Privacy Notice
Version: draft · Draft updated: 2026-10-12
This is a translation; in case of any difference, the Hungarian version prevails.
Currently only the website and the launch waitlist operate; sections 3, 4, 6, 7 and 9 also apply to them. The account, portfolio, chat and review sections describe planned processing for the app’s later launch. Legal review of planned retention limits and verification of missing deletion settings take place before the relevant feature launches.
1. The controller
Controller: OFFICEXPERTS Kft. (registered office: Gyár utca 2., 2040 Budaörs, Hungary; company registration number: Cg. 13-09-197492; tax number: 14585641-2-13). For privacy questions and requests, write to privacy@yartist.app.
2. What we process, why and for how long
| Data | Legal basis | Retention |
|---|---|---|
| Account and profile (name, email address, profile picture, bio, crafts, rate, town) | Performance of the contract | Until the account is deleted; then a 30-day grace period, then anonymisation |
| Portfolio (images, videos, captions) | Performance of the contract | Until the work or the account is deleted (with the files) |
| Gigs, interest (swipes), matches | Performance of the contract | Until the account is deleted; then without personal data (anonymised) |
| Chat (messages, images) | Performance of the contract; after unmatching or account deletion, legitimate interest (investigating fraud and harassment, legal claims) | For 90 days after unmatching or the final deletion of the account, visible to no one, then deleted automatically; with an open report or procedure, until it is closed |
| Reviews (stars, criteria, text; who reviewed whom after which work) | Legitimate interest (reliable reviews for the users) | While the reviewed account exists. In public the author's first name and profile picture (a company's name and logo) and the work's title show, never the surname or contact details. When the reviewed account is deleted, the reviews about it are deleted; when the author's account is deleted, only the stars remain. A review removed by a moderator stays with the moderation records |
| Location | Performance of the contract | Only the chosen town; the exact coordinates of the “My location” button are not stored. Other users see only the town and a rounded distance |
| Moderation: reports, decisions, appeals, removed reviews | Legitimate interest, legal obligation (DSA) | Planned retention of closed cases and removed reviews: 2 years from case closure; the deletion rules remain to be implemented |
| Moderator audit log (action, time, affected identifier, IP address) | Legitimate interest (security, accountability) | 1 year from creation (planned rule; the deletion mechanism remains to be implemented) |
| Banned identifiers (hashed email, Apple and Google IDs) | Legitimate interest (preventing return) | 2 years from the ban (planned rule; the deletion mechanism remains to be implemented) |
| Usage statistics (PostHog) | Consent (can be withdrawn in the app at any time) | At most 12 months (planned upper limit; production PostHog retention remains to be verified) |
| Push notifications (device token) | Consent (the phone's permission) | Until sign-out or the permission is withdrawn |
| Transactional emails (codes, notifications) | Performance of the contract | The sending log until the account is deleted |
| Server logs | Legitimate interest (security) | At most 90 days (planned upper limit; production time-based deletion remains to be configured and verified) |
| Backups | Legitimate interest | 30-day rotation |
What other users see about you: your name (for clients, the display or company name), profile picture, bio, crafts, rate, town and portfolio. Your email address, phone number and exact location are never shown to anyone else.
During an open legal dispute or authority procedure, retention may be extended until its closure only for the data and evidence needed for that case. Necessity is reviewed regularly; retention of all data is not extended automatically.
3. Usage statistics
Only if you allow it (“Help improve the app”), the app sends to PostHog's EU servers which screens and features you use (e.g. the sign-up steps, cards viewed). You appear under your account ID, without your name, email address, messages or IP address; when you withdraw consent, sending stops at once. There is no advertising tracking. The website uses no tracking cookies or advertising tracking. Your browser remembers only your light/dark appearance choice; this is not added to the waitlist and is not used for tracking.
4. Processors
| Provider | Task | Data location |
|---|---|---|
| BlazeArts Kft. (FORPSI) | Server, database, email sending | EU |
| Cloudflare (R2) | Image and file storage, CDN | Production R2 storage: planned EU jurisdiction; to be verified before launch |
| Mux | Portfolio videos | USA |
| Expo, Apple, Google | Push notifications, Apple and Google sign-in | USA |
| PostHog | Usage statistics (only with consent) | EU |
| Sentry | Error logs | EU region |
Before the app’s later launch, we will finalise transfers outside the EU, the processor agreements with the relevant providers and the applicable safeguards; their legal review remains pending. Town data comes from the public GeoNames database (geonames.org, CC BY 4.0); no personal data is sent to it.
5. Account deletion and data export
You can delete your account in the app; after a 30-day grace period your personal data is deleted or overwritten (anonymised), and your portfolio is deleted with its files. Details: Delete account. You can download your data as a ZIP file (Settings → Download my data); the link is valid for 7 days.
6. Your rights
You may request access to, rectification or erasure of your data, restriction of processing and data portability, and object to processing based on legitimate interest; you can withdraw consent at any time. We answer within one month. You may also complain to the Hungarian data protection authority (NAIH, naih.hu), or go to court.
7. Security
Passwords are stored in a non-reversible form and connections are encrypted. Published versions of portfolio images, profile pictures and Gig images are available in public storage. Chat images, originals kept for recropping and data exports use private storage with time-limited access links. Moderators can view a chat only through a report; moderator access is logged.
8. Age limit
Yartist is not meant for people under 18; we do not knowingly process minors' data.
9. Signing up for the launch (website)
If you sign up on the website, we store your email address, the language you chose and – if you give it – your role (professional, client), to tell you when the app launches. The legal basis is your consent. First we send a confirmation email: if you do not confirm within a week, we delete your address. You can unsubscribe at any time with the link at the bottom of our emails, which deletes your address at once; after the launch notice we close the list.
To record consent, we also store the accepted privacy notice version, sign-up and modification times and confirmation time. We keep a non-reversible hash of the confirmation and unsubscribe link identifier. Unconfirmed sign-ups older than one week are removed by daily cleanup. Signing up does not create an app account, start a subscription or create a payment obligation.
Earlier versions
This is the first published version.