Privacy Policy

Who we are

Vitrine is operated by Composition Limited, a company registered in England and Wales. We provide collection management software for museums and cultural institutions.

Data controller contact: hello@composition.agency

What data we collect

When you use Vitrine, we collect and store the following information:

• —Your email address — used to identify your account
• —Museum name, slug, and branding settings — your organisation's profile
• —Collection data — object titles, descriptions, images, and associated records you enter
• —Staff names and email addresses — members of your team added to Vitrine
• —Depositor names and contact information — entered during object entry procedures
• —Loan institution contacts — names and emails of partner organisations for loans
• —Object exit recipient details — names, contacts, and addresses for deaccessioned objects

We do not collect payment card details, phone numbers (unless you enter them as part of collection records), or sensitive personal categories of data.

Why we collect it

How long we keep it

All data is retained for as long as your account is active. What happens afterwards depends on how your account ends.

If you delete your account, everything associated with it is permanently deleted from our systems within 24 hours. That includes your museum profile, collection records, images, documents and staff information. We do not retain backups of deleted accounts beyond our standard 7-day backup retention window.

If your subscription ends, your museum moves to the free Community plan and nothing is deleted straight away. Your account and public site stay available. Anything over the Community plan's limits (objects beyond the limit, extra photos, documents, staff accounts and private share links) is kept for 180 days if you have previously paid, or 30 days if you only ever used a free trial, so that you can come back or take a copy with you. After that it is permanently deleted, most recently added first. We email you before that happens, 30 days and again 7 days beforehand where the window allows. Everything within Community's limits is kept for as long as your account is active. You can download a complete copy of your collection at any time. These periods apply while Vitrine is still running. If it shuts down, see "Keeping your own backups" below.

A small amount of information outlives account deletion, because the law requires us to be able to show how we handled your subscription:

• —Billing compliance records, kept for six years. These record each subscription notice we sent you, each cancellation and how it was made, and any refund. Each record holds the email address we sent to, the dates, and the amounts. They do not contain any of your collection data.
• —A deletion record, kept for six years. This notes that an account existed, its name, the email address of its owner, and the date and reason it was deleted. It exists so that we can answer a query about an account that no longer exists.

Keeping your own backups

The retention and notice periods above describe what we aim to do while Vitrine is operating normally. They are not a guarantee. If Vitrine shuts down, including if Composition Limited stops trading or becomes insolvent, we may not be able to keep your data for those periods or email you before it is deleted. Data stored on our servers is subject to deletion without notice, and may also be lost or become inaccessible through technical failure or other causes, as set out in our Terms of Service.

We recommend that you keep your own backups of your collection data somewhere other than Vitrine, alongside your use of the service. "Export my data" in Settings downloads a copy of your records at any time. It does not include the image and document files you have uploaded, so please keep your own copies of those as well.

Who we share it with

We do not sell your data. We use the following sub-processors:

• —Supabase Inc: database and authentication (servers in the EU region)
• —Vercel Inc: application hosting and infrastructure
• —Vercel Speed Insights: anonymous performance analytics (with consent only)
• —Cloudflare Inc: storage for the images and documents you upload
• —Stripe Inc: subscription billing, and ticket payments for museums that sell tickets. Stripe handles card details directly and we never see or store them
• —Resend Inc: sending email, including account, billing and subscription notices
• —Upstash Inc: short-lived rate limiting data
• —Functional Software Inc (Sentry): error reporting, used to diagnose faults

Cookies

We use two categories of cookies:

• —Essential cookies — session cookies placed by Supabase to keep you signed in. These are strictly necessary and do not require consent.
• —Analytics cookies — used by Vercel Speed Insights only if you have given consent. You can withdraw consent at any time.

Your rights

Under UK GDPR and EU GDPR, you have the right to:

• —Access — request a copy of your personal data (use the "Export my data" feature in Settings)
• —Rectification — correct inaccurate data
• —Erasure — delete your account and all associated data (use "Delete account" in Settings)
• —Portability — receive your data in a machine-readable format (JSON export via Settings)
• —Object — object to processing based on legitimate interests
• —Complaint — lodge a complaint with the ICO (ico.org.uk) or your local EU supervisory authority

To exercise any right, email hello@composition.agency. We will respond within 30 days.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email to the address on your account. Continued use of Vitrine after changes constitutes acceptance.