Billing data: plan, subscription status, country, and the transaction reference from Paddle | Know which plan you have, meet tax and accounting duties | Contract; legal obligation, Art. 6(1)(c) |
| Emails and support: messages you send us, and a log of the service emails we sent you | Answer you, and prove that important notices were delivered | Contract; legitimate interest, Art. 6(1)(f) |
| Technical data: IP address, browser and device type, pages requested, time, errors | Keep the Service running and secure, prevent abuse and fraud, rate-limit sign-in attempts | Legitimate interest, Art. 6(1)(f) |
| Usage and marketing data: how the Semirare website and dashboard are used, which ad or link brought you | Understand what to improve and measure our marketing (see section 5) | Consent, Art. 6(1)(a) |
| Product news: your email, if you opt in | Occasional emails about new themes and features | Consent, Art. 6(1)(a); unsubscribe any time |
You give us account data and portfolio content when you use Semirare; without them we can’t provide the Service. We don’t make decisions about you based solely on automated processing, and we don’t buy data about you from others.
4. Visitors to portfolios
When you visit a portfolio hosted on Semirare (on a semirare.com subdomain or the artist’s own domain):
- our servers and content delivery network process your IP address and technical request data to deliver the page and protect it from abuse;
- if you send a message through the contact form, we store your name, email address and message and forward it to the artist, who is its controller. We keep it until the artist deletes it or closes their account;
- themes load fonts from Google Fonts, which means your browser connects to Google’s servers and shares your IP address with Google;
- we set no analytics or advertising cookies on portfolios. If we ever offer artists visitor statistics, they will be cookieless or consent-based and we will update this policy first.
Artists: when you publish other people’s personal data (for example portraits, names or testimonials), you are responsible for having a legal basis to do so. We act as your processor under Art. 28 GDPR; these terms and this policy form our data processing agreement with you, and you authorise the sub-processors listed in section 6.
5. Cookies and analytics
Strictly necessary cookies (always on)
| Cookie | Purpose | Lasts |
|---|---|---|
| session_id | Keeps you signed in to the dashboard | Until you sign out |
| ui_theme | Remembers light or dark mode for the Semirare website and dashboard | 1 year |
| _semirare_session | Security (CSRF protection), remembering choices during sign-up and theme previews | Browser session |
| semirare_consent | Remembers your cookie choices, so we don’t ask again. We also keep a record of each choice (time, choice, country and IP address) as proof of consent, for 3 years. | 6 months |
| site_owner | Shows an “Edit” button on your own portfolio when you open it from the dashboard. It contains no personal data and grants no access. | Up to 20 years, or until you clear cookies |
Analytics and advertising (only with your consent)
On the Semirare website and dashboard (semirare.com), not on artists’ portfolios, we use or plan to use the tools below. They run only after you agree in our cookie banner, and you can withdraw consent at any time through the cookie settings link at the bottom of every page. We will not turn on any of them before the banner is in place.
- Google Analytics 4 (Google Ireland Ltd.): statistics about visits and how people find and use the site. We use IP anonymisation, don’t send Google your email address or other identifiers, and keep data for 14 months. Cookies:
_ga,_ga_*, up to 2 years. See Google’s privacy policy. - Google Ads (Google Ireland Ltd.): measuring whether our ads lead to sign-ups (conversion tracking) and, if you allow it, showing Semirare ads to people who visited our site (remarketing). Uses Google Consent Mode v2, so nothing is stored unless you agree. Cookies:
_gcl_*, up to 90 days. You can also adjust ads at adssettings.google.com. - PostHog (PostHog Inc., hosted in the EU): product analytics, meaning which dashboard features are used and where people get stuck, and optional session replays with all text inputs masked. Cookie:
ph_*, up to 1 year.
6. Who we share data with
We share personal data only with service providers who process it for us under a data processing agreement, with Paddle for payments, and with authorities when the law requires it. If Semirare is ever sold or merged, data may pass to the new owner under this policy, and we will tell you.
| Provider | What for | Where |
|---|---|---|
| Heroku (Salesforce, Inc.) | Application servers and database | EU (Ireland) |
| Cloudflare, Inc. | Image storage (R2), content delivery, DNS, custom domain certificates, protection against attacks | Global network, EU storage where available |
| Amazon Web Services EMEA SARL | Backups of original uploads | Frankfurt, Germany |
| Postmark (ActiveCampaign, LLC) | Sending account emails and contact-form messages | USA |
| Paddle.com Market Ltd. | Reseller of paid plans: checkout, payments, invoices, tax, fraud prevention. Paddle is an independent controller; see Paddle’s privacy policy. | UK / USA |
| Google Ireland Ltd. | Fonts; with consent, Google Analytics and Google Ads | EU / USA |
| PostHog Inc. | With consent, product analytics | EU |
We will update this list before adding a new provider that processes your personal data.
7. Transfers outside the EU
Some providers above are based in, or can access data from, the United States or the United Kingdom. The UK has an EU adequacy decision. For US providers we rely on their certification under the EU–US Data Privacy Framework where available, and otherwise on the European Commission’s Standard Contractual Clauses, with additional safeguards such as encryption in transit and at rest. You can ask us for a copy of the relevant safeguards.
8. How long we keep data
- Account and portfolio content: while your account exists. When you close your account, we delete it straight away from the live service; files are removed from storage within a few hours.
- Backups of original images: copies are kept for up to 90 days after deletion, then permanently erased. We use backups only to recover from failures.
- Export files: download links and ZIP files are deleted after 7 days.
- Contact-form messages: until the artist deletes them or closes their account.
- Billing records: 10 years, as Czech tax and accounting law requires (kept mainly by Paddle).
- Server logs: up to 30 days, longer only when needed to investigate a specific security incident.
- Log of service emails: up to 2 years.
- Analytics data: up to 14 months (Google Analytics) or 1 year (PostHog).
- Inactive Free accounts: may be deleted after 24 months without a sign-in, after we email you.
9. Security
All connections use HTTPS. Passwords are stored as bcrypt hashes. Data is encrypted at rest by our providers, access to production systems is limited to the people who run Semirare, and sign-in attempts are rate-limited. No system is perfectly secure; if a breach puts your rights at risk, we will tell you and the supervisory authority as the GDPR requires. Please report security issues to [email protected].
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- rectification of inaccurate data (most of it you can edit yourself in the dashboard);
- erasure (you can close your account yourself in Settings);
- restriction of processing;
- data portability: Settings → Your data gives you a ZIP of all your originals plus your portfolio as JSON and CSV;
- object to processing based on legitimate interest, and to direct marketing at any time;
- withdraw consent at any time, without affecting processing before withdrawal;
- complain to a supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz); you may also contact the authority where you live or work.
Email [email protected] to use any of these rights. We reply within one month and may need to confirm your identity first. If you are a visitor whose data is on an artist’s portfolio, please contact the artist first; if you can’t reach them, write to us and we will help.
11. Children
Semirare is not intended for anyone under 16, and we don’t knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes
We update this policy when we change how we handle data, for example before adding a new provider or tool. The date at the top shows the current version. For significant changes we also tell account holders by email or in the dashboard.
13. Contact
Initial condition s.r.o.
Urxova 436/10, Karlín, 186 00 Prague 8, Czech Republic
Privacy: [email protected]
Legal: [email protected]
See also our Terms of Service.