Privacy

The sanctuary is invite-only. We still owe you a clear account of what is kept, why, and for how long — especially if you are in the European Union.

Who is responsible

The controller of personal data for Obsidian Pieces (https://obsidianpieces.com/) is a natural person operating this sanctuary, not a company. There is no trade name, registration number, or VAT number to publish, because none exist. Write to contact@obsidianpieces.com for access, erasure, or any other request under the GDPR.

If the house later becomes a trade (a shop, a fee, a firm or PFA), this page will name that identity before money is taken. Until then the operator is reachable at the email above.

What we collect, and why

At the Gateway you may offer a name, an email address, a text, and optionally a PNG or JPG sketch (at most 4 MB, and no more than 4500 pixels on a side). We use this to decide whether the door opens. Sketches are stored outside the public web path and are shown only to moderators. The legal basis is your consent (GDPR Art. 6(1)(a)). You may withdraw it by writing to us; a withdrawn offering is not used for a later admission.

If you are admitted, we create a member account (name, email, role, login). That processing is needed to perform the membership (Art. 6(1)(b)). You may keep pieces in private galleries you name. We store the gallery name and which piece IDs you pointed to, not a second copy of the work. You may hang an MP3 in the chamber (at most 12 MB); it is stored outside the public web path and streamed only to admitted members.

A piece you hang may contain personal data you chose to put in it — a name, a face, a diary line. A photograph or a clear likeness of a living person is personal data under the GDPR. A recording of a voice is personal data too. We store and show that content only because you asked the house to hang the work. You may take the piece down; we then erase that copy from the sanctuary. House rules for faces, children, and music are in the Terms and the Content notice.

There is no shop and no checkout at present. We do not collect payment data. If a market opens later, this page will name the processor before any money is taken.

We set a small cookie that remembers you confirmed you are eighteen, so the gate does not appear on every page. That is a strictly necessary preference for access to adult artistic work (Art. 6(1)(f), and the ePrivacy exception for cookies required to provide a service you asked for). If you are signed in as a member, the gate is not shown; the membership already confirmed your age.

The web server may keep technical logs (IP address, time, requested address, browser string) for security and diagnosis. We do not run advertising, likes, or behavioural profiles.

Who else sees it

Moderators and administrators see offerings in a private queue. They are not published.

Admitted members may read hung pieces, keep pointers in private galleries, hang a resonance the author invited, and hear recordings in the chamber. Those files are not on a public URL.

The host that serves this site stores the database and files. When the sanctuary is in production, choose a host in the European Economic Area where possible.

Type is currently requested from Google Fonts. That is a network request to Google, not a cookie we set. No advertising is attached to it. Self-hosting the type is the cleaner path and is planned; until then this request is disclosed here. If you block that request, the house falls back to system type.

We do not sell personal data. We do not run ads.

How long we keep it

A pending offering is kept until a human decision is made.

A denied offering is kept only as long as needed to prevent the same address from being used to press the door again, then erased.

A member account lasts for the life of the membership, then is deleted or anonymised unless a law requires a fragment.

A piece you take down is erased from the sanctuary, including its private recording if it had one. We cannot erase copies that other people may already have made outside this house. Private galleries store only a pointer (the piece ID and the gallery name you chose). If the author takes the piece down, that pointer is deleted with it. A keep is not a copy.

Technical logs are not kept longer than needed for security — typically days or a few weeks, not years.

Your rights

If the GDPR applies to you, you may ask to access, correct, erase, or restrict what we hold; to object to processing based on legitimate interest; to receive a portable copy of data you gave us; and to withdraw consent without affecting the lawfulness of what was done before.

Vetting is a human reading, not an automated decision with legal effect.

You may lodge a complaint with your EU supervisory authority. If the operator is established in Romania, that authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

Children

This house is not for anyone under eighteen. We do not knowingly collect a child’s data. We do not accept photographs, videos, recordings of a child’s voice, or clear likenesses of anyone under eighteen — including as an “artistic” offering. If you believe we hold a child’s data or image, write to contact@obsidianpieces.com and it will be erased. Where the law requires it, we will inform the competent authority.

This is the house’s published notice for how the sanctuary is run. It is not personal legal advice.