Effective 27 July 2026
Legality (app.legality.art) is a portfolio and licensing platform for artists. For anything related to your data, write to main@legality.art.
Your account. Email address and password (stored only as a cryptographic hash by our authentication provider). We need these to sign you in.
Your profile. Display name, bio, website, social links, logo, and an optional portfolio PDF. You choose what to fill in; it is shown to the brands you share links with.
Your works. Images you upload, their technical metadata (including EXIF data such as creation dates), sketches, file fingerprints (SHA-256), and the dates on which files were sealed. This is the core of the service: establishing and preserving proof of your authorship.
Your business records. Clients, deals, licences, invoices, and bank details you enter for invoicing. These are visible only to you.
Brand and guest data. When a brand requests access to a portfolio, we collect the name, company, and email they submit. When a guest opens a shared portfolio, deal page, or downloads a file, we record the event with its date and time in the author's access journal. This journal exists so that authors can prove who saw their work and when — evidence that matters in copyright disputes.
Early access requests. If you ask for early access from our public page, we keep the name, email address, kind of work, portfolio link and note you send us. We use them to answer you and to decide whom to invite, and for nothing else.
Technical data. Standard server logs kept by our infrastructure providers for security and reliability.
We do not sell data. We do not show ads. We do not track you. There are no analytics scripts of any kind on this platform.
All application data is stored in the European Union:
These providers act as our processors and do not use your data for their own purposes.
Your works, clients, finances, and journals are visible only to you. A brand sees only what you deliberately share through a link you create, and you can revoke a link at any time. Certificates of authorship are public pages by design — that is what makes them useful as proof.
Early access requests are kept until we have answered them and for up to twelve months afterwards, so that we can remember whom we already wrote to; ask us at any time and we delete yours sooner. Your data stays as long as your account is active. Access journals and seals are kept for as long as the related work may need proof — this is the point of the service. If you delete your account, we delete your data, except records we must keep for legal reasons (for example, invoices) or records that are part of an active dispute.
Under the GDPR you can ask us to show you the data we hold about you, correct it, export it, or delete it. Write to main@legality.art and we will respond within 30 days. These requests are currently handled personally, not by an automated tool.
If you believe we are mishandling your data, you can complain to your local data protection authority.
We use only the essential cookies needed to keep you signed in. No advertising or tracking cookies.
If this policy changes in a way that matters, we will tell you by email before the change takes effect.