Privacy policy

Last updated: 28 September 2026

1. Who runs the site

Pictavera is a private, non-commercial hobby site. Its operator is responsible for your personal data.

2. What we store

• Account: username, email address and password (stored only in encrypted form — nobody can read it).
• Artist profile, only if you fill it in: name, photo, nationality, style and biography — shown publicly.
• Contact details, optional: email, phone, website — shown only to logged-in visitors on your paintings for sale.
• Your activity: the paintings you upload, your favorites (visible only to you; rankings count them without names) and your comments (public after approval, with your name).
• Technical data: the hosting provider keeps standard server logs (IP address, browser, time) for security. To stop password guessing, wrong logins are counted for a short time — with a scrambled code instead of your IP address; it is deleted after one day.

3. Why

Only to run the site: your account, showing your works, favorites and comments, and protecting the site from abuse. Legal basis: providing the service you asked for, and our legitimate interest in keeping the site secure.

4. What we do not do

No advertising, no analytics or tracking tools, and we do not sell or pass your data to anyone for marketing.

5. Cookies

Only the cookies the site needs to work: your login session, form security (CSRF) and your chosen language. Under EU rules they need no consent. No advertising or tracking cookies. The “Random” page remembers, only in your open browser tab, which paintings it has already shown you, so that it does not repeat them — this is not a cookie and it disappears when you close the tab.

6. Where the data is kept

The website runs on a server of Hetzner Online in Finland (EU). The images and the backups are stored with Cloudflare, which also delivers the pages quickly and protects the site from attacks. Emails for a forgotten password are sent through an email delivery service. They process the data only on our behalf; Cloudflare may use servers outside the EU, with the safeguards the GDPR requires.

7. How long

As long as your account exists. When you ask us to delete your account, we delete your data and your uploaded works. Server logs are kept only for a short time. Backups of the database are kept for 14 days.

8. Your rights

You can ask to see, correct, receive a copy of or delete your data, or object to its use — write to us via “Contact us”. You may also complain to the Bulgarian Commission for Personal Data Protection (www.cpdp.bg).

9. Changes

We may update this policy; the date above shows the current version. See also the terms of use.