Privacy Policy

1. Who We Are

Qurio is operated by Qurio LLC, registered in Wyoming, United States. Website: qurio.art. Contact: hello@qurio.art. We create and sell original layered crystal wall art to collectors worldwide.

2. Information We Collect

Information you provide:

• Account information: name, email address (when you create an account via Google, Apple, or email)
• Purchase information: shipping address, phone number (during checkout — processed by Stripe)
• Profile information: display name, location, bio, avatar (optional)
• Communication: messages you send us via email or contact forms
• Auction participation: bid amounts and timestamps
• Commission requests: your vision description, preferences, and reference images
• Newsletter and waitlist: email address

Information collected automatically:

• Analytics: page views, session duration, referral source (via Google Analytics — anonymized)
• Device information: browser type, operating system (for website optimization only)
• We do NOT use cookies for tracking or advertising
• We do NOT sell, rent, or share your personal data with third parties for marketing

3. How We Use Your Information

• To process and fulfill your orders
• To create and maintain your account
• To provide Certificate of Authenticity and provenance records
• To send order confirmations, shipping updates, and delivery notifications
• To process auction bids and notify winners
• To send newsletter updates (only if you opted in — you can unsubscribe anytime)
• To respond to your inquiries and improve our service
• To prevent fraud and ensure auction integrity

We will never use your information for targeted advertising.

4. Payment Security

All payments are processed by Stripe — Qurio never sees, stores, or has access to your credit card numbers. Stripe is PCI DSS Level 1 certified — the highest level of payment security. We store only: the last 4 digits of your card (for your reference), transaction IDs, and payment status.

5. Provenance & Public Information

When you acquire a piece, your city and country may be displayed on the provenance record (e.g., “Acquired — New York, US”). Your full name and address are never displayed publicly. If you enable a public collector profile, only your display name, city, and owned pieces are visible — you control what is shown. You can disable your public profile at any time in account settings.

6. Data Sharing

• Stripe: payment processing (name, email, address, payment details)
• ShipEntegra / UPS / DHL / FedEx: shipping (name, address, phone — necessary for delivery)
• Resend: email delivery (email address only — for transactional and newsletter emails)
• Google Analytics: anonymized usage data (no personally identifiable information)

We do not share data with advertisers, data brokers, or social media platforms. We do not sell your data — ever.

7. Data Retention

• Account data: retained as long as your account is active
• Order and provenance data: retained permanently (ownership history must persist for the lifetime of the artwork)
• Newsletter subscribers: retained until you unsubscribe
• Waitlist entries: retained until notification is sent, then deleted after 30 days
• Analytics data: anonymized, retained for 26 months

8. Your Rights

• Access: request a copy of all data we hold about you
• Correction: update or correct your personal information at any time via account settings
• Deletion: request deletion of your account and personal data — provenance records are maintained but your details will be anonymized
• Portability: request your data in a machine-readable format
• Opt-out: unsubscribe from newsletters and notifications at any time

To exercise any of these rights, contact hello@qurio.art — we will respond within 30 days.

9. Children

Qurio is not directed at individuals under 18. We do not knowingly collect information from minors.

10. Security

All data is transmitted over HTTPS. Database hosted on Supabase with row-level security. If a data breach occurs, affected users will be notified within 72 hours.

11. International Transfers

Your data may be processed in the United States (Vercel, Supabase) and the European Union (Stripe, Cloudflare). For EU residents: data transfers are covered by Standard Contractual Clauses.

12. Cookies

We use only essential cookies for authentication. We use Google Analytics with anonymized IP addresses. We do not use advertising cookies, tracking pixels, or third-party marketing cookies. No cookie consent banner is required — but we tell you anyway because transparency matters.

13. Changes

We may update this policy as our practices evolve. Significant changes will be communicated via email.

14. Contact

Questions about your privacy: hello@qurio.art

Qurio LLC, Wyoming, United States