How DeepArt handles your information

Controller and contact

The data controller is DeepTrace Technologies S.r.l., Via Conservatorio 17, 20122 Milan, Italy.

Privacy and data-protection requests can be sent to info@deeptracetech.com.

DeepTrace Technologies is the sole controller for the processing described in this notice and has not appointed a Data Protection Officer.

Services and your choices

DeepArt provides public augmented-reality artwork scanners, an optional AI portrait feature on selected projects, and a private administration area. You can use essential scanner content without agreeing to analytics, and you can leave the scanner or portrait feature at any time.

Camera access and portrait submission are optional. Refusing camera access prevents AR tracking, and refusing to submit a portrait prevents creation of an AI portrait. Administrator account information is required to access the administration area.

AR camera and scanner analytics

Camera processing

After you choose to start the AR camera and grant permission, DeepArt uses camera images on your device to recognize the artwork and display AR content. DeepTrace does not upload or save those images.

Analytics and browser storage

If you consent to analytics, DeepArt collects information about how you use the scanner, such as when it opens, how long it is active, how quickly and steadily it recognizes the artwork, whether the camera and portrait features work and, if they fail, a general reason why (for example, that camera permission was denied), which overlays or hotspots you select or aim at, and how long you view hotspot details. This information is associated with a random session identifier. DeepArt does not intentionally collect your name or email address for analytics.

If you allow analytics, DeepArt uses browser storage to maintain the random analytics session. It also uses necessary browser storage to remember your analytics choice for six months and whether you want to see the hotspot guide. Analytics session information normally lasts for the life of the browser tab. The hotspot-guide preference remains until you clear the site's browser data or reset the preference.

Analytics and non-essential browser storage are based on your consent under Article 6(1)(a) GDPR and applicable ePrivacy rules. You may refuse or withdraw consent without losing access to essential scanner content. Withdrawal does not affect processing performed before it.

Optional AI portraits

The portrait preview initially remains on your device. If you choose to create a portrait, DeepArt sends your photo and the artwork to its AI provider, OpenAI, to create the requested image. DeepArt then returns the finished portrait to you without storing your photo or the portrait.

Portrait generation is based on your consent under Article 6(1)(a) GDPR. Face images are used only to create the requested artistic output. DeepArt does not use them for face recognition, unique identification, decisions about you, or profiling.

If you consented to analytics, DeepArt records whether portrait creation succeeds or fails as part of that scanner session. It also uses limited network and request information to prevent misuse of the feature.

Administration and security

DeepArt uses an administrator's email, password, role, account status, and sign-in information to verify the account and provide access to the administration area. Passwords are protected and are not stored in readable form.

Administrator data is processed to perform the applicable service or employment relationship under Article 6(1)(b) GDPR and for DeepTrace's legitimate interest under Article 6(1)(f) in administering and securing DeepArt. Account and security information is processed under Article 6(1)(f) to prevent misuse, protect the service, and diagnose problems.

When you use DeepArt, DeepTrace and its hosting providers receive standard technical information such as IP address, request time, requested page, and response status. Access is limited to people who need it to operate and protect the service.

Recipients and international transfers

DeepTrace uses the following principal service providers:

• OpenAI, for AI portrait generation.
• DigitalOcean, for hosting, storage, backups, and service monitoring.

Authorized DeepTrace personnel and administrators may access information where necessary for service operation, support, security, and aggregate reporting. Providers may use their own approved subprocessors under their contracts with DeepTrace.

Where a provider processes personal data outside the European Economic Area, DeepTrace uses an applicable adequacy decision or the European Commission's Standard Contractual Clauses and any necessary supplementary safeguards. You may request information about the safeguard that applies to your data by contacting DeepTrace.

How long information is kept

• AR camera frames are not uploaded or retained.
• Raw scanner events and session identifiers are kept for no more than 13 months, then deleted or irreversibly anonymized. Aggregate statistics may be kept indefinitely when they can no longer be linked to or used to single out a person.
• Portrait photos and finished portraits are not stored.
• Scanner security records are kept for no more than 24 hours. Account and portrait security records are kept for no more than 30 days.
• Administrator accounts are kept while active and for 90 days after deactivation. Expired sessions are deleted within 30 days.
• Technical logs are kept for 30 days. Deleted information may remain in restricted backups until the normal backup cycle completes, within 35 days.

DeepTrace may keep specific records longer where required by law or necessary to establish, exercise, or defend legal claims. In that case, access is restricted and the records are deleted when the additional purpose ends.

Children

DeepArt is not specifically directed at children. A person under 18 must not submit a portrait without authorization from a parent or legal guardian.

Your data-protection rights

Subject to applicable conditions and exceptions, you may request access to, correction, deletion, restriction, or portability of your personal data. You may object to processing based on legitimate interests and withdraw consent at any time without affecting earlier processing. DeepArt does not use automated decision-making that produces legal or similarly significant effects.

Send requests to info@deeptracetech.com. To delete scanner analytics, select “Request deletion of earlier analytics” in the scanner's privacy choices. The email it prepares includes the consent reference of your most recent choice to allow analytics in that browser, which lets DeepTrace find and delete the analytics collected under that choice. For analytics collected under an earlier choice, or without a consent reference, include the relevant project and approximate date and time. DeepTrace may request additional information where reasonably necessary to verify your identity and locate the records. Requests are free of charge and are normally answered within one month.

These rights do not apply to statistics after they have been irreversibly anonymized because those statistics can no longer be associated with or used to single out a person.

Complaints

You may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy. You may also contact the supervisory authority in the EU or EEA country where you live, work, or believe an infringement occurred.

Changes to this notice

DeepTrace may update this notice when DeepArt, its providers, or applicable legal requirements change. The effective date at the top of the notice identifies the current version. Material changes will be highlighted through an appropriate service notice where required.