Privacy Policy
What is collected, why, who else sees it, and what you can ask for. Written from the database schema and the request path, so it describes what the site actually does rather than what a template says it might.
Plain language, pending legal review.
This page was written from what the application actually does — the data it stores, the companies it hands data to, and what a subscription charges and when. It is accurate about the software. It is not legal advice, and no solicitor has read it yet.
Four things are still outstanding:
- The registered legal entity. Everything on the site — this page, the footer and the Licence — names the trading name "Taste". The company that actually holds the copyright, takes the money and answers for the data has to be named, with its company number and registered address.
- The registered address of the data controller, which a privacy notice is required to give.
- The governing law, and which courts would hear a dispute. That follows from the entity above, so it cannot be answered before it.
- The effective date of each document, and how existing members are told when either changes.
Who holds your data
Taste runs https://gotaste.art and decides what happens to the personal data described here. Taste is a trading name: the registered company and its registered address are not yet stated, which a privacy notice is supposed to give. That is being dealt with and it is the first item in the note above.
Anything on this page: hello@gotaste.art.
What is collected, and when
When you create an account: your first name, your last name and your email address. Your password goes to our login provider, which stores a hash of it — it is not in our database and nobody here can read it.
If you fill it in on your account page: a phone number. It is optional, nothing in the product uses it, no page shows it to anyone but you, and nothing will text or ring you. The account page currently says it is collected in case of emergencies; since we cannot point to a process that would use it, the honest position is that you should leave it blank, and the field is under review. You can clear it at any time.
When you subscribe: your card details are collected by Stripe, on Stripe’s own pages. We never see or store a card number. What we keep is the Stripe customer and subscription reference, which plan you are on, whether it is monthly or annual, its status, how many seats it has, when the current period ends, and whether it is set to stop at the end of it.
When you download an image: which account downloaded it, which image, which version of the file and the time. Nothing about the file itself is changed or marked.
If someone invites you to a seat on their Business plan: the email address they invited, when they invited it, and when you accepted. The invited address is stored before you have an account, because that is what the invitation is.
Automatically, on every visit: the ordinary request records our host keeps in order to serve a page, which include your IP address, plus page views and page-speed measurements from the analytics described below.
Why each of those is held
In the order above, and with the legal ground for each:
- Your name and email address — to run your account and to send the two emails an account needs: confirm your address, and reset your password. We need them to provide what you signed up for (performance of a contract).
- Your phone number — no current purpose, which is why the field is under review. If you have entered one, it sits in your profile row and nothing reads it.
- Your subscription and Stripe references — to take the payment you agreed to and to know whether the library should open for you (contract), and to keep the accounting records the law requires (legal obligation).
- Your download records — to enforce the Licence, to know which images are actually used, and to answer "did that download work" when you ask (contract, and our legitimate interest in protecting the licensed work).
- Request records and IP addresses — to serve pages, to keep the site up and to deal with abuse (legitimate interests).
- Analytics — to know which pages people use and whether they are fast enough (legitimate interests).
Your data is not used to advertise to you and is not sold or rented to anyone. There is no marketing list: the database has no subscriber table and no form on this site adds you to one. Nothing about you is decided automatically.
Cookies
One cookie matters: the session cookie set when you sign in. It is how the site knows it is you on the next page, it is refreshed as you move around, and it is removed when you sign out. Without it you cannot stay signed in, so there is nothing to consent to and nothing to switch off — it is the sign-in.
There are no advertising cookies, no social-network embeds and no third-party tracking scripts. The two typefaces the site uses are served from this site rather than from Google, so loading a page makes no request to a font service.
The site includes Vercel Web Analytics and Vercel Speed Insights, which count page views and measure how quickly pages render. They are not used to build a profile of you and they do not follow you to other sites.
Who else processes it
Three companies, each doing one job:
- Supabase — the database, the login system and the image storage. It holds your profile row, your subscription record, your download history and any team seats, and it sends the confirmation and password-reset emails.
- Stripe — payments. It holds your card details and your payment history, and it provides the billing portal you cancel from.
- Vercel — hosting, and the analytics above. Every request to this site passes through it.
There is nobody else. No CRM, no email marketing tool, no advertising network, no chat widget, no session recording.
All three are American companies, so your data may be processed outside the United Kingdom and the EEA. The region this site’s database actually sits in, and the safeguards each of the three relies on for those transfers, still have to be stated here — the second item in the note above.
How long it is kept
For as long as your account exists. There is no automatic deletion of inactive accounts and no automatic trimming of download history today. That is a gap rather than a policy, and setting a period is the third item in the note above.
When an account is deleted, the database removes your profile, your subscription record, your team seats and your download history in the same operation — that is enforced by the database itself, not by a script that might be forgotten.
Stripe keeps its own record of payments for as long as its own rules and tax law require. Deleting your account here does not delete Stripe’s accounting records, and we could not make it.
What you can ask for
If you are in the United Kingdom or the European Union, you have the right to see the data held about you, to have it corrected, to have it deleted, to restrict or object to what is done with it, and to be given a copy in a portable form. Where we rely on your consent for something, you can withdraw it.
In practice: your name and phone number you can correct yourself on your account page. For anything else — a copy of your data, or deleting the account outright — email hello@gotaste.art. We will answer within one month, which is the limit the law sets.
If you are unhappy with how we have handled it, you can complain to the Information Commissioner’s Office at ico.org.uk if you are in the UK, or to the data protection authority for your country in the EU. You do not have to come to us first, though it is usually quicker.
How it is kept safe
Passwords are hashed by the login provider and never stored in readable form. The database enforces access per row, so one member cannot read another member’s profile, subscription or download history even if the application asked it to.
Full-resolution image files live in a private store that is not reachable from the web. A download is released as a link that works for sixty seconds and is checked against your subscription at the moment you ask for it.
No system is perfectly secure and this page is not a guarantee. If there is ever a breach that affects you, we will tell you and the regulator within the time the law allows.
Children
This is a paid tool for people who make things for a living. It is not aimed at children and we do not knowingly collect data from anyone under 16. If you think a child has created an account, email us and we will remove it.
Changes to this policy
When this page changes it will carry the date of the change. If a change affects what is done with data already held, account holders will be emailed before it takes effect.
The 30-day trial, the plans and the cancellation terms are on the Terms of Service page rather than this one.