Privacy Notice

In brief

Albertson Product Development LLC operates galeria.casa and is responsible for the personal information described here. We use it to provide and secure the Service, communicate with you, and understand limited product use. We do not sell personal information, use behavioral advertising, perform facial or biometric identification, make sensitive inferences, or train generative-AI models on user content. Public gallery material is public; “unlisted” is not private. Contact [email protected] to ask about or exercise your privacy rights.

1. Who is responsible

Albertson Product Development LLC
4730 University Way NE, Suite 104, PMB 2838
Seattle, WA 98105, United States

Albertson Product Development LLC is the operator and data controller or responsible party for galeria.casa. Email the privacy function at [email protected].

This Notice covers the Service, including the waitlist, accounts, galleries, public pages, inquiries, invoices, support, security, and product analytics. It does not govern independent sites or services you choose to visit or connect.

2. Information we process

Depending on how you use the Service, we process:

• Account and eligibility information: name, email, password digest, account and membership records, invitation status, stated country of primary residence, and confirmation that you are at least 18. We do not routinely ask for a birth date or identity document to establish age.

• Gallery and public content: gallery profile, custom domain, works, articles, collections, exhibitions, events, text, credits, links, prices, availability, images, and other material you choose to publish or share.

• People depicted or mentioned: names, images, biographical information, credits, or other information in user content. The account holder—not the depicted person—may provide this information.

• Original media and metadata: uploaded image files and selected extracted metadata used for cataloging. Original files may contain embedded metadata. Public delivery versions are intended to remove embedded EXIF, GPS, and device metadata, but that technical property must be verified before publication of this Notice.

• Transactions and communications: inquiries, sender contact information, invoices, buyer and sale details, support messages, policy reports, copyright communications, and transactional email delivery records.

• Device, network, and usage information: IP address, browser and device details, request path, referring page, timestamps, session and security records, logs, error and performance diagnostics, pageviews, product events, titles or slugs, record identifiers, query strings, and aggregate funnel or duration fields.

• Imported or derived information: catalog CSV files and row errors, image variants, technical metadata, and status or count information produced while operating the Service.

Please do not send sensitive information that the Service does not request. Public content may reveal sensitive facts through what you choose to publish.

3. Why we use information

We use information to:

• create accounts, confirm eligibility, authenticate people, and manage invitations and collaborators;

• host, process, deliver, back up, organize, and export galleries and content according to account settings;

• support inquiries, invoices, transactional email, custom domains, and requested product features;

• secure the Service, prevent abuse and fraud, investigate incidents, debug failures, and enforce policies;

• respond to privacy, safety, copyright, support, and legal requests;

• understand limited first-party audience and product use and improve usability and reliability; and

• comply with law, preserve narrow records for legal or dispute needs, and protect rights and safety.

We do not use user content to train generative-AI models. We do not use facial recognition or biometric identification, infer sensitive traits, sell personal information, or serve behavioral advertising.

4. What other people can see

Material you publish as public may be viewed worldwide, indexed by search engines, linked, downloaded, cached, or copied. It may include information about artists, buyers, collaborators, and depicted or mentioned people. Make sure you have appropriate rights and permissions before publishing it.

“Unlisted” means omitted from ordinary listings; it is not access-controlled. A person who has or guesses the URL may view it. Password or opaque-link sharing provides only casual access control. Draft and administrative areas are intended for authorized account members, subject to the security and cache limitations of an online beta.

Changing visibility or deleting material does not guarantee removal from copies already held by other people, search engines, browsers, recipient mail systems, or lawful archives.

5. Service providers and international processing

We disclose information to service providers only as needed for functions such as:

• hosting, databases, object storage, backups, content delivery, and domain security;

• email delivery;

• image optimization;

• error, performance, and security monitoring;

• first-party product and audience analytics; and

• technical operations and certificate management.

Providers process information under their services and applicable agreements. We may also disclose information at your direction, to authorized collaborators, to recipients of messages or invoices, during a business transfer, to protect rights or safety, or when lawfully required.

The Service is operated by a U.S. company and uses infrastructure that may process information in the United States, Mexico, and other countries where providers operate. Those countries may have different privacy protections. This Notice does not claim that accounts are approved outside the United States and Mexico.

6. Analytics, monitoring, and cookies

We use essential cookies and similar storage for sign-in, security, preferences, and requested features. We also use separate first-party analytics datasets for public and administrative product activity. Analytics may include paths, query strings, referrers, device information, titles or slugs, record identifiers, and limited event fields useful for understanding the product. We do not create named-user advertising profiles or use cross-site behavioral tracking.

Operational monitoring may receive IP addresses, request paths, headers, user context, logs, and diagnostic messages needed for reliability, security, and abuse prevention. We do not deliberately send credentials, session cookies, payment details, inquiry bodies, or similarly sensitive content to analytics or monitoring. If we discover such a leak, we will treat it as a security and privacy issue.

7. Retention and deletion

We use three broad lifecycle rules:

1. Account and content data remains while the relevant account or user-controlled record exists, then is deleted or de-identified subject to the limits below.

2. Transient operational data—such as expired sessions, obsolete tokens and invitations, import artifacts, queue data, logs, analytics, and diagnostics—is kept for a configured period appropriate to operations and security, then removed or aggregated.

3. Required exception records are kept only when reasonably needed for accounting, security, fraud prevention, a dispute, a legal hold, or another legal obligation.

When account closure is available, access will be disabled promptly and deletion from active systems will be targeted within 30 days. Ordinary backups are targeted to expire within 90 days. Restoration controls are intended to prevent deleted data from silently returning. These are operational targets, not a guarantee that we can recall public copies held by others. Narrow exception records and recipient-controlled copies may last longer.

You may delete supported user-created records. Some deletion and account-wide export/closure controls are still being implemented during the beta; until they are available, email [email protected]. An export provides the highest-quality version then stored, which may not be the untouched original upload.

8. Security and incidents

We use administrative, technical, and physical measures appropriate to a small beta, including access controls, encrypted transport, password hashing, restricted administrative access, and backups. No online service is perfectly secure, and we do not guarantee confidentiality, uninterrupted availability, or recovery of every item.

If we identify a security incident affecting personal information, we will investigate, contain, document, and notify affected people and authorities when applicable law requires it.

9. Your choices and requests

You may update certain account, gallery, and content information in the Service and control content visibility. You may unsubscribe from optional waitlist or product marketing communications; service, security, policy, and transactional messages may still be necessary while you have an account or active request.

Email [email protected] to request:

• access to or a copy of personal information;

• correction of inaccurate information;

• deletion or cancellation, account closure, or withdrawal from the waitlist;

• objection to or restriction of a particular use where applicable;

• revocation of consent where processing depends on consent; or

• information about our processing.

Describe the account, data, and request. We will verify identity proportionately—normally through control of the account or email and information related to the request. We will not ask for government identification unless reasonably necessary and no less intrusive method is sufficient. An authorized agent must identify the person, provide proof of authority, and verify their own identity; we may also confirm the request directly with the person.

Rights and exceptions vary by location. We may deny or limit a request when permitted by law, cannot verify it, must protect another person, or must preserve a narrow record. We will explain the reason when permitted.

Mexico: ARCO rights

If Mexican privacy law applies, you may exercise rights of access, rectification, cancellation, and opposition (ARCO) independently; one is not a prerequisite for another. Send the request to [email protected] with your name, a means to receive our response, a clear description of the personal data and right involved, information that helps locate the data, and evidence of identity or representation proportionate to the request. For rectification, describe the correction and include supporting information.

We will communicate our determination within the legally applicable period—generally no more than 20 days after receipt under the Mexican private-sector framework—and, if granted, carry it out within the following applicable period, generally 15 days. Lawful extensions and exceptions may apply. Exercising ARCO rights is free; only legally permitted reproduction or delivery costs may apply. You may also revoke consent or ask to limit use through the same address. Revocation is not retroactive and may make it impossible to continue a requested service.

10. Age policy

Accounts are for people age 18 or older. We do not knowingly approve accounts for minors and do not routinely collect birth dates or identity documents for age verification. If we learn that an account holder is under 18, we may suspend access and remove the account and content while preserving only what law or safety requires. Report a concern to [email protected] or [email protected].

User content may depict or discuss minors. The Content Guidelines impose strict safety rules, including a prohibition on sexualized depictions and, for this beta, real or photorealistic nude imagery of minors.

11. Changes to this Notice

We will publish the current version and effective date. We will provide reasonable advance notice of material changes and request fresh acceptance when a change materially affects the agreement. Earlier versions remain in version control. Contact us with questions before a change takes effect.

12. Contact

Albertson Product Development LLC
4730 University Way NE, Suite 104, PMB 2838
Seattle, WA 98105, United States
[email protected]