Brush & Tell Privacy Policy

Effective October 12th, 2026.

1. Introduction and Scope

1.1 Who We Are. Brush & Tell, LLC, a Colorado limited liability company ("Brush & Tell," "we," "us" or "our"), operates the online marketplace at brushandtell.com and the related websites, pages, features, programs and communications described in our Terms of Service (the "Services").

1.2 What This Policy Covers. This Privacy Policy (the "Policy") describes how we collect, use, disclose, retain and protect Personal Information about every person who accesses or uses the Services ("you"), in every capacity, including visitors who browse without an account, account holders, buyers, sellers (whom the Services may call "artists"), applicants to become sellers, entrants in the Brush & Tell Art Competition and any other contest we sponsor (the "Competition"), representatives of businesses that display artwork or inquire about doing so (each such business, a "Venue"), subscribers to our email list, and persons who correspond with us. Capitalized terms that this Policy does not define have the meanings given in the Terms of Service.

1.3 Personal Information. "Personal Information" means information that identifies, relates to, describes, or can reasonably be linked to an identifiable individual. It does not include information that has been aggregated or de-identified so that it can no longer reasonably be linked to an individual, which we may use and disclose for any lawful purpose.

1.4 Relationship to the Terms of Service. By using the Services you acknowledge this Policy and consent to the practices it describes. If you do not agree with this Policy, do not use the Services. To the fullest extent permitted by law, the Terms of Service, including their provisions on limitation of liability, governing law and disputes, apply to any claim relating to this Policy. Nothing in this Policy or in the Terms of Service limits any right you have under a privacy law that cannot be waived.

1.5 Third Parties. This Policy applies only to the Services. It does not apply to any website, product or service operated by a third party, including our payment processor, sign-in providers, carriers and Venues, each of which handles information under its own terms and privacy policy.

2. Information We Collect

2.1 Information You Provide. We collect the information you give us, which includes the following.

Account information. Your email address and password. Passwords are stored by our sign-in provider only in hashed form, and we do not have access to them in readable form. An account may also hold your name, your city and your notification preferences.
Seller applications, profiles and listings. If you apply to sell or are approved as a seller, the information in your application and profile, such as your display name, photograph, tagline, city, biography, links, and images and descriptions of your work, together with your listings. Seller profiles and listings are published on the Services and are visible to the public.
Acceptance records. When you accept the Terms of Service and this Policy, the versions and text you accepted, the date and time, and the network address from which you accepted them.
Order information. The artwork purchased; the price, shipping charge and tax; the name and address to which the artwork is to be shipped; the status of the order; the carrier and tracking number; your confirmation of delivery; and, for artwork collected at a Venue, the pickup code and the Venue's confirmation of collection. We also keep records of returns, refunds, claims and payment disputes.
Competition information. If you join the Competition waitlist, the school email address you provide and the school associated with it, which we use to send you information about the Competition. If you enter the Competition, the email address issued to you by your school, which we use to verify your eligibility by sending a verification code to it, together with your school, your entry and the votes you cast. We do not publish a school email address or disclose it to your school, and we do not use an address collected to verify eligibility to send marketing email unless you have separately subscribed it to our email list. Individual votes are not published.
Venue information. If you inquire about displaying artwork or act for a Venue, the business name, your name, email address, telephone number, business address, the type of business, and any other information you submit.
Email list. If you subscribe to our email list, your email address and the category you select (such as artist, buyer or venue).
Communications and other submissions. The messages you send us, including email to info@brushandtell.com, our replies, any report you make about a listing or a user, the profiles you follow, and any other information you choose to submit through the Services.

2.2 Information Collected Automatically. When you use the Services, we and our service providers automatically collect the following.

Device and network information. Your Internet Protocol (IP) address, browser type, device type and operating system, and the date and time of each request. Our hosting provider maintains request logs, and our sign-in provider maintains logs of sign-in activity.
Usage information. The pages you view and the site that referred you, collected through the analytics service described in Section 5.2.
Cookies. The cookies described in Section 5.1.
Venue codes. When you scan a code or follow a link displayed with artwork at a Venue, the link identifies the Venue so that a resulting purchase can be attributed to it. We may record the scan and associate it with your account or device.

2.3 Information From Third Parties. We receive information about you from the following sources.

Sign-in providers. If you sign in with Google, Google provides us your name, email address and profile picture.
Payment processor. Stripe provides us limited information about each payment, such as a payment reference and the status of the payment. For sellers, Stripe provides us the identifier and status of the seller's Stripe account, such as whether payouts are enabled.
Sellers and Venues. A seller provides the carrier and tracking number for an order, and a Venue confirms the collection of artwork.

2.4 Payment Card and Bank Information. Payment card details are collected directly by Stripe and are not stored on our servers. A seller's identity, tax and bank account details are collected by Stripe when it establishes the seller's Stripe account. Stripe handles that information under its own privacy policy (see https://stripe.com/privacy for that policy).

2.5 Information We Do Not Seek. We do not seek sensitive Personal Information, such as health information, through the Services, and we ask that you not submit it. If you give us information about another person, such as the recipient of an order, you represent that you are authorized to do so.

3. How We Use Information

3.1 Purposes. We use Personal Information for the following purposes:

to provide, operate and maintain the Services, including to create and administer accounts, publish profiles and listings, process orders and payments, calculate, collect and remit sales tax, arrange shipment, delivery and collection, pay sellers, and administer returns, refunds and claims;
to send the communications that an account or an order requires, such as receipts, shipping notices and messages about returns, refunds or problems;
to review applications, administer the display of artwork at Venues, and attribute sales to Venues;
to promote the Services, including by featuring sellers and their artwork as the Terms of Service permit;
to verify eligibility for, administer and protect the integrity of the Competition, including its voting;
to respond to your inquiries and requests;
to send marketing email to persons who have subscribed to our email list or a waitlist or have otherwise asked or agreed to receive it;
to secure the Services and to detect, investigate and prevent fraud, abuse, vote tampering and other unlawful or prohibited conduct;
to understand how the Services are used and to maintain and improve them;
to enforce the Terms of Service and our other agreements, and to establish, exercise or defend legal claims;
to comply with our legal obligations, including tax and recordkeeping obligations; and
for any other purpose disclosed to you when the information is collected or to which you consent.

3.2 What We Do Not Do. We do not sell Personal Information. We do not disclose or process Personal Information for targeted advertising. We do not use Personal Information for profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

4. How We Disclose Information

4.1 Service Providers. We disclose Personal Information to the companies whose services we use to provide the Services. These include Stripe (payment processing, seller payouts, sales tax calculation and fraud prevention); Supabase (database, sign-in and file storage); Vercel (website hosting, request logs and analytics); Resend (delivery of transactional email, and of marketing email to our email list, for which it holds subscribers' email addresses); Google (business email, including the messages you send us); Sentry (error monitoring, which receives technical reports of errors that occur on the Services); and Shippo (shipment tracking, which receives the carrier and tracking number of an order). Some of these companies, such as Stripe and Google, also use information for their own purposes, as their privacy policies describe. We may add or replace service providers from time to time.

4.2 Sellers and Carriers. When you purchase artwork to be shipped, the seller receives the name and shipping address you provided so that the seller can ship the artwork, and the carrier the seller uses receives the information on the shipping label. A buyer who returns artwork receives the address to which the seller has asked that it be returned.

4.3 Venues. When you purchase artwork for collection at a Venue, the Venue uses the pickup code you present to release the artwork. We do not provide the Venue with your contact details, payment details or purchase history.

4.4 Public Information. Seller profiles and listings are public. Entries in the Competition, and the names of entrants and winners, may be displayed publicly as the Official Rules provide. Any information you choose to publish through the Services may be viewed, collected and used by others.

4.5 Legal and Safety Purposes. We may disclose Personal Information where we believe in good faith that disclosure is necessary to comply with a law, regulation, subpoena, court order or other legal process; to respond to a request from a governmental authority; to enforce the Terms of Service; to detect, prevent or address fraud, security or technical issues; or to protect the rights, property or safety of Brush & Tell, our users or any other person.

4.6 Business Transfers. We may disclose and transfer Personal Information in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business or assets. The recipient may use that information as this Policy describes, as it may be amended under Section 12.

4.7 With Your Consent. We may disclose Personal Information for any other purpose with your consent or at your direction.

4.8 No Disclosure for Third-Party Marketing. We do not disclose Personal Information to third parties for their own direct marketing purposes.

5. Cookies, Analytics and Similar Technologies

5.1 Cookies. The Services use cookies set through our sign-in provider that are necessary to keep you signed in. On the pages where you pay, Stripe sets its own cookies, which it uses to detect and prevent fraud (see https://stripe.com/legal/cookies-policy for Stripe's cookie policy). The Services do not currently use advertising cookies or third-party analytics cookies. You may set your browser to refuse cookies, but parts of the Services, including sign-in and checkout, will not function without them.

5.2 Analytics. We use Vercel Web Analytics to measure page views. That service does not set cookies. It identifies a visit by means of a hash generated from the incoming request, which is discarded after 24 hours, and it records the page address, the referring site, the country, region and city derived from the request, and the device type, browser and operating system. It does not record your name, email address or account. Before a page view is sent, we remove from the page address the elements that could identify you or an order, such as order and payment references. We receive this information only in aggregate form.

5.3 Do Not Track and Opt-Out Signals. The Services do not respond to browser "Do Not Track" signals. Because we do not sell Personal Information or process it for targeted advertising, there is no such processing from which to opt out. To the extent applicable law requires, we will treat a recognized universal opt-out signal sent by your browser as a valid request to opt out of that processing.

6. Retention

6.1 Retention Periods. We retain Personal Information for as long as reasonably necessary for the purposes described in this Policy. In particular:

Account and profile information: for as long as the account is open. When you ask us to delete your account, we delete it within 30 days, except for the records described below, material published before the deletion, and residual copies in backup systems, which are overwritten in the ordinary course.
Acceptance records: for as long as we retain any order or account record to which the acceptance relates.
Order, payment and tax records: for as long as tax and other laws require, which is generally seven years after the sale.
School email addresses and vote records: deleted or de-identified 90 days after the winner of the Competition is announced, unless a dispute or an investigation under the Official Rules relating to that Competition is then pending.
Request and sign-in logs: for the limited periods for which our hosting and sign-in providers retain them.
Analytics: the visit hash for 24 hours, and aggregate page counts indefinitely.
Correspondence: for two years after the correspondence concludes.
Email list: until you unsubscribe or ask us to delete your address.

6.2 Longer Retention. We may retain Personal Information for a longer period where necessary to comply with a legal obligation, to resolve a dispute, to enforce our agreements, to prevent fraud, or to establish, exercise or defend a legal claim.

7. Your Choices and Rights

7.1 Access, Correction and Deletion. You may ask us to tell you what Personal Information we hold about you, to correct it, or to delete it, including by deleting your account, by writing to info@brushandtell.com. You may also close your account from the Settings page of your account. We will verify your identity, ordinarily through the email address on your account or the address you used to contact us, before acting on a request. We will respond within 45 days, or within any longer period that applicable law permits, and will tell you if any information must be retained under Section 6.

7.2 Marketing Email. Every marketing email we send contains an unsubscribe link. Unsubscribing does not affect the email that your account or your orders require.

7.3 State Privacy Rights. Depending on where you live, and to the extent the law applies to us, you may have additional rights under a state privacy law such as the Colorado Privacy Act. Those rights may include the right to confirm whether we process your Personal Information, to access it, to correct it, to delete it, to obtain a portable copy of it, and to opt out of its sale, of its processing for targeted advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects. As Section 3.2 states, we do not engage in that sale, processing or profiling. To exercise a right, write to info@brushandtell.com. You may use an authorized agent where the law allows, and we may require proof of the agent's authority. If we decline your request, we will tell you why, and you may appeal by replying to our response. If your appeal is denied, you may contact the attorney general of your state. We will not discriminate or retaliate against you for exercising a right under this Section.

7.4 Notice to California Residents. California residents may ask whether we have disclosed Personal Information to third parties for their own direct marketing purposes. As Section 4.8 states, we do not make those disclosures.

8. Children and Minors

The Services are intended only for persons who are at least 18 years of age and are not directed to children. We do not knowingly collect Personal Information from anyone under 18. If we learn that we have collected Personal Information from a person under 18, we will delete it and close the account. If you believe a person under 18 has provided us Personal Information, write to info@brushandtell.com.

9. Security

We maintain administrative, technical and physical safeguards designed to protect Personal Information against unauthorized access, use and disclosure. These measures include encryption of data in transit, access controls in our database designed to limit each account to the information it is authorized to view, and the use of a third-party payment processor so that payment card details are not stored on our servers. No method of transmission or storage is completely secure, and we do not guarantee the security of any information. You are responsible for keeping your password confidential and for notifying us at info@brushandtell.com if you believe your account has been compromised. If a security breach affects your Personal Information, we will notify you as applicable law requires.

10. Location of Processing

The Services are operated from, and intended for users located in, the United States. Your information may be processed and stored in the United States and in any other country in which our service providers operate, where privacy laws may differ from those of your jurisdiction. By using the Services you consent to that processing.

11. Third-Party Services and Links

The Services rely on and may link to services operated by third parties, including Stripe, Google, carriers and Venues. Their collection and use of your information is governed by their own privacy policies, and we are not responsible for their practices. We encourage you to review the privacy policy of each third-party service you use.

12. Changes to This Policy

We may revise this Policy at any time. We will post each new version on the Services with its effective date and, for a change that materially affects your rights, will send notice to the email address on each account at least 7 days before the new version takes effect. At the next sign-in after a new version takes effect, an account holder will be asked to accept it. If you do not hold an account, your continued use of the Services after the effective date of a new version constitutes your acknowledgment of it. Where applicable law requires your consent to a new use of Personal Information collected under an earlier version, we will obtain that consent.

13. Contact

Questions and requests about this Policy may be sent to info@brushandtell.com or to Brush & Tell, LLC, 1500 N Grant St Suite N, Denver, CO 80203.