ArtHausScope and responsibilities
ArtHaus is business management software with owner and staff workspaces, a client portal, and Social Studio. This policy explains information handled through those services. It covers our administration of ArtHaus accounts, platform security, subscriptions, support, and optional integrations.
Businesses using ArtHaus also supply and manage information about their staff, clients, appointments, and services. The service business decides what information it enters and how it uses it for its own services, and must provide its own appropriate privacy notices. For requests about a business's appointment or client records, contact that business first; you may also contact ArtHaus for help directing the request.
This policy does not replace the separate policies of Whop, Twilio, Meta, TikTok, or a business you book with.
Information we handle
The information depends on your role, what you submit, and which features are enabled.
| Category | Examples and source | Main purpose |
|---|---|---|
| Account and access information | Email address, authentication and verification records, account identifiers, sessions, role and workspace relationships, invitations | Sign-in, recovery, account linking, and access control |
| Business and team information | Business name, contact details, location, timezone, services and prices, staff display names, invitations, assignments, and availability | Operate the workspace and present enabled booking information |
| Client and appointment information | Client name, email, phone, business-entered notes, selected services and staff, reservation intervals, appointments, and status history | Manage service relationships and visits |
| Subscription and payment records | Whop customer/account and transaction references, amounts, currency, status, billing periods, receipts, refund/dispute information, consent records, and safe saved-method descriptions | Verify billing and bookings, reconcile transactions, and provide receipts |
| Messaging information | Recipient phone number, message content or related booking/review details, sending number, consent evidence, opt-outs, provider message identifiers, and delivery/webhook records | Send permitted business messages and enforce preferences |
| Social planning content | Draft captions, platform variants, uploaded images, planned dates, archive state, and edit history | Save and display content plans within the workspace |
| Social connection information | Provider and account/Page identifiers and names, granted permissions, encrypted access/refresh credentials where applicable, expiry/check status, and authorization security records | Connect the selected account, validate access, and maintain the connection |
| Support and operational information | Information you provide when contacting us, audit events recording relevant workspace actions, and technical data needed to deliver and secure requests | Respond to requests, troubleshoot, and protect the service |
Whop collects full card details through its payment interfaces. ArtHaus stores provider references and safe display information rather than raw card numbers or security codes. Identity and bank details requested during payment-account onboarding are supplied to the payment provider through its own workflow.
Infrastructure providers may process request and device information such as IP address, browser details, and timestamps while hosting and securing the service. The information retained depends on the provider and the service configuration.
Optional Facebook, Instagram, and TikTok connections
An authorized owner starts a connection from Social Studio → Connected accounts. You authenticate with the provider, which presents its authorization screen. ArtHaus does not ask you to type your social account password into ArtHaus.
The current implementation requests and uses:
| Platform | Requested permissions | Information used in ArtHaus |
|---|---|---|
| pages_show_list, pages_read_engagement; pages_manage_posts only when an owner separately authorizes publishing | Available Page identifiers and names for selection; selected Page identity; authorization credentials and validation metadata; post content and media only after an explicit publish or schedule confirmation | |
| Instagram professional accounts | instagram_business_basic; instagram_business_content_publish only when an owner separately authorizes publishing | Account identifier and username; authorization credentials and validation metadata; post content and media only after an explicit publish or schedule confirmation |
| TikTok | user.info.basic | App-specific user identifier (open_id) and display name; authorization credentials and validation metadata |
Some provider permissions can technically permit broader access than these requested fields. This implementation does not fetch social inboxes, comments, contact lists, video libraries, or engagement reports. For a Facebook or Instagram connection with separately approved publishing access, ArtHaus sends only the content and media selected for a post after the owner explicitly confirms Post now or Schedule post. A planning date, draft save, account connection, or basic authorization does not trigger publication.
We use the connection information to show which account belongs to the business's connection and to validate or renew that access. It is stored separately for each business. Social credentials are encrypted at rest by the application, processed on the server, and excluded from browser responses and application audit metadata.
You can disconnect a platform in Connected accounts while authorized workspace access is available. This clears that business's current connection credentials, account identifier/name, and pending connection flow from active records. A minimal disconnect audit record remains. Disconnecting does not delete social drafts or uploaded media, revoke the provider's app permission globally, or disconnect another ArtHaus business. You can also revoke authorization in the provider's app settings. If you cannot access the workspace, use the privacy contact above to request help.
Optional Twilio messaging
Each business connects an independently billed Twilio account that it owns and pays for directly. ArtHaus stores the connection information and encrypts the supplied API secret and Auth Token at rest. Stored secrets remain server-side.
When messaging is enabled, ArtHaus provides the business's Twilio account with the recipient and sender phone numbers, message content, and information needed for delivery and status reporting. Twilio and communications carriers process this information to deliver messages. ArtHaus records consent and opt-out evidence and processes authenticated status and inbound webhook events.
Eligible messages can include appointment confirmations, reminders, authorized change notices, and review requests. These depend on business settings, required consent, a valid connection, and applicable send controls. Missing or invalid credentials block SMS without invalidating the booking. ArtHaus does not switch the business to an ArtHaus-funded account.
Reply STOP or contact the business to withdraw text permission. A review request and appointment update can have separate consent purposes; consent to one does not automatically authorize the other. Suppression and consent records may be retained to prevent further unwanted messages. Ordinary replies may be recorded through provider events but are not a monitored two-way support inbox in ArtHaus.
Retention and deletion
Account and business records remain available while needed for the service and relevant operational, financial, security, or legal purposes. Canceling a subscription or deactivating staff does not itself delete historical records. Retention depends on the record, its purpose, applicable obligations, and the infrastructure supporting it. Contact us about a specific record or deletion request.
Social authorization attempts expire from use after ten minutes. Expiry is not the same as immediate physical deletion: expired pending records are removed when relevant connection operations run, and there is not yet a scheduled purge. Disconnect clears the active connection records described in section 3; backup copies, where configured, follow their separate retention lifecycle.
Archiving a social draft retains it for restoration. Removing an image from a draft keeps the upload in the business's private media library. Permanent media deletion and account-wide self-service deletion are not implemented in the current release. You can submit a deletion request to the privacy address above. Requests require review and are not processed automatically by emailing us. Retained financial, security, or suppression records may need different treatment, subject to applicable law and platform obligations.
Your choices and requests
You can use available account controls to update information, ask the service business to correct appointment/client records, remove a saved-method permission for that business, withdraw messaging consent, or disconnect a social account. These choices have the distinct effects described above; they do not automatically erase financial history or data held independently by providers.
Depending on where you live and which laws apply, you may have rights to request access, correction, deletion, a copy of information, or limits on certain processing, and to withdraw consent or complain to a privacy regulator. Send requests to Support@arthaus-collective.co. Identify your ArtHaus sign-in email, the relevant business and integration, and the request. Do not send passwords, API secrets, full card details, or unnecessary identity documents. We may need proportionate verification before responding.
Security, location, and children
ArtHaus uses authentication, business-scoped authorization, database access controls, and server-side credential handling. Twilio and social integration secrets receive the specific application encryption described above. This is not a claim that every field is separately encrypted or that any service is completely secure.
Our service providers may process information in countries other than where you live, depending on their infrastructure and configuration. Contact us with questions about the processing of your information.
ArtHaus is intended for business use and is not directed to children. Account holders must be 18 or older under the Terms of Service. If you believe a child has provided information improperly, contact the privacy address so it can be investigated. ArtHaus does not provide parental-consent or family-account workflows.
Changes and contact
We will date policy changes and provide appropriate notice of material changes. New processing that requires consent must not be treated as authorized merely because this policy changes.
For privacy questions or deletion requests, contact Support@arthaus-collective.co. For questions about a service appointment, contact the business shown in your booking.