Effective date: 21 July 2026
Last updated: 23 July 2026

1. About this privacy policy

Artist Archive is a mobile app designed to help makeup artists, hairstylists and hair and makeup artists keep organised records of their clients, trials, appointments, products, notes and photographs.

In this privacy policy:

• “Artist Archive”, “we”, “us” and “our” refer to Stephanie Garrett, trading as Artist Archive.

• “You” and “your” refer to the artist who creates and uses an Artist Archive account.

• “Client” refers to a person whose information is entered into the app by an artist.

This privacy policy explains what personal information Artist Archive collects, why it is collected, how it is used and protected, who it may be shared with, and the rights individuals have in relation to it.

Artist Archive is operated by Stephanie Garrett as a sole trader based in New Zealand.

Artist Archive is subject to the New Zealand Privacy Act 2020. Other privacy laws, including the EU or UK General Data Protection Regulation and the Australian Privacy Act 1988, may also apply in some circumstances.

2. Information about artists and clients

Artist Archive handles two main types of personal information.

Information about you as an artist

This includes the information needed to create, manage and secure your Artist Archive account.

For this information, Artist Archive is responsible for deciding how and why the information is handled.

Information about your clients

This includes client details, consultation notes, appointment records, products and photographs that you choose to enter into the app.

You decide what client information is collected and entered into Artist Archive. You are responsible for ensuring that you have a lawful and appropriate reason to collect, store and use that information.

Artist Archive stores and processes client information on your behalf so that we can provide the app.

Where the GDPR applies, you will generally be the data controller of your clients’ information and Artist Archive will act as your data processor.

3. Information we collect

3.1 Account information

When you create and use an Artist Archive account, we may collect:

• Your email address.

• Your name, if you choose to provide it.

• Your professional role, such as makeup artist, hairstylist or both.

• Your account creation date.

• Your email verification status.

• Basic account and subscription information.

• Information needed to authenticate and secure your account.

If you create an account using an email address and password, your password is managed by our authentication provider. Artist Archive does not receive or store your password in readable form.

If sign-in through Apple or Google is available and you use that option, we may receive confirmation of your identity and limited account information, such as your name or email address, depending on the information you have chosen to share through that provider.

We do not receive your Apple or Google password.

3.2 Client information entered by artists

The information you choose to enter about a client may include:

• The client’s name.

• Their phone number or email address.

• Event or appointment dates.

• Preparation locations and other event details.

• Consultation notes.

• Skin type and undertone.

• Hair texture, thickness and length.

• Allergy or sensitivity information.

• Details of trials, sessions and appointments.

• Products used.

• Adjustments or changes made to a look.

• Tags and additional notes.

• Photographs.

• A record of whether the client has consented to you publicly sharing their photographs.

You control what information you enter. You should only record information that is reasonably necessary for your work and that you are permitted to collect and store.

3.3 Photographs

When you add a photograph to Artist Archive, the image is uploaded to and stored using our cloud storage provider.

The app may compress or resize photographs before uploading them. We may also store information associated with a photograph, including:

• The date it was added.

• Its file type or file size.

• The client or session it relates to.

• A label or description you have added.

Photographs of identifiable people are personal information.

Artist Archive does not currently use facial recognition or use client photographs to identify, authenticate or profile people.

3.4 Device permissions

Depending on the features you use, Artist Archive may request permission to access:

• Your device camera, so you can take and add photographs.

• Your photo library, so you can select and upload existing photographs.

• Notifications, if app notifications are offered.

These permissions are used only to provide the feature you choose to use.

You can manage device permissions through your phone or device settings. Disabling a permission may prevent the related feature from working.

Artist Archive does not automatically access or upload your entire photo library.

3.5 Technical and service information

We and our technology providers may automatically process limited technical information needed to operate, secure and maintain the app, including:

• Your app version.

• Device and operating-system information.

• Login and authentication events.

• Network and security information.

• Dates and times of service requests.

• Error information.

• Records used to detect misuse, investigate faults and maintain security.

We do not use this information for behavioural advertising.

If we introduce a separate app analytics or crash-reporting service in the future, we will update this privacy policy before or when that service is introduced.

3.6 Support communications

If you contact Artist Archive for support, we may collect:

• Your name and email address.

• The contents of your message.

• Screenshots or other information you choose to provide.

• Relevant account or technical information needed to investigate your request.

Please avoid sending client information through ordinary email unless it is genuinely necessary for us to assist you.

3.7 Website and waitlist information

If you visit the Artist Archive website, contact us through the website or join a waitlist, we may collect information such as:

• Your email address.

• Your name, if requested.

• The contents of a contact form or message.

• The date and source of your registration.

• Basic website and device information.

• Cookie and analytics information, where applicable.

We use waitlist information to provide launch news and other updates you have requested. You can unsubscribe from these communications at any time using the unsubscribe option in the email or by contacting us.

3.8 Information we do not collect or use

Artist Archive does not:

• Sell artists’ or clients’ personal information.

• Rent personal information to other businesses.

• Use client records or photographs for advertising.

• Use client photographs to train public artificial-intelligence models.

• Use facial recognition on client photographs.

• Allow other artists to access your client records.

• Store your complete payment-card details.

4. How we use personal information

We may use personal information to:

• Create and administer your account.

• Verify your email address.

• Authenticate and sign you into the app.

• Provide and operate the app’s features.

• Store and display the records, notes, products and photographs you create.

• Allow you to search, update and retrieve your records.

• Personalise app features based on your professional role.

• Send essential account and service messages.

• Provide customer support.

• Diagnose and correct technical problems.

• Maintain the reliability and security of the service.

• Detect or prevent unauthorised access, fraud, misuse and security incidents.

• Administer subscriptions if paid features are introduced.

• Meet legal, regulatory and record-keeping obligations.

• Protect the rights, safety and property of Artist Archive, its users and others.

We will not use personal information for a materially different purpose without providing appropriate notice and, where legally required, obtaining consent.

5. Legal grounds where the GDPR applies

Where the EU or UK GDPR applies to Artist Archive’s handling of your account information, we may rely on the following legal grounds:

Performance of a contract

We process information that is necessary to create your account and provide the Artist Archive service.

Legitimate interests

We may process information where reasonably necessary to:

• Operate and secure the service.

• Prevent misuse.

• Investigate faults.

• Improve the service’s reliability.

• Respond to enquiries.

We will only rely on legitimate interests where those interests are not overridden by your rights and interests.

Consent

We may rely on consent for optional activities, such as certain marketing communications or non-essential website cookies.

Where we rely on consent, you may withdraw it at any time.

Legal obligations

We may process information where required to comply with an applicable law or lawful regulatory requirement.

As the artist entering information about your clients, you are responsible for identifying an appropriate legal basis for your own collection, storage and use of that information.

6. Technology and service providers

Artist Archive uses trusted service providers to help operate the app and website.

These providers may process information only to provide their services to Artist Archive, subject to their applicable contractual, security and privacy obligations.

Google Firebase and Google Cloud

Artist Archive uses Google Firebase and Google Cloud services, which may include:

• Firebase Authentication, for account authentication and sign-in.

• Cloud Firestore, for storing account, client, appointment, session and product records.

• Cloud Storage for Firebase, for storing photographs.

• Related security, hosting and infrastructure services.

Google processes information on our behalf to provide these services.

Apple and Google sign-in

If you choose to sign in using Apple or Google, the selected provider will process information in accordance with its own privacy policy and account settings.

Artist Archive receives only the limited information needed to authenticate your account.

Website and communication providers

Our website hosting, domain, form, email and communication providers may process information needed to:

• Deliver the website.

• Process contact or waitlist forms.

• Send service or waitlist emails.

• Protect the website from abuse.

• Maintain appropriate website records and security logs.

Professional advisers

Where reasonably necessary, limited information may be shared with professional advisers such as lawyers, accountants, insurers or information-security specialists who are subject to appropriate confidentiality obligations.

Legal requirements

We may disclose information where we reasonably believe disclosure is required by law, a court order or another valid legal process.

We may also disclose information where reasonably necessary to investigate fraud or unlawful activity, protect the security of the service, or protect someone’s rights or safety.

Business transfer

If Artist Archive or its assets are sold, transferred or reorganised, relevant information may be included in that transaction.

Where this happens, we will take reasonable steps to ensure the recipient continues to protect the information and we will provide notice where required.

We do not otherwise share client information with unrelated third parties for their own marketing or commercial purposes.

7. Storage and international processing

Artist Archive uses cloud-based technology providers.

The primary location selected for Artist Archive’s Cloud Firestore and Cloud Storage data is intended to be Sydney, Australia. This location should be confirmed against the live Firebase project configuration before this policy is published.

Information may also be processed from other countries where our technology providers, support providers or their authorised personnel operate.

This means personal information may be stored or processed outside New Zealand.

When we use an overseas provider to store or process information solely on our behalf, Artist Archive remains responsible for taking reasonable steps to ensure that the information is appropriately protected.

Where an overseas transfer is subject to the GDPR, we will rely on an approved transfer mechanism where required, such as standard contractual clauses or another legally recognised safeguard.

8. Artists’ responsibilities for client information

Artist Archive is a professional record-keeping tool. It does not replace your own privacy notices, consent processes or professional responsibilities.

When entering client information, you are responsible for:

• Collecting only information that you reasonably need.

• Explaining to clients why you are collecting their information where required.

• Ensuring you have a lawful and fair basis for collecting and storing it.

• Obtaining any consent required by law or appropriate professional practice.

• Keeping the information accurate where reasonably possible.

• Protecting any information you export, download, copy or share.

• Responding to requests from your clients.

• Deleting information when you no longer need to retain it.

• Complying with the privacy laws that apply to your business and clients.

Allergy and sensitivity information

Allergy and sensitivity notes may reveal information about a person’s health.

You should only record this information where it is relevant to providing your service and where you have appropriately informed the client or obtained consent when required.

Client photographs

Before storing an identifiable client photograph, you should ensure that the client understands that the photograph will be stored in Artist Archive for professional record-keeping purposes.

Consent to store a photograph as part of a private professional record is separate from consent to publish, advertise with or publicly share that photograph.

Photo-consent setting

The app may allow you to record whether a client has consented to public use of their photographs.

This setting is provided only as a record-keeping aid. Selecting or changing the setting does not itself obtain valid consent from a client.

You remain responsible for obtaining and recording appropriate permission before posting or publicly sharing a photograph.

Client privacy requests

If a client asks to access, correct or delete information that you have entered about them, you are generally responsible for responding to that request.

The app allows you to view, update and delete client records. You may contact Artist Archive if you need reasonable technical assistance to action a request.

9. How we protect information

Artist Archive uses administrative and technical safeguards intended to protect personal information.

These safeguards may include:

• Authentication and account-access controls.

• Database security rules designed to restrict users to their own records.

• Encryption during transmission.

• Encryption of information stored by our cloud provider.

• Managed authentication services.

• Restricted administrative access.

• Security monitoring and technical logging.

• Processes for responding to suspected privacy or security incidents.

You are also responsible for protecting your account. You should:

• Use a strong and unique password.

• Keep your device and email account secure.

• Avoid sharing account credentials.

• Sign out of shared devices.

• Contact us promptly if you believe your account has been accessed without permission.

No internet-connected service can guarantee absolute security. However, we will take reasonable safeguards appropriate to the nature of the information we hold.

10. How long information is kept

We generally retain your account information and app records for as long as your account remains active or as long as reasonably necessary to provide the service.

You control how long most client records remain in your account.

Deleting individual records

You can delete individual clients, sessions, notes and photographs through the app.

Once deletion is processed, the information will no longer be available through your account.

Deleted information may remain temporarily in backups, security records or technical systems before being automatically removed or overwritten in accordance with our providers’ normal retention processes.

Deleting your account

You may request or initiate deletion of your account through the app where that feature is available, or by contacting us.

Account deletion removes your active Artist Archive account and the client records, sessions, products and photographs associated with it.

Some limited information may be retained where reasonably necessary to:

• Complete the deletion process.

• Maintain security and fraud-prevention records.

• Resolve a dispute or support request.

• Comply with legal obligations.

• Maintain temporary system backups.

Any information retained for these purposes will be kept only for as long as reasonably necessary and will not be used for unrelated purposes.

Before deleting your account, you should make any copies you are legally permitted to keep and wish to retain. Account deletion may not be reversible.

11. Your privacy rights

The rights available to you depend on the law that applies.

Under the New Zealand Privacy Act 2020, you may ask Artist Archive to:

• Confirm whether we hold personal information about you.

• Provide access to personal information we hold about you.

• Correct personal information that is inaccurate or incomplete.

You can update or delete much of your information directly through the app.

Where another applicable law provides additional rights, you may also have the right to:

• Request deletion of certain information.

• Restrict certain processing.

• Object to certain processing.

• Receive certain information in a portable format.

• Withdraw consent where processing is based on consent.

• Complain to an appropriate privacy regulator.

Privacy rights may be subject to legal limitations or exceptions.

To make a request, contact the Artist Archive Privacy Officer using the details in section 18.

We may need to verify your identity before acting on a request. We will respond within the timeframe required by applicable law.

Requests concerning information entered by another artist should generally be directed to that artist first, because the artist controls the client record.

12. Children and young people

Artist Archive is intended for professional makeup artists and hairstylists and is not designed for children to create accounts.

We do not knowingly allow children to create Artist Archive accounts.

If we become aware that a child has created an account without appropriate authorisation, we may suspend or delete the account and associated information.

Artists may work with clients who are children or young people. If you enter information about a client who is a minor, you are responsible for:

• Ensuring the collection is appropriate.

• Providing information to the young person in an age-appropriate way where applicable.

• Obtaining consent from the young person, their parent or guardian where appropriate or required.

• Using particular care when storing or publicly sharing their photographs.

13. Privacy and security breaches

Artist Archive maintains processes for responding to suspected privacy and security breaches.

If a breach occurs, we will investigate it and take reasonable steps to contain and address it.

Where a privacy breach has caused, or is likely to cause, serious harm, we will notify the New Zealand Office of the Privacy Commissioner and affected individuals where required by the Privacy Act 2020.

We will also comply with applicable notification requirements under other privacy laws where those requirements apply.

14. Website cookies and analytics

The Artist Archive website may use cookies and similar technologies.

Cookies are small files or identifiers used to help websites function, remember choices, maintain security and understand website use.

Necessary website technology

The website may use necessary cookies or similar technology to:

• Display and operate the website.

• Maintain website security.

• Process forms.

• Remember essential settings.

• Prevent fraud or misuse.

Google Analytics

If Google Analytics is enabled on the Artist Archive website, it may collect information such as:

• Your approximate location based on your IP address.

• Your browser and device type.

• The pages you visit.

• The website or source that referred you.

• How you interact with the website.

• General website-performance information.

This information is used to understand website traffic and improve the website. It is not used by Artist Archive to access or view client records stored in the app.

Google may process analytics information on servers outside New Zealand.

Where consent is legally required, non-essential analytics will only be activated after the visitor has made an appropriate cookie choice.

You may also control or delete cookies through your browser settings.

If Google Analytics is not enabled on the live website, this subsection should be removed or updated before publication.

App tracking

The Artist Archive app does not currently contain advertising trackers or use Google Analytics to track users’ activity within the app.

If this changes, this policy and any required app-store privacy disclosures will be updated.

15. Marketing communications

We may send you launch announcements, product news or other promotional communications where you have requested them or where otherwise permitted by law.

Marketing messages will include a way to unsubscribe.

Unsubscribing from marketing will not prevent us from sending essential messages about your account, security, privacy, payments or changes to the service.

Artist Archive does not use client information entered by artists to send marketing communications to those clients.

16. Payments and subscriptions

Artist Archive is currently free and does not currently collect payment information through the app.

If paid subscriptions or other paid features are introduced, payments may be processed through a provider such as:

• Apple’s App Store in-app purchase system.

• Google Play’s billing system.

• Another specialist payment processor.

The actual payment provider must be added to this policy before paid features are launched.

The payment provider will process payment details under its own privacy policy and security requirements.

Artist Archive will not normally receive or store your complete payment-card number. We may receive limited transaction and subscription information, such as:

• Your subscription plan.

• Subscription status.

• Purchase or renewal date.

• Transaction or receipt identifier.

• Confirmation that a payment succeeded or failed.

We may retain records reasonably necessary to administer subscriptions, provide support, prevent fraud and meet financial or legal obligations.

17. Changes to this policy

We may update this privacy policy if:

• The app’s features change.

• We introduce new providers or processing activities.

• Our legal obligations change.

• We introduce analytics, subscriptions or other new services.

• We make changes to improve clarity.

When we update the policy, we will change the “Last updated” date at the top.

For material changes, we will take reasonable steps to notify account holders, such as through an in-app notice, website notice or email.

The current version will be published on the Artist Archive website.

18. Contacting Artist Archive

Artist Archive has appointed Stephanie Garrett as its Privacy Officer.

For privacy questions, access or correction requests, account-deletion assistance or complaints, contact:

Artist Archive
Operator and Privacy Officer: Stephanie Garrett
Email: artistarchiveapp@gmail.com
Website: artistarchiveapp.com
Location: Christchurch, New Zealand

Please include enough information for us to understand your request, but do not send unnecessary client photographs, health information or other sensitive details by email.

We take privacy concerns seriously and will work with you to address them.

19. Complaints to a privacy regulator

We encourage you to contact Artist Archive first so we have an opportunity to investigate and respond.

You may also contact the privacy regulator that applies to your situation.

New Zealand

Office of the Privacy Commissioner
privacy.org.nz

Australia

Office of the Australian Information Commissioner
oaic.gov.au

United Kingdom

Information Commissioner’s Office
ico.org.uk

European Union

You may contact the data-protection authority in the EU country where you live, work or believe a privacy issue occurred.