Effective Date: June 13, 2025

Malt is a global, artist-only platform committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and safeguard your personal data, and outlines your rights under laws like the EU General Data Protection Regulation (GDPR), UK GDPR, and the California Consumer Privacy Act/California Privacy Rights Act (CCPA/CPRA). By using Malt, you acknowledge that you accept the practices described in this Policy.

Personal Data We Collect

Information You Provide: When you create a Malt account or use our services, we collect the limited personal information you provide. This may include your name, email address, username, profile biography, and any social media or website links you add to your profile. If you are an artist selling or receiving payments through Malt, we may ask for additional details such as your billing address or payout account information. However, Malt does not collect or store sensitive payment card details directly – those are handled by our payment processor (see Third-Party Services below). We also retain communications you send us (for example, support requests or feedback) and any content you post on the platform as part of your profile or artist portfolio.

Information Collected Automatically: We collect certain data automatically to operate and secure our platform. This includes technical information like your IP address, device and browser type, pages or features you access, and timestamps of your activities. We gather basic usage statistics to understand how artists use Malt and to improve our services. Importantly, we do not use cookies or invasive tracking technologies to collect this information. Malt uses a minimal tracking model – for example, we maintain your login session using a secure Supabase authentication token instead of persistent cookies. By avoiding cookies and third-party trackers, we ensure that your usage data remains private and is not used to follow you across other sites.

Children’s Data: Malt’s services are not intended for children. You must be at least 18 years old to create an account or use Malt. We do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and discover that a minor under 18 has provided personal information to Malt, please contact us immediately. We will take prompt steps to delete the information and terminate the child’s account, consistent with applicable laws. Malt does not offer any child-directed features, and our platform is designed for use by adult artists and their audiences only.

How We Use Your Personal Data

Malt uses the personal data we collect only for legitimate and necessary purposes, including:

• Providing and Improving the Service: We use your information to create and manage your account, allow you to log in securely, and enable core platform features such as your artist profile and interactions with other users. For example, your name and profile info may be displayed to other users to facilitate community interaction, but you can choose what details to include on your public profile. We also use data about how you use Malt to improve our platform’s functionality, fix technical issues, and develop new features that enhance the artist experience.
• Transactions and Payments: If you engage in commerce on Malt (such as selling your artwork or merchandise), we use personal data to process those transactions. This includes facilitating payments through our third-party payment processor and keeping records of your purchase or sales history. We do not see or store your credit card or bank details when you make a purchase; those are handled directly by Stripe, our payment provider (see below). We only receive confirmation of the transaction (such as date/time and amount) to update your account and order history.
• Communication: We use contact information (like your email) to send you service-related messages. These include confirming your account email, providing receipts or invoices, notifying you of important account or policy updates, or responding to support inquiries. We may also send optional updates such as a newsletter or announcements about new Malt features, but only if you have given us consent where required by law. You can opt out of marketing emails at any time by using the unsubscribe link or contacting us, and we will respect your choice.
• Security and Legal Compliance: We may process personal data as needed to secure our platform, prevent fraud, enforce our Terms of Service, and comply with legal obligations. For example, we might use certain data to investigate suspicious activity or to ensure users are abiding by community guidelines. If required by law (such as responding to a court order or regulatory requirement) or to protect the rights and safety of Malt, our users, or others, we may use and disclose necessary information in accordance with applicable regulations.

Legal Bases for Processing (GDPR/UK GDPR): For individuals in the European Economic Area or United Kingdom, we process personal data only under valid legal bases. Primarily, we process data to perform our contract with you – for example, when you sign up and agree to our terms, we must use your data to provide the Malt services you requested. In other cases, we rely on legitimate interests – such as improving our platform, securing our services, and supporting our artist community – but only where those interests are not overridden by your data protection rights. If we ever seek to process your data for purposes that require consent (for instance, if we wanted to use your email for a new marketing program in the future), we will ask for your consent, and you can withdraw consent at any time. We also may process data to comply with legal obligations (e.g. keeping transaction records for tax or accounting requirements).

Third-Party Services and Data Sharing

We value your privacy, and we do not sell or rent your personal data to anyone. Malt only shares personal data in a few limited circumstances, described below, and we do so with careful safeguards in place:

• Service Providers (Processors): We employ trusted third-party companies to help us operate Malt and deliver services to you. These service providers act under our instructions and only process your data for the purposes we specify. Key service providers include:

• Supabase – a cloud database and authentication service we use to store your account information and manage user authentication securely. Supabase helps us host your data and login credentials, and it is bound to strict confidentiality and security obligations.

• Stripe – our payment processor for handling any purchases or sales on Malt. When you make a payment (or receive a payout), you will provide your payment details (such as credit card number or bank account) directly to Stripe via embedded forms or secure redirects. Malt does not see, collect, or store your full payment card information; Stripe processes that information securely and in compliance with PCI-DSS standards. Stripe may receive your name, email, and transaction amount to process the payment, and they will use and protect that information according to their own privacy policy. (You can review Stripe’s Privacy Policy at any time on their website.) By using Malt’s commerce features, you are authorizing this transfer of your details to Stripe solely for payment processing.

• Tinybird – an analytics platform we use to gather aggregated, anonymized usage statistics about how Malt is used. Tinybird allows us to analyze metrics like the number of page views or feature usage in real-time without tracking individual users across the web. We have configured Tinybird in a privacy-first manner: we do not send personally identifying information (like names or emails) into our analytics events, and we do not use cookies for analytics. This means all data collected for analytics is de-identified and cannot be traced back to you individually. Tinybird operates as our data processor under GDPR, and they comply with GDPR requirements and have robust security measures in place.

  In addition to the above, we may use other vendors for things like cloud infrastructure (to host our website), email delivery (to send verification or notification emails), or customer support software. We only share the minimum data necessary with these providers and require them to protect your information and use it only for the agreed purpose. We do not allow our service providers to use your data for their own marketing or any purpose other than serving you on our behalf.

• Business Transfers: If Malt is ever involved in a merger, acquisition, sale of assets, or other business transaction, user information (which may include personal data) could be transferred to or acquired by another company as part of that deal. We would ensure any acquiring company continues to protect your personal data in line with this Privacy Policy. If such a transfer is subject to additional rights under law, we will provide you with notice and choices as required.