Privacy Policy

1. Who we are

PassTheBrush is operated by Nocap Consortium F.Z.E., which is responsible for the personal data described in this policy. You can contact us about privacy matters at compliance@passthebrush.com.

2. Information we collect

Account information

When you register, we collect your first name, last name, email address and a password. Your password is stored only in a securely hashed form; we never store it in readable form. Your name is not shown publicly and is not sent to Google Analytics or included in the information we pass to Stripe. We also record whether and when your email address was verified, when you last signed in, and the number of recent unsuccessful sign-in attempts (used to protect your account).

Sign-in, verification and password reset

When you sign in, we create a session so that you stay signed in, and a security token that protects your account against cross-site request forgery. When we send you an email verification or password reset link, we store a securely hashed version of the one-time token in that link, together with its expiry time.

Reservations and contributions

We record the segments you reserve, when the reservation was made and when it expires, the colours you select, and the resulting contribution once payment is finalised.

Terms and checkout acknowledgements

When you register, we record that you accepted our Terms & Conditions, when you did so and which version you accepted.

Before each checkout, we record the right-of-withdrawal acknowledgement you confirm: the exact wording shown to you, the segments it covers, when you confirmed it, the related purchase and payment session, and a hashed (pseudonymised) form of your IP address. We include a copy of this acknowledgement in your purchase confirmation email.

Purchase and payment information

We keep records of your purchases, including the amount, currency, status and the reference identifiers issued by our payment processor, Stripe. We also keep the payment notifications Stripe sends us to confirm a payment; these may include details you provide to Stripe at checkout, such as your name, email address and billing country. We do not receive or store your full card number or security code; these are collected and handled by Stripe.

Security and audit information

To protect the Service and investigate misuse, we record security-related events (such as registrations, sign-ins, failed sign-ins, reservations, checkouts and payment outcomes) with the time they occurred. These records include a hashed (pseudonymised) form of the IP address from which the request was made, rather than the address itself. The same hashed value is used to apply rate limits that prevent abuse.

Analytics information (only with your consent)

If you accept analytics cookies, we use Google Analytics 4 to understand how visitors use the website. See section 5 below.

3. How we use your information

• to create and manage your account and keep you signed in;
• to verify your email address and let you reset your password;
• to reserve segments for you, process your payment and permanently record your finalised contribution;
• to send you service emails, such as verification, password reset and purchase confirmation emails;
• to protect the Service, prevent fraud and abuse, and keep audit records of payments and contributions;
• to keep a record of the Terms you accepted and of the right-of-withdrawal acknowledgement you confirmed at checkout;
• to understand how the website is used and improve it, where you have consented to analytics; and
• to comply with our legal, tax and accounting obligations.

We do not sell your personal data and we do not use it for advertising.

4. What is shown publicly

The public artwork shows which segments are reserved or finalised and the colour of each finalised segment. It does not publicly show your name, email address or other account details.

5. Analytics and cookies

Google Analytics is loaded only after you accept analytics cookies in our cookie banner. Before that, no request is made to Google Analytics. When enabled, we send page views and a limited set of product events (such as viewing the artwork, selecting a segment or colour, completing registration, starting checkout and completing a purchase, with the number of segments, value and currency). We do not send your name or email address to Google Analytics. Advertising features and Google Signals are not enabled.

You can change your choice at any time using “Cookie Settings”. For details of the cookies we use, see our Cookie Policy.

6. Who we share information with

We share personal data only with service providers that help us run the Service, and only as needed for that purpose:

• Stripe – payment processing. We pass your email address and internal reference numbers to Stripe when you start checkout. Stripe processes your payment details under its own privacy policy.
• Resend – delivery of service emails.
• Google – website analytics, only where you have consented.
• Hosting and infrastructure providers – hosting the website and database, and delivering and protecting website traffic.

We may also disclose information where required by law, or where necessary to establish, exercise or defend legal claims.

7. International processing

Our service providers may process personal data in countries other than the one in which you live, including countries whose data protection laws may differ from yours. Where required by applicable law, we take steps to ensure that appropriate safeguards are in place for such transfers.

8. How long we keep information

We keep personal data only for as long as necessary for the purposes described in this policy. In particular:

• sign-in sessions expire after 30 days, or earlier if you sign out;
• email verification links expire after 24 hours;
• password reset links expire after 30 minutes;
• records of finalised contributions are kept permanently, because they form part of the artwork; and
• purchase, payment and security records, including records of Terms acceptance and checkout acknowledgements, are kept for as long as needed to operate the Service, resolve disputes and meet legal, tax and accounting obligations.

9. Security

We use technical and organisational measures designed to protect personal data, including hashed passwords and tokens, secure cookies, access controls with multi-factor authentication for administrative access, and rate limiting. No method of transmission or storage is completely secure, but we work to protect your information.

10. Your rights

Depending on the laws that apply to you, you may have rights to access, correct or delete your personal data, to restrict or object to certain processing, to receive a copy of your data, and to withdraw consent at any time (for example, to analytics cookies). You may also have the right to complain to a data protection authority.

To exercise your rights, contact compliance@passthebrush.com. We may need to verify your identity before responding. Because finalised contributions form a permanent part of the artwork, some records relating to them may need to be kept even if other account data is deleted.

11. Changes to this policy

We may update this policy from time to time. We will publish the updated version on this page and, where appropriate, notify you.

12. Contact

For any questions about this policy or how we handle your personal data, contact compliance@passthebrush.com.