Legal

Privacy Policy

CAA Media Ltd · Company no. 16797709 · Registered in England and Wales

Privacy Policy

Crypto{Art}Analytics Operated by CAA Media Ltd Company number: 16797709 Registered in England and Wales

Last updated: 18 September 2026

1. Who we are

Crypto{Art}Analytics ("C{A}A", "we", "us", "our") is operated by CAA Media Ltd, a company registered in England and Wales under company number 16797709.

We are the data controller for personal data collected through this Platform. Our contact for privacy matters is support@cryptoartanalytics.io.

ICO registration: CAA Media Ltd is registered with the Information Commissioner's Office. Our ICO application number is C2037264. Registration is confirmed as paid and the formal registration number will be published here upon issuance by the ICO.

2. What data we collect

Data you provide directly

- Email address — when you create an account or sign in via our authentication provider (Privy)
- Wallet address — if you choose to authenticate using a cryptocurrency wallet (optional)

Data collected automatically

- Authentication tokens — session tokens issued by Privy to maintain your logged-in state
- Basic usage data — pages visited and features used, collected to operate and improve the Platform

Payment data

If you subscribe to a paid plan, your payment is processed by Stripe. We do not collect or store your card details. Stripe provides us with:
- Confirmation of subscription status (active, cancelled, etc.)
- Your Stripe customer ID
- Transaction timestamps and amounts

3. How we use your data

We use your personal data to:

- Create and manage your account
- Provide access to the Platform and its features according to your subscription plan
- Process payments and manage your subscription
- Send transactional emails (account confirmation, payment receipts, important service updates)
- Respond to your enquiries
- Comply with our legal obligations

We do not use your data for marketing purposes without your explicit consent. We do not sell your data to third parties.

4. Legal basis for processing (UK GDPR)

We process your personal data on the following legal bases:

- Contract — processing necessary to provide the service you have requested, including account management and payment processing
- Legitimate interests — operating, securing, and improving the Platform, where these interests are not overridden by your rights
- Legal obligation — where processing is required to comply with applicable law

5. Data processors and third parties

We share your data only with the following third-party processors, each bound by appropriate data processing agreements:

Processor	Purpose	Location
Privy	Authentication and identity	United States
Stripe	Payment processing	United States
Microsoft Azure	Platform hosting and infrastructure	European Union / United Kingdom
Microsoft Clarity	Behavioural analytics (session recording)	United States

Transfers outside the UK. Privy and Stripe are based in the United States. We rely on Standard Contractual Clauses approved by the UK Information Commissioner to lawfully transfer data to these providers.

We do not share your personal data with any other third parties except where required by law.

6. Data retention

We retain your personal data for as long as your account is active and for a reasonable period thereafter to comply with our legal obligations, resolve disputes, and enforce our agreements.

If you delete your account, we will delete or anonymise your personal data within 90 days, except where retention is required by law.

Payment records are retained for 7 years in accordance with UK financial record-keeping requirements.

7. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

- Access — request a copy of the data we hold about you
- Rectification — request correction of inaccurate data
- Erasure — request deletion of your data in certain circumstances
- Restriction — request that we limit processing of your data
- Portability — request your data in a commonly used, machine-readable format
- Objection — object to processing based on legitimate interests

To exercise any of these rights, contact us at support@cryptoartanalytics.io. We will respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies, local storage and analytics

Strictly necessary cookies and storage

The following are required for the Platform to function and are always active:

- Authentication tokens — stored locally to keep you signed in across sessions
- Session preferences — such as theme or layout preferences

Analytics cookies (consent required)

The following are only set after you accept analytics cookies via the cookie banner:

- Microsoft Clarity cookies — behavioural analytics including session recording. See Microsoft's privacy statement for the full cookie list.

We use Microsoft Clarity, a behavioural analytics service provided by Microsoft Corporation, to help us understand how visitors interact with the Platform. Microsoft Clarity records anonymised session data including mouse movements, clicks, and scroll behaviour. We do not pass your name or email address to Microsoft Clarity. Where you are signed in, we pass only a pseudonymous identifier — a one-way hash of your user ID — so that sessions can be linked across pages without Microsoft receiving any information that directly identifies you.

Microsoft Clarity sets cookies necessary for its operation. A full list of Clarity cookies and Microsoft's privacy practices are described at https://privacy.microsoft.com/en-us/privacystatement.

We do not use advertising cookies, retargeting cookies, or Google Analytics. Microsoft Clarity is the only third-party analytics service we operate.

You may withdraw consent to analytics cookies at any time by clicking "Cookie preferences" in the footer of any page. If you withdraw consent, Microsoft Clarity will be disabled for your session and future sessions on this device.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted connections (HTTPS), access controls, and secure hosting on Microsoft Azure.

No method of transmission over the internet is 100% secure. If you believe your account has been compromised, contact us immediately at support@cryptoartanalytics.io.

10. Children

The Platform is intended for professional use by galleries, art funds, and collectors. It is not directed at children under the age of 18. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice on the Platform. The date at the top of this page reflects when the policy was last updated.

12. Contact

For any privacy-related questions or to exercise your rights:

CAA Media Ltd
Company number: 16797709
Email: support@cryptoartanalytics.io