Legal

This page contains Corpus’ Privacy Policy, Terms of Service and Cookies/Storage Policy. Corpus is operated by Art Society, Monaco.

Contents

  1. Privacy Policy
  2. Terms of Service
  3. Cookies and Storage Policy

Last updated: 2026-01-16

Privacy Policy

1. Who we are

Corpus is a service operated by:

  • Art Society, SARL
  • RCI: 17S07374
  • Address: 13 boulevard Princesse Charlotte, MC-98000 Monaco, Principality of Monaco
  • Privacy contact / DPO: privacy@corpus.art
  • General contact: Contact page

This Privacy Policy is written to reflect Monaco requirements and, where applicable, the EU/EEA General Data Protection Regulation (GDPR).

2. Scope

This Privacy Policy explains how we process personal data when you:

  • visit our website,
  • request a demo or contact us,
  • create and use a Corpus account,
  • use Corpus features (inventory, CRM, websites, sales, banking, offline mode),
  • send a spontaneous career application.

3. Personal data we collect

3.1 Data you provide
  • Contact/Demo forms: first name, last name, email, company/gallery (optional depending on form), role, message and any information you may include in your message.
  • Careers form: first name, last name, email, company (optional), area/interest, note/message and links you provide (e.g. LinkedIn, portfolio, GitHub).
  • Account data: user identity, login credentials, team/organization details, permissions/roles.
  • Content you add to Corpus: artwork records, inventory metadata, provenance, literature/exhibition history, valuations, locations (including potentially sensitive locations), invoices, notes, attachments/documents, CRM contact records and relationship notes.
3.2 Data collected automatically
  • Service and security logs: approximate timestamps, device/browser information, and event logs needed to operate, secure and troubleshoot the service.
  • Offline mode storage: Corpus may store a local cache in your browser (e.g., LocalDB/IndexedDB/local storage) to provide offline consultation and performance. This is not used for advertising or cross-site tracking.

We do not use third-party website analytics trackers and do not run advertising pixels.

4. Sensitive and high-risk data

Corpus may contain data that is highly sensitive in practice (even if not “special category data” under GDPR), including: collector identities, private addresses, artwork locations/storage information, valuation history, invoices and confidential notes.

You should only upload and process such information if you have a lawful basis and appropriate authority to do so. We provide access controls (RBAC) and security measures, but you remain responsible for deciding what to store and who can access it.

We only prohibit illegal content. However, we strongly recommend you avoid storing unnecessary sensitive personal data where it is not required for your use case.

5. Why we process data

  • Provide and operate the Corpus service and its features.
  • Set up accounts, manage users, permissions, and organizations.
  • Provide offline consultation mode and syncing.
  • Provide customer support and respond to inquiries.
  • Process transactions for online sales where enabled (via payment providers).
  • Connect banking features (bank reconciliation) where enabled (via banking connectivity providers).
  • Maintain security, prevent abuse and ensure service reliability.
  • Comply with legal obligations and enforce our Terms.

6. Legal bases

Where GDPR applies, we rely on the following legal bases:

  • Contract: to provide Corpus and requested features.
  • Legitimate interests: to secure, maintain and improve the service, and respond to inquiries.
  • Consent: where required (e.g., optional communications where you opt in).
  • Legal obligation: where we must retain or disclose information to comply with law.

7. When we share data

We do not sell your personal data. We share data only as needed:

  • Service providers (processors): infrastructure, hosting, email delivery, payment processing and banking connectivity providers used to deliver features you enable.
  • Within your organization/account: according to permissions and roles configured by account administrators.
  • Legal and safety: if required to comply with law, protect rights, prevent fraud or respond to lawful requests.
  • Business transfers: if we undergo a merger, acquisition or asset sale, subject to appropriate safeguards.

Key providers you stated you use: OVH (EU region hosting), Mailgun (EU region email) and storage on infrastructure hosted with OVH. Payment processing uses Braintree when online sales are enabled.

8. International transfers

We aim to host and process data in the EU region via OVH and EU region email via Mailgun. Some third parties you enable (for example, payment processing via Braintree or certain banking connectivity providers) may process data outside the EU/EEA.

When international transfers occur, we use appropriate safeguards where required (such as standard contractual clauses) and minimize shared data to what is necessary for the feature.

9. Security

We implement technical and organizational measures designed to protect personal data, including:

  • TLS encryption in transit.
  • Encryption at rest.
  • Encrypted backups.
  • Two-factor authentication (2FA).
  • Role-based access controls (RBAC) and permissions.

No system is perfectly secure. You are responsible for using strong passwords, safeguarding credentials and managing your user access appropriately.

10. Data retention

We retain personal data for 5 years, unless a longer retention period is required by law or a shorter period is appropriate for the specific data and purpose (e.g., you delete content or an account is closed and eligible for deletion).

Where feasible, we will delete or anonymize data when it is no longer needed for the purposes described in this policy.

11. Your rights

Depending on your location (including Monaco and, where applicable, the EU/EEA), you may have rights such as:

  • Access to your personal data.
  • Rectification (correction).
  • Erasure (deletion), subject to legal and contractual limits.
  • Restriction or objection to certain processing.
  • Data portability where applicable.
  • Withdrawal of consent where processing is based on consent.

To exercise your rights, contact: privacy@corpus.art. We may need to verify your identity and authority (especially for organization accounts).

12. Banking connections and reconciliation

If you enable bank reconciliation via a banking connection, you authorize Corpus to access and process banking data required to provide reconciliation and matching features (e.g., transaction references, amounts, dates, counterparties where available).

We minimize the data processed and use it only to provide banking and accounting-related features inside Corpus. Your banking provider or banking connectivity provider may have separate terms and privacy notices.

13. Payments and online sales

Where online sales are enabled, payments are processed by Braintree (or another payment provider you enable). We are not the merchant of record for your sales unless explicitly agreed in writing.

Payment data is handled by the payment provider under their compliance programs. Corpus receives only the payment information needed to record the transaction, issue invoices and update inventory status.

14. Data enrichment and accuracy

Some features may pre-fill or enrich data using internal sources. We do not guarantee that enriched data is complete, current or error-free. You remain responsible for verifying information before relying on it (especially for provenance, valuations and market data).

15. Children

Corpus is not intended for children. You must be at least 18 years old to create an account.

16. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date will reflect the latest version. If changes are material, we will provide a reasonable notice within the service or via email where appropriate.

Back to top

Terms of Service

1. Acceptance of these Terms

These Terms of Service (“Terms”) govern your access to and use of Corpus (the “Service”). By creating an account, using the Service or accessing our website, you agree to these Terms.

If you are using Corpus on behalf of an organization, you represent that you have authority to bind that organization and “you” refers to the organization and its authorized users.

2. Service provider

The Service is provided by Art Society, SARL, RCI 17S07374, 13 boulevard Princesse Charlotte, MC-98000 Monaco, Principality of Monaco (“Art Society”, “we”, “us”).

3. Eligibility

You must be at least 18 years old to use Corpus. You must provide accurate information and keep your account details up to date.

4. Plans, subscriptions and billing

4.1 Plans

Corpus may be offered under different plans (e.g., Starter, Pro, Enterprise). Plan features and limits are described on our website or in your order form.

4.2 Starter

The Starter plan is offered as a free plan with feature and usage limits (e.g., maximum artworks). Features not listed in Starter may require a paid plan.

4.3 Paid plans, billing cycles, and taxes

Paid plans are billed in advance according to the billing cycle you select (monthly or annual where available). Prices are shown on our website or in your order form and may be updated from time to time with reasonable notice.

Where applicable, VAT may be calculated automatically based on the information you provide. You are responsible for providing accurate billing details.

4.4 Overages

Some plans may include usage thresholds (e.g., number of artworks, email volume). If you exceed thresholds, we may charge overage fees as described on the pricing page or in your order form.

4.5 Non-payment

If payment is overdue, we may suspend access to the Service after reasonable notice until payment is received.

5. Your use of the Service

You agree to use Corpus only in compliance with applicable laws and these Terms. You will not:

  • upload, store or share illegal content through the Service,
  • attempt to gain unauthorized access to accounts or systems,
  • interfere with or disrupt the Service,
  • reverse engineer or attempt to extract source code except where permitted by law.

6. Your content and responsibilities

You (and/or your organization) retain all rights to the content and data you upload to Corpus (“Customer Content”). You grant us a limited, non-exclusive license to host, store, process and display Customer Content solely to operate and provide the Service.

You represent that you have the necessary rights and authority to upload and process Customer Content, including personal data of collectors, clients and contacts.

7. Our intellectual property

Corpus, including its software, design and documentation, is owned by Art Society or its licensors and is protected by intellectual property laws. Except as expressly permitted, you may not copy, modify or distribute the Service.

8. Third-party services

Certain features rely on third-party services (e.g., payment processing via Braintree, banking connectivity providers for bank reconciliation, email delivery via Mailgun). Your use of those features may be subject to third-party terms and policies.

9. Online sales, VAT, shipping, and export

If you use online sales features, you are responsible for the sale terms between you and your buyer (including authenticity, description, pricing, delivery and applicable consumer obligations).

VAT may be calculated automatically based on the information you provide, but you remain responsible for tax compliance. Export, framing and shipping logistics may be handled manually by you or your partners and are not provided as a managed service unless expressly agreed in writing.

10. Availability and SLA

We aim to provide a reliable Service. For Enterprise customers, an SLA may be offered (including an uptime target of 99.9%) as set out in the applicable order form or SLA document. Planned maintenance and events outside our reasonable control may affect availability.

11. Disclaimers

Corpus is provided on an “as is” and “as available” basis to the maximum extent permitted by law. We do not warrant that the Service will be uninterrupted or error-free or that enriched/pre-filled data will be accurate.

You are responsible for verifying critical information (including provenance, valuations, and compliance-related details) before relying on it.

12. Limitation of liability

To the maximum extent permitted by law, Art Society will not be liable for indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, goodwill, or data, arising from or related to your use of the Service.

Some jurisdictions do not allow certain limitations; in such cases limitations apply to the greatest extent permitted.

13. Termination

You may stop using the Service at any time. We may suspend or terminate access if you materially breach these Terms, use the Service unlawfully or pose a security risk.

Upon termination, you may lose access to the Service and Customer Content. We will handle retention and deletion in accordance with our Privacy Policy and any applicable contractual commitments.

14. Changes to these Terms

We may update these Terms from time to time. If changes are material, we will provide reasonable notice. Continued use of the Service after the effective date means you accept the updated Terms.

15. Governing law and jurisdiction

These Terms are governed by the laws of Monaco. Any dispute arising out of or relating to these Terms or the Service will be subject to the exclusive jurisdiction of the competent courts of Monaco, except where mandatory law provides otherwise.

Back to top

Cookies and Storage Policy

1. Summary

We do not use advertising cookies, third-party analytics cookies or tracking pixels on our website.

However, the Corpus Service may use strictly necessary technologies to function, such as authentication session cookies and local browser storage for offline mode.

2. Do we use cookies?

On the marketing website, we aim to use no cookies beyond what is necessary for basic functionality.

In the logged-in Corpus application, we may use strictly necessary cookies (or equivalent mechanisms) for:

  • authentication and session management,
  • security (e.g., protecting accounts and preventing abuse),
  • remembering essential preferences (e.g., language), if implemented.

These are not used for cross-site tracking or advertising.

3. Local storage (Offline mode)

Corpus offers offline consultation features. To do this, the application may store a local cache in your browser using technologies such as IndexedDB/local storage.

This local cache is used to:

  • make selected data available offline,
  • speed up loading and reduce repeated downloads,
  • sync changes when connectivity returns (where applicable).

You can clear browser storage via your browser settings. Clearing storage may disable offline mode and require re-downloading data.

4. Do Not Track / tracking

We do not run behavioral tracking or advertising and we do not respond to “Do Not Track” signals with special behavior as we do not track users across sites.

5. Contact

Questions about this policy can be sent to: privacy@corpus.art.

Back to top