This Privacy Policy explains how Santallana Technology Corporation (DBA "Artiflex Studio") collects, uses, shares and protects information. We respect your privacy: we use only first-party analytics, and we do not sell your personal information or use it for third-party advertising.

Scope. This policy applies to: (a) the artiflexstudio.com website, (b) the Artiflex Studio mobile app for iOS, and (c) the public NFC card profiles served at artiflexstudio.com/nfc-cards/{cardId}.

Mobile App scope. The Artiflex Studio iOS app does not initiate AI chatbot conversations, does not access the WhatsApp messages stored on your device, and does not send your data to OpenAI. Sections below that refer to the WhatsApp Business AI chatbot apply only to support requests initiated from our website. They are included here so the policy covers every Santallana service in one place.

1. Information We Collect

• Account data: name, email, preferred language
• Business / profile data: company name, address, phone numbers, description, images, social links and custom links you add to your card
• Technical data: IP address, browser, device type and approximate location (country, city and region derived from your IP)
• Card view analytics (public profiles): when someone opens a public NFC card, we log the date and time of the visit, the approximate location (country / city / region, from IP), device type, browser, and the referral source. We use this to show the card owner their own view statistics. This is first-party analytics — it is not sold and is not used for advertising.
• Payment data: handled securely by Stripe (web checkout) or by Apple In-App Purchase and RevenueCat (iOS app). We do not store card numbers.
• WhatsApp data (website only): phone number, message content and conversation history when you interact with our AI chatbot via WhatsApp Business

2. How We Use Information

We use the data to:

• Provide, operate and improve our services
• Authenticate you and keep you signed in
• Display your business information in the public views of your card
• Produce view analytics and statistics for card owners
• Communicate updates, alerts and technical support
• Respond to customer inquiries via our AI-powered WhatsApp chatbot (website only) and analyze conversation patterns to improve those responses

3. User Responsibility

Users are responsible for verifying that the content they publish (contact details, prices, descriptions, images) is correct and does not violate the law.

4. Prohibited Content

It is not permitted to upload images or texts that are illegal, offensive, discriminatory or that infringe copyright.

5. Cookies and Similar Technologies

• Strictly necessary: a session cookie (authToken) that keeps you signed in. The service does not work without it.
• Functional browser storage: we use your browser's local storage for preferences such as your language, a visitor identifier for the website chatbot, and your biometric sign-in choice in the mobile app.
• No advertising or third-party tracking. We do not use advertising cookies, third-party analytics cookies (such as Google Analytics), or cross-site tracking. Our card view analytics are first-party and recorded on our own servers.

6. Storage and Security

• We use Cloudflare and other infrastructure providers to host and protect data
• We implement SSL/TLS encryption and security measures to prevent unauthorized access
• Data may be stored on servers inside and outside the United States, with appropriate safeguards, in compliance with applicable data protection regulations

7. Service Providers and Third Parties

We share data only with the service providers needed to run Artiflex Studio:

• Stripe (web payment processing)
• Apple Inc. (In-App Purchase transactions when you subscribe through the iOS app)
• RevenueCat (iOS subscription management — receives the Apple transaction ID and our internal user ID to associate the purchase with your account; does not receive payment card data)
• Cloudflare (hosting, content delivery, image storage and security)
• Resend (delivery of transactional emails such as verification, alerts and receipts)
• Shippo (shipping rates and labels when you order a physical product from our store — receives the shipping address for that order)
• Apple and Google (Sign in with Apple / Sign in with Google authentication, and Google Places for address autocomplete at checkout)
• WhatsApp Business Platform (Meta) for chatbot messaging (website only)
• OpenAI for AI-powered chat responses (website only, message content only, no personal identification data)

We use first-party analytics only — we do not use Google Analytics or any third-party advertising or analytics tracker. We do not sell your personal information, and we do not share it for cross-context behavioral advertising (sometimes called "selling" or "sharing" under state privacy laws).

7.1 WhatsApp Business Integration (website only)

When you interact with our AI chatbot via WhatsApp Business through our website:

• Your messages are processed through Meta's WhatsApp Business Platform
• Message content is sent to OpenAI's API for AI-powered responses
• We store conversation history to provide contextual responses and improve service quality
• Your phone number is used solely to maintain conversation context and respond to your inquiries
• You can request deletion of your conversation history at any time by contacting support
• We comply with WhatsApp Business Policy and Meta's Platform Terms

8. Data Retention

• Account and profile data is retained while your account is active.
• Account deletion: when you delete your account it is deactivated and recoverable for 30 days; after that it is permanently deleted, including your profile and card images.
• Card view analytics are retained to provide ongoing statistics to the card owner, and are removed when the card or account is deleted.
• WhatsApp conversation history can be deleted on request at any time.

9. Your Privacy Rights

You can request access to, correction of, update of, or deletion of your personal data, subject to applicable law. To exercise any right, email support@artiflexstudio.com.

• EEA / UK (GDPR): you have the rights of access, rectification, erasure, restriction, portability and objection. Our legal bases are your consent and/or our legitimate interest in operating the service.
• California (CCPA/CPRA): you have the right to know, delete and correct your personal information, and to opt out of its sale or sharing. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of.

10. Children's Privacy

Artiflex Studio is intended for businesses and adults. It is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to This Policy

We may update this Policy at any time. We will update the date above and notify users of material changes.

Contact

For questions about this Privacy Policy or to exercise your rights, contact us at:
Email: support@artiflexstudio.com