Privacy Policy
Pithos ("Pithos", "we", "us") provides collection-management software to museums, galleries and similar institutions ("Institutions"). This policy explains what personal data we collect, why, and what rights you have over it — whether you're a staff member or volunteer using Pithos on behalf of an Institution, or a visitor to an Institution's sign-in page.
1. Who is responsible for your data
Pithos is currently operated by its founder, ahead of formal incorporation as a registered company — we'll name that entity here once it exists. You can reach us about privacy matters at alicw8@gmail.com.
Pithos works on a multi-tenant basis: each Institution has its own private collection, staff list and settings, invisible to every other Institution. For the collection data and staff/volunteer records an Institution puts into Pithos, the Institution is the data controller and Pithos acts as its data processor — we hold and process that data on the Institution's instructions, under a separate data processing agreement with each Institution. This policy describes how we handle data as controller (your account with us, and how we run the service) and, where relevant, how we handle data as processor on an Institution's behalf.
2. What we collect
Account data
For every person with a Pithos sign-in, we hold:
- Name and email address
- The Institution(s) you belong to, and your role there (viewer, contributor, manager or admin)
- A securely hashed password, or nothing at all if you sign in via a reset link only
- Basic display preferences you set yourself (text size, font, colour theme) — stored against your account, not used for anything beyond showing you the app the way you asked to see it
Collection data
On an Institution's instructions, we store whatever they catalogue: object records, images, locations, categories, provenance and accession information, and the history of changes made to each record. This can include personal data about third parties an Institution records for its own purposes — for example a donor's name on a provenance record. We do not inspect or use this data for any purpose of our own; see Section 1.
Technical data
Standard web request data (IP address, browser type, timestamps) is generated automatically by our hosting providers as part of serving the site and keeping it secure, and is retained by them on their own standard schedules — see Section 5.
Cookies and local storage
Pithos does not currently use tracking or advertising cookies, and does not run analytics. The app stores a small amount of data in your browser's local storage — your display preferences and current view settings — which never leaves your device and isn't read by us. If this ever changes (for instance, if we turn on usage analytics), we'll update this section and, where the law requires it, ask for your consent first.
3. Why we process your data, and our legal basis
| Purpose | Legal basis |
|---|---|
| Providing the Pithos service to you and your Institution | Performance of a contract with your Institution |
| Account security, fraud prevention, and the access-control logging described in Section 6 | Legitimate interests, and our obligations to Institutions as processor |
| Sending you transactional email — invitations, password resets, and account notices | Performance of a contract / legitimate interests |
| Responding to support requests | Legitimate interests |
| Complying with law, or defending our legal rights | Legal obligation / legitimate interests |
4. Who we share data with
We use a small number of subprocessors to run Pithos. None of them may use your data for their own purposes.
| Provider | What for | Where |
|---|---|---|
| Google Cloud / Firebase | Database, file storage, and authentication | australia-southeast1 (Sydney, Australia) |
| Google Cloud / Firebase | The server-side functions the app runs on | us-central1 (Iowa, United States) |
| Vercel | Hosting the website itself | Vercel's global edge network — no single fixed region; the nearest edge location to each visitor serves the (identical) static site |
| Not yet in use | Pithos doesn't currently send automated email; invitation and reset links are shared directly by your Institution's admin. When we turn on automated email delivery, we'll name the provider here first. | — |
We do not sell personal data, and do not share it with anyone for their own marketing purposes.
5. Pithos's own access to your Institution's data
6. International transfers
Your Institution's collection and account data is stored in Australia
(Google Cloud's australia-southeast1 region). The server-side
functions that read and write that data run in the United States (Google
Cloud's us-central1 region), which means data does cross into
the US briefly in the course of being processed, even though it is stored
at rest in Australia. If your Institution is located outside Australia,
this also means a transfer into Australia.
Where this requires a safeguard under data protection law, we put an appropriate transfer mechanism in place before that data is transferred.
7. How long we keep data
We keep your account data for as long as your Institution's subscription is active. When an Institution's account is closed, we retain their data for 90 days to allow them to export it, then delete it.
Some records are kept permanently by design, even after other data is deleted, because deleting them would undermine the thing they exist to guarantee:
- An object's change history is append-only — once written, an entry is never edited or removed. This is what makes an Institution's accession record auditable, and Institutions rely on it for their own legal/provenance record-keeping.
- Internal audit logs of administrative actions (grants of elevated access, platform-level actions taken on an Institution's behalf) are kept indefinitely and are not accessible to Institutions or their staff at all — only to Pithos, for accountability.
If a personal-data erasure request would touch one of these records, we'll tell you plainly rather than pretend to comply — see Section 8.
8. Your rights
Depending on where you live, you may have the right to:
- Ask what personal data we hold about you, and get a copy of it
- Ask us to correct inaccurate data
- Ask us to delete your data, or restrict how we use it
- Object to processing based on legitimate interests
- Receive your data in a portable format
- Complain to your local data protection regulator
For data your Institution controls (your staff profile, the collection itself), we'll usually direct your request to them, since they're the controller — but you're welcome to contact us either way and we'll point you the right direction. As noted in Section 7, some append-only or audit records can't be selectively deleted without undermining what they're for; we'll explain exactly which ones apply, if any, rather than silently refuse.
9. Security
Every Institution's data is isolated from every other's by server-side access-control rules, independently of anything the app's own interface does or doesn't show you — so a bug in the interface can't expose another Institution's records. Role-based permissions (viewer / contributor / manager / admin) are enforced the same way. We review these controls periodically and fix issues we find. No system is perfectly secure, and we can't guarantee against every possible incident — but we take this seriously and will tell you promptly if something goes wrong that affects your data.
10. Children's privacy
Pithos is a professional tool for museum and gallery staff and volunteers. It isn't directed at children, and we don't knowingly collect data from anyone under 16.
11. Changes to this policy
If we make a material change to this policy, we'll let Institution admins know and update the date at the top of this page.
12. Contact us
Questions, requests, or complaints about this policy: alicw8@gmail.com.