At a Glance
This summary is provided for convenience only and does not form part of the legally binding terms. Please review the full terms below.
Version 4.1 · Last Updated: September 7, 2026
This Privacy Policy ("Policy") applies to Visionary Studios, a trading name of MTSTGEORGE LTD ("Company," "we," "us," or "our"), and governs the collection, use, and disclosure of personal information through our platform and services (collectively, the "Services").
By accessing or using the Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, you must immediately cease using our Services.
Users may upload files and documents to the platform in connection with artwork listings and marketplace activity. Uploaded materials may include, but are not limited to: artwork images, certificates of authenticity (COAs), provenance records, condition reports, exhibition histories, invoices, receipts, and any other supporting documentation submitted by sellers or buyers. These files are stored by the platform to support artwork listings, facilitate transactions, and maintain marketplace functionality.
Users are solely responsible for ensuring they have the full legal right to upload, share, and distribute any files they submit to the platform. Users acknowledge that uploaded files may contain personal or identifying information - including names, addresses, signatures, or financial details embedded within documents - and that by uploading such files, they consent to the platform storing and processing them for the purposes described in this Policy. Users should not upload files containing sensitive personal data of third parties without appropriate authority to do so.
When you use the platform's messaging features, we collect and store the content of messages exchanged between buyers and sellers, message timestamps, sender and recipient identifiers, conversation thread IDs, and any attachments or related metadata associated with those communications. This applies to all messages sent through the platform's built-in messaging system, including pre-sale enquiries, post-sale coordination, and any other communications facilitated by platform tools. These communications are stored for the purposes of facilitating transactions between buyers and sellers, providing customer support, resolving disputes, and maintaining marketplace integrity. See Section 7.2 for full details on how communication data is retained and the lawful basis for its processing.
When you use our AI-powered features (descriptions, interpretations, messaging assistance, discovery tools, and recommendations), we process your inputs and content to provide these services. User interactions with search and AI tools - including queries, filter selections, and prompts - may be logged to improve platform functionality and the quality of recommendations. AI-generated content is provided "as is" without warranties.
We may collect personal information through our official social media channels, including but not limited to TikTok, Instagram, and other platforms.
This may include:
This information is used for the following purposes:
Where you submit your information via social media lead forms, such data may be processed both by the relevant platform provider (e.g. TikTok Technology Limited) and by Visionary Studios in accordance with this Privacy Policy.
You should also review the privacy policies of the relevant social media platforms to understand how they process your data independently.
Where required by applicable data protection laws, we will rely on your consent to process personal data collected through social media lead forms. You may withdraw your consent at any time by contacting us at privacy@visionarystudios.art or by using unsubscribe mechanisms provided in communications.
We process personal data under the following lawful bases:
Where the platform acts as the deemed supplier for VAT under EU law, we additionally process the buyer's country of residence and, for B2B transactions, the buyer's VAT identification number, on the lawful basis of legal obligation (Article 6(1)(c) GDPR) to collect and remit VAT via the EU One Stop Shop.
The table below maps each category of our processing to the lawful basis we rely on:
| Processing category | Lawful basis |
|---|---|
| Account & profile management | Performance of a contract |
| Marketplace transactions, shipping coordination and platform messaging | Contract; legal obligation for record-keeping |
| Buyer identity verification (purchases of €2,500 and above) | Legal obligation (AML / fraud prevention) and contract |
| Anti-money-laundering due diligence (transactions of €10,000 and above) | Legal obligation (Criminal Justice Act 2010 / 5AMLD) |
| Seller payouts and commission records | Contract; legal obligation (tax and accounting) |
| Site analytics, security and moderation logs | Legitimate interests |
| AI-assisted discovery and personalised recommendations | Legitimate interests — you may object at any time |
| Pre-approval applications (access, seller, appraiser) | Pre-contract steps and legitimate interests |
| Editorial outreach notes on prospective sellers and appraisers | Legitimate interests (business-to-business) |
| Marketing newsletter | Consent — opt-in, unsubscribe at any time |
| Legal compliance evidence (terms and privacy acceptance logs) | Legal obligation |
Visionary Studios uses automated tools and AI-assisted services to support platform functionality, including but not limited to: artwork discovery, personalised search results, style-based recommendations, artwork description generation, market trend analysis, quality assessment, and content moderation assistance. These features are designed to improve the relevance and quality of the experience for buyers and sellers.
When you interact with AI-assisted features - including by entering search queries, prompts, filter selections, or other inputs - those interactions may be processed and logged by the platform. This processing is carried out for the following purposes:
Visionary Studios does not use fully automated decision-making processes that produce legal effects or similarly significant effects on users within the meaning of GDPR Article 22. AI-assisted features on the platform are designed to support and inform - not replace - human judgment. Outputs generated by AI tools (including artwork descriptions, quality scores, market estimates, and recommendations) are indicative only and do not constitute binding determinations, professional appraisals, or decisions affecting users' legal rights or obligations.
Where any automated process is used in the review or moderation of platform content, human oversight is maintained. Users who believe an automated process has adversely affected them may contact us at privacy@visionarystudios.art to request a manual review.
Some AI-assisted features may be powered by third-party AI providers. Where third-party services process user data as part of delivering AI features, such providers act as data processors under appropriate contractual arrangements. User inputs processed by third-party AI services are handled in accordance with those providers' data processing terms and are not used to train third-party models without separate disclosure.
Visionary Studios uses artificial intelligence and automated processing in the following ways. Where any of these activities constitute profiling or automated decision-making under GDPR, the specific lawful basis and your rights are set out below.
We analyse your browsing behaviour, wishlist activity, search queries, and purchase history to generate personalised artwork recommendations. This constitutes profiling under Article 4(4) GDPR. The lawful basis for this processing is our legitimate interests (Article 6(1)(f)) in providing a relevant and personalised discovery experience. You have the right to object to this profiling at any time by contacting privacy@visionarystudios.art.
Our AI-powered chat assistant processes your queries and interaction history within a session to provide contextual guidance. Session data is not retained beyond the active session and is not used for profiling purposes.
Submitted artwork listings are assessed by automated AI tools as part of our moderation process. This assists human admin review and does not constitute solely automated decision-making under Article 22 GDPR - all listing decisions are subject to human review before any outcome is applied.
Seller accounts are subject to automated risk assessment based on transaction patterns, dispute history, and account behaviour. This assists human admin review and does not constitute solely automated decision-making - all risk flags are reviewed by a human administrator before any account action is taken.
You have the right to obtain human intervention, express your point of view, and contest any decision that significantly affects you. To exercise this right, or to object to profiling-based processing, contact us at privacy@visionarystudios.art or use our online data request form.
All payment transactions on the platform are processed through Stripe, Inc. or its affiliates ("Stripe"). Stripe acts as the payment processor and payment data controller for all payment-related information collected on this platform.
MTSTGEORGE LTD and Visionary Studios do not collect, store, or process payment card information - including card numbers, CVV codes, or bank account details - directly. Payment information is submitted by users directly to Stripe through Stripe's secure, PCI-compliant payment interfaces. We do not have access to full payment card details at any point.
We store only Stripe-issued reference identifiers (such as customer IDs, payment intent IDs, and Connect account IDs) to enable transaction tracking, order reconciliation, and seller payout routing. These identifiers do not contain or represent any raw financial data.
Sellers who list artworks on the platform are required to connect a Stripe Connect Express account. For card payment transactions, seller payout banking details are collected and held exclusively by Stripe. The platform does not have access to seller banking details submitted through Stripe Connect. Stripe acts as an independent data controller with respect to seller banking and identity verification data collected during Stripe Connect onboarding.
For acquisitions of €2,500 or above, buyers may also pay by bank transfer. This is processed entirely by Stripe: Stripe generates a unique virtual bank account for the buyer's transfer, and funds settle directly into the seller's own connected Stripe account. Visionary Studios does not receive, collect, or store either party's bank account details (including account numbers or IBANs) at any point in this process - this data is held exclusively by Stripe, in the same manner described for card payments above.
Visionary Studios does not act as a payment intermediary, escrow provider, or financial institution in relation to bank transfers.
When you submit payment information through the platform, Stripe may independently collect and process payment-related data in accordance with its own privacy policy. This may include, but is not limited to: card details, billing address, transaction history, device and browser information, fraud signals, and identity verification data. This data is collected directly by Stripe and is subject exclusively to Stripe's Privacy Policy.
Visionary Studios and MTSTGEORGE LTD have no visibility into, access to, or control over the personal data Stripe collects through its own interfaces. Stripe acts as an independent data controller in respect of data collected through its payment services. For information about how Stripe processes your data, manages data subject rights requests, or transfers data internationally, please refer directly to Stripe's Privacy Policy at stripe.com/privacy.
By making a purchase or receiving a payout on this platform, you acknowledge that you have read and agree to Stripe's Privacy Policy and Stripe's Terms of Service, which govern the collection and use of your payment data. We encourage you to review Stripe's policies before submitting payment information.
For buyers making high value purchases (€2,500 and above), identity verification is required prior to initiating a transaction. This process is conducted entirely by Stripe, Inc. via Stripe Identity. Visionary Studios does not receive, store, or process your identity documents (such as passport or driving licence scans). We receive only a verification status (verified or not verified) and the date of verification, which is stored on your account profile. This data is processed on the lawful basis of legal obligation (EU AML compliance - Directive 2018/843) and legitimate interests (fraud prevention).
Visionary Studios operates as a technology platform facilitating transactions between users. We do not act as a merchant of record, payment processor, or financial intermediary. All payment processing - card payments and bank transfers alike - is conducted by Stripe; a bank transfer settles via a Stripe-generated virtual bank account directly into the seller's own connected Stripe account.
The Visionary Studios platform is built and hosted on infrastructure provided by Base44, Inc., a US-based software platform provider. Base44 acts as a data processor on behalf of MTSTGEORGE LTD and processes personal data solely in accordance with our instructions and under the terms of Base44's Data Processing Addendum, available at base44.com/dpa.
As our platform infrastructure provider, Base44 may process the following categories of personal data in the course of delivering its services: account information, usage data, platform content (including artwork listings, uploaded files, and messages), transaction metadata, and any other data processed through the platform in the ordinary course of its operation.
Base44 engages its own sub-processors in the delivery of its infrastructure services. All Base44 sub-processors are bound by data processing agreements governing the transfer and handling of personal data. You may request further information about Base44's sub-processor arrangements by contacting us at privacy@visionarystudios.art.
Base44's servers are currently located in the United States. As a result, personal data processed through the Visionary Studios platform may be transferred to and stored in the United States in connection with Base44's infrastructure services. Such transfers are governed by Base44's Data Processing Addendum, which incorporates Standard Contractual Clauses (SCCs) as adopted under GDPR Article 46(2)(c), with Ireland designated as the governing EU member state for the purposes of Clauses 17 and 18 of those SCCs. A copy of Base44's Data Processing Addendum is available at base44.com/dpa.
We will update this section when EU data residency has been confirmed for our platform application. For further information about Base44's data storage and transfer arrangements, please refer to Base44's privacy documentation at base44.com/dpa.
We may share your information with:
As a company registered in Ireland, MTSTGEORGE LTD processes and retains personal data in accordance with the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and the Irish Data Protection Act 2018. We retain personal data only for as long as is necessary for the purposes for which it was collected, subject to the following:
Account information (including name, email address, and profile details) and transaction records are retained for as long as necessary to operate the marketplace, fulfil our contractual obligations to users, and comply with applicable legal obligations. Following account closure, we may retain certain account and transaction data for a minimum of six (6) years to comply with Irish tax law, company law obligations under the Companies Act 2014, and any applicable EU financial regulations.
Visionary Studios stores communications exchanged through the platform, including but not limited to: the full content of messages sent between buyers and sellers, message timestamps, conversation thread identifiers, sender and recipient details, and any related conversation metadata. This data is collected and retained for the following specific purposes, each of which constitutes a lawful basis for processing under GDPR Article 6:
Communication data is anonymised 36 months after the conversation ends, and in-app notifications and email delivery logs are pruned automatically (12 and 24 months respectively). Where a dispute, investigation, or legal claim is pending or reasonably anticipated, relevant communications may be retained beyond these periods until the matter is resolved.
Artwork listings (including images, descriptions, and supporting documentation), bids, and general platform activity logs are stored on the same basis and subject to the same retention principles.
Financial and payment-related records - including order data, Stripe reference identifiers (payment intent IDs, customer IDs, Connect account IDs), payout records, and commission calculations - are retained for a minimum of six (6) years from the date of the relevant transaction for accounting, tax reporting, and regulatory compliance purposes. This reflects the minimum retention periods prescribed under Irish Revenue requirements and EU VAT regulations.
Under GDPR Article 17, you have the right to request the deletion of your personal data. To submit a deletion request, contact us at privacy@visionarystudios.art. We will action verified requests within 30 days. However, please note that the right to erasure is subject to exceptions, including where retention is necessary to:
Where deletion of specific data is not possible due to legal retention requirements, we will inform you of this and, where feasible, restrict processing of that data to the minimum necessary to fulfil the applicable legal obligation.
As an Irish-registered company, our lead supervisory authority under GDPR is the Data Protection Commission (DPC) of Ireland. You have the right to lodge a complaint with the DPC at www.dataprotection.ie if you believe your data protection rights have not been respected.
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. No system is completely secure, and we cannot guarantee the absolute security of your data. You acknowledge the inherent risks of transmitting information over the internet.
In the event of a personal data breach within the meaning of GDPR Article 4(12), MTSTGEORGE LTD will notify the Data Protection Commission (DPC) of Ireland without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33. Where notification to the DPC is not made within 72 hours, we will provide a reasoned explanation for the delay.
Where a personal data breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will notify those individuals directly without undue delay in accordance with GDPR Article 34, unless an exemption applies (such as where the data was encrypted or the high risk no longer materialises following remediation). Such notification will describe the nature of the breach, the likely consequences, and the measures taken or proposed to address it, and will include our data protection contact details.
Upon becoming aware of a potential data breach, we will: (i) take immediate steps to contain and assess the breach; (ii) document the breach in accordance with our internal records of processing; (iii) assess the risk to affected individuals; and (iv) notify the DPC and affected individuals where required by applicable law.
If you become aware of or suspect a personal data breach involving your data, please contact us immediately at privacy@visionarystudios.art.
When you use the Room Visualizer, the room photo you upload is processed solely for the purpose of generating your composite preview. Room photos are not stored beyond the active session and are not used for any other purpose. Generated composites may be stored temporarily to enable download and sharing functionality. We do not use your uploaded room photos for training AI models or for any marketing purpose.
Depending on your jurisdiction, you may have rights to:
To exercise these rights, contact us at privacy@visionarystudios.art or use our online data request form. We reserve the right to verify your identity and may charge reasonable fees where permitted by law.
You have the right to request deletion of your personal data at any time. Upon receiving a valid request, we will delete or anonymise your personal data unless retention is required for legal, regulatory, or legitimate business purposes.
Please note that certain data may be retained where necessary to:
Where data cannot be fully deleted, it will be restricted and retained only for the minimum period required.
Where you have engaged in transactions on the Platform, certain personal data (including transaction records, payment references, and related communications) may be retained for a legally required period, typically up to 5–10 years, in accordance with applicable tax, accounting, and anti-money laundering regulations.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, and regulatory requirements. Retention periods may vary depending on the nature of the data and our legal obligations.
The table below sets out the retention period for each category of data we hold. Shorter-lived categories are pruned automatically by scheduled retention jobs; longer-lived categories are kept only where a legal obligation or a pending dispute requires it.
| Data Type | Purpose | Retention Period |
|---|---|---|
| Account & profile data | Account management | Until account deletion or verified erasure request, subject to legal holds |
| Marketplace transaction & financial records (incl. payment references) | Tax, accounting and regulatory compliance; transaction verification and dispute handling | 6–7 years from the transaction |
| AML due-diligence records (transactions of €10,000 and above) | Statutory anti-money-laundering obligations | 5 years from the end of the relationship — statutory, overrides erasure requests |
| Buyer identity verification status (purchases of €2,500 and above) | Fraud prevention / AML | Kept for account lifetime; ID documents are held exclusively by Stripe under their policy |
| Platform messages & price negotiations | Platform functionality, dispute resolution, fraud prevention | Anonymised 36 months after the conversation; dispute-linked messages retained until the matter is resolved |
| In-app notifications | Service delivery | 12 months (automated) |
| Email delivery logs | Delivery troubleshooting | 24 months (automated) |
| Analytics, security & moderation logs | Platform security, abuse prevention and improvement | 12–24 months (automated) |
| Pre-approval applications & outreach notes | Application review only | Pruned 12 months after a final decision |
| Legal acceptance logs (terms/privacy versions) | Evidence of compliance | Retained long-term as legal evidence |
| Newsletter subscriptions | Marketing (opt-in) | Until unsubscribe |
In all cases, we may retain data for longer where required to comply with legal obligations, resolve disputes, or enforce our agreements.
In the course of providing the Services, your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States. Such transfers occur in connection with our use of third-party service providers, including Stripe, Inc. (payment processing) and Base44, Inc. (platform infrastructure and hosting).
Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place in accordance with GDPR Chapter V, including: adequacy decisions where the European Commission has determined that the destination country provides an adequate level of data protection; Standard Contractual Clauses (SCCs) where transfers are made pursuant to the European Commission's standard contractual clauses for the transfer of personal data to third countries as adopted under GDPR Article 46(2)(c); in respect of Stripe, Inc., whose data transfers are governed by Standard Contractual Clauses and Stripe's own data processing agreements - for full details of Stripe's international transfer mechanisms please refer to Stripe's Privacy Policy at stripe.com/privacy; and in respect of Base44, Inc., whose data transfers are governed by Standard Contractual Clauses with Ireland designated as the governing EU member state, as set out in Base44's Data Processing Addendum at base44.com/dpa; and in respect of Resend, Inc. (transactional email delivery), whose data transfers are governed by Standard Contractual Clauses as set out in Resend's Data Processing Agreement at resend.com/legal/dpa. Resend's email sending infrastructure uses an EU (Ireland) sending region, though account-level data including email metadata and logs is stored in the United States under the same SCC mechanism.
You may request further information about the safeguards we have in place for international transfers, and obtain copies of relevant transfer mechanisms, by contacting us at privacy@visionarystudios.art.
Our Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us.
We may update this Policy from time to time. Where we make material changes to how we collect, use, or share your personal data, we will provide advance notice of not less than 30 days by email to your registered address or by prominent notice on the platform prior to the changes taking effect. Your continued use of the Services after the effective date of any material changes constitutes acceptance of the updated Policy. Where a change to our processing activities requires a new or different lawful basis - in particular where we previously relied on your consent - we will seek your consent separately before the change takes effect. For non-material changes, including corrections and clarifications that do not affect the substance of our data processing activities, updates may take effect upon posting.
For questions about this Privacy Policy, contact us at:
MTSTGEORGE LTD (Trading as Visionary Studios)
Email: privacy@visionarystudios.art
MTSTGEORGE LTD has assessed its processing activities against the criteria for mandatory Data Protection Officer (DPO) appointment under GDPR Article 37. At the current scale of operations — a small team, processing that is limited in scale and volume, and compliance oversight handled directly by company management — we have determined that a mandatory DPO appointment is not required. We will formally reassess this position as soon as any of the following occurs: (i) our headcount exceeds 20 staff; (ii) we introduce systematic, large-scale processing or monitoring of individuals; (iii) the volume of anti-money-laundering due diligence we perform makes that processing a core activity of the business; or (iv) we are contacted by the Data Protection Commission or another regulator. For all data protection queries, requests, and concerns, please contact us at privacy@visionarystudios.art.
Visionary Studios operates in the art market, a sector subject to enhanced anti-money laundering (AML) obligations under EU Directive 2018/843 (5AMLD) and its successor directives, as implemented under Irish law. In compliance with these obligations, we process certain personal data on the lawful basis of legal obligation (GDPR Article 6(1)(c)):
This Privacy Policy is provided for informational purposes. By using our Services, you acknowledge that you understand and accept the terms outlined herein. We recommend consulting with legal counsel for advice specific to your situation.