Payment Privacy Notice

1. Who is responsible

When you pay a gallery through an Orkest payment link, Angstroms Inc. is the merchant of record: we charge your card, receive the payment, and pass the proceeds to the gallery. We are responsible for the payment data we use for the purposes in this notice.

The gallery you paid is responsible for its own use of your data, such as your purchase, delivery, and its client records, under its own privacy notice. We handle that data for the gallery, on its instructions.

Contact:
Angstroms Inc. (Orkest)
10 Garden Avenue
San Rafael, CA 94903
United States
privacy@orkestai.com

2. Data we use and where it comes from

• From you, on the payment page: your name, email address, and card details, and your billing address if the page asks for it. You enter your card details on a page run by Stripe, our payment processor. We never receive your full card number; we see only the card brand, country, and last four digits.
• From Stripe: the amount, currency, date, payment method, card country, payment and transfer identifiers, and the result of Stripe's fraud checks.
• From the gallery: your name and email address as the gallery entered them on the invoice, what you paid for, and which gallery staff member issued the invoice or link.
• If you pay with stablecoin, where a gallery offers it: the transaction details we receive from Jeeves, our stablecoin payment partner, such as the amount, date, transaction reference, and wallet address.

We do not ask for sensitive personal data.

3. Why we use it

We use your data, on the legal basis shown:

• to take your payment and pass it to the gallery (to perform the payment you asked for);
• to prevent and investigate fraud, handle refunds and chargebacks, and follow card-network and payment-provider rules (our legitimate interest in secure and reliable payments);
• to support the identity, sanctions, and anti-money-laundering checks that our payment providers and banks run (our legitimate interest, and theirs, in lawful payments);
• to keep payment, accounting, and tax records (legal obligation); and
• to answer questions from you, the gallery, our providers, and authorities, to establish, exercise, or defend legal claims, and to run and secure the payment service (our legitimate interest).

We use your data only for these purposes. We do not sell it or use it for advertising. If you are in Mexico: all of these purposes are needed for your payment, and we have no secondary purposes.

4. Automated fraud checks

Stripe automatically screens every card payment for fraud. A payment may be declined or held for review as a result. If that happens, you can write to privacy@orkestai.com to ask for a person to review it and to give your point of view.

5. Who receives it

• the gallery you paid;
• Stripe, which processes card payments for us and also uses payment data for its own purposes, as an independent controller, under its own privacy policy;
• Jeeves and its providers, if you pay with stablecoin, which also act under their own terms;
• our service providers, which act on our instructions and keep your data confidential, including Notion, which holds our internal payout records (your name and, for some payments, your email address), and SendGrid, which sends invoice and payment emails. The full list is on our Subprocessors page; and
• banks, card networks, auditors, and professional advisers, and authorities where the law requires it or to protect rights or defend legal claims.

If you are in Mexico: we share your data with the gallery, Stripe, and Jeeves because this is needed for the payment you asked for, and our service providers act on our behalf, so neither needs your consent. We make no other transfers without your consent except where the law allows.

6. International processing

We are based in the United States. Your data is processed in the United States and in other countries where we and our providers operate. When you enter your details on the payment page, you give them directly to us in the United States to make your payment. When personal data is transferred to us or our providers from the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum and Swiss amendments where they apply, and, where a provider is certified, on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. You can ask privacy@orkestai.com for a copy of the relevant safeguard.

7. How long we keep it

We keep payment and transaction records for seven years after the payment, or longer if the law or an open dispute requires it. We then delete or anonymize them.

8. Your rights

Depending on where you live, you can ask to access, correct, or delete your data, to restrict its use, to receive a copy, and to object at any time to uses based on our legitimate interest. Records that the law requires us to keep cannot be deleted before that period ends. Email privacy@orkestai.com and tell us which right you are using; we may ask you to confirm your identity. You can also complain to your data-protection authority.

If you are in Mexico, you can exercise your rights of access, rectification, cancellation, and opposition (ARCO rights), revoke your consent where it applies, and ask us to limit the use or disclosure of your data. Email privacy@orkestai.com with your name, a copy of an identity document, the right you are exercising, and the data concerned. We respond within the periods set by the Federal Law on the Protection of Personal Data Held by Private Parties.

For the gallery's own use of your data, contact the gallery.

9. Changes to this notice

We will post any change on this page with a new date. When galleries move to their own Stripe accounts, we will update this notice to explain who is responsible for payments made after that change.