Privacy Policy

VuVu Gallery is an online art marketplace operated by VuVu (sole proprietorship). Our website address is https://www.vuvu.nl.

Questions about this policy? Contact us at hello@vuvu.nl or write to: Darwinstraat 53, 2571 DG, The Hague, Netherlands.

When you create an account or submit an inquiry, we collect: your email address, name, and any shipping address or message you provide.

When you browse the website, we may collect: your IP address (anonymised before storage), browser type, pages visited, and referring URL. This data is used solely to maintain the security and performance of the service, including rate limiting.

When you complete a purchase via a Stripe payment link, Stripe processes your payment. We do not store full card numbers or sensitive payment credentials on our servers.

We use the information we collect to: process and fulfil your orders; send order confirmations and shipping updates; respond to your support requests and dispute submissions; calculate applicable taxes and shipping costs; prevent fraud and maintain platform security.

We retain order information for as long as required for tax, accounting, and legal obligations (typically 7 years). Account data is retained for the lifetime of your account and deleted upon request.

VuVu Gallery uses Supabase for authentication. When you sign in with your email address and password, we store a secure session token in your browser. This token expires automatically and contains no sensitive personal data.

Your password is never stored in plain text. It is hashed and managed securely by Supabase.

We use strictly necessary cookies and local storage entries to maintain your session and remember your preferences (such as your shopping cart). No third-party advertising or tracking cookies are set.

You can clear cookies at any time through your browser settings. Clearing session cookies will sign you out.

Artwork images uploaded to VuVu Gallery are analysed via VuVu's reading system, using the Anthropic Claude API. Anthropic processes these images under a no-training data policy: images are not stored by Anthropic beyond the duration of a single API call and are never used to train Anthropic models.

For more information, see the Anthropic privacy policy at https://www.anthropic.com/legal/privacy.

Payments are processed by Stripe, Inc. After agreeing on a purchase, you receive a secure Stripe payment link. VuVu Gallery does not see or store your card number, CVV, or other sensitive payment details.

Stripe’s privacy policy is available at https://stripe.com/privacy.

To generate shipping rates and purchase labels, we share your shipping address with Shippo (our shipping API provider). Shippo uses this data solely to produce carrier rates and labels.

Your shipping address is also shared with the relevant carrier (e.g., PostNL, DHL) for the purpose of delivering your order.

We send transactional emails (inquiry confirmations, order updates, shipping notifications) via Postmark. These emails are sent to the address you provided when inquiring or registering.

We do not send unsolicited marketing emails. If you have consented to marketing communications, you can unsubscribe at any time by emailing jmo@vuvu.nl.

VuVu Gallery staff (the founder) has access to order and customer information to fulfil orders, process refunds, and provide support.

We do not sell your personal data to third parties. We share data only with the service providers listed in this policy (Stripe, Shippo, Anthropic, Postmark, Supabase) and only to the extent necessary to operate the service.

Under the GDPR and applicable Dutch law, you have the right to: access the personal data we hold about you; correct inaccurate data; request deletion of your data; object to or restrict processing; and receive a portable copy of your data.

To exercise any of these rights, email hello@vuvu.nl. We will respond within 30 days.

All data is stored in Supabase (hosted in the EU). Access is protected by row-level security policies. Data in transit is encrypted using TLS. We apply the principle of least privilege: service accounts access only the data they need.

Despite these measures, no system is completely secure. If you become aware of a security issue, please report it to hello@vuvu.nl.

Some of our service providers (including Stripe and Anthropic) are headquartered in the United States. Data transfers to the US are conducted under standard contractual clauses or other appropriate safeguards as required by the GDPR.

VuVu Gallery is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. The date at the top of this page indicates the most recent revision. Continued use of the website after changes are posted constitutes acceptance of the updated policy.

For any privacy-related questions or requests, contact us at: