Cookie and Privacy Policy.

Mostra is operated by House of Octopus Limited, a company registered in England and Wales under company number 17228856, with its registered office at 6 Boulevard Place, Apartment 137, Hove, BN3 7RR, United Kingdom. For any privacy question, write to us at hello@getmostra.com. We act as data controller for the personal data we handle through this site.

• Account data you give us when you sign up: email, display name, handle, role, and any profile fields you choose to publish. Your legal name, when you provide one, is kept private and used only on certificates of authenticity, invoices, and payout records.
• Artist content you upload: artwork images, descriptions, prices, shipping settings.
• Transaction metadata when you buy or sell: order id, amounts, and the shipping address that you share with the other party.
• Messages you send through the on-site inbox.
• Enquiries and contact form submissions, including a one-way SHA-256 hash of your IP address and a truncated browser user agent, used for rate limiting and spam prevention. We do not store raw IP addresses.
• Certificate of authenticity verification lookups, retained with the same hashed IP only for abuse prevention.
• Search queries you type into the on-site AI search, retained in aggregate to improve results and to detect abuse.
• Reports members file against other members or artworks, and the actions our moderators take in response.
• Newsletter attribution: when you subscribe via someone's referral link, we record that referrer so we can credit them.
• Basic technical data: page views and referrer, used to run the site and prevent abuse.
• Cookie choices you make in the preferences panel.

Mostra does not handle card details. Payments are processed by Stripe acting as the artist's payment provider. We do not store bank account or card numbers.

Mostra features a small number of publicly known artists on invitation-only claimable profiles, built from published biography, discipline, city, and public images. If you are one of these artists and would like your profile removed before you claim it, email hello@getmostra.com and we will take it down within 7 days. Claiming the profile makes you the data controller of what you keep and edit afterwards.

• To operate your account and show your profile and works.
• To connect buyers and artists for sales, shipping, and customer support.
• To prevent fraud, spam, and abuse, and to enforce our terms.
• To send transactional emails about your account and orders.
• To send marketing emails only when you have opted in, and you can unsubscribe at any time.

• Contract: to provide the service you signed up for.
• Legitimate interests: to keep the site safe, prevent abuse, and improve it, balanced against your rights.
• Consent: for non-essential cookies and marketing emails. You can withdraw it at any time.
• Legal obligation: to keep records required by law, such as tax and accounting.

• Stripe: to take payments on behalf of the artist and pay them out.
• Supabase: managed database, authentication, and storage for the site.
• Cloudflare: hosting and content delivery.
• Resend: to send transactional and opt-in marketing emails on our behalf.
• Other Mostra members only when you choose to: messages, follows, orders.

We do not sell your personal data and we do not share it with advertisers.

Some providers process data outside the UK and EEA. When that happens we rely on the UK International Data Transfer Agreement or EU Standard Contractual Clauses and equivalent safeguards.

• Account and content: kept while your account is active. If you delete your account we remove your profile and unpublished content within 30 days.
• Completed sales: limited records kept for tax and accounting for up to 7 years.
• Enquiries: hashed IP and user agent are erased 60 days after the enquiry is sent; the enquiry itself remains between you and the artist.
• Certificate verification lookups: purged after 90 days.
• Security and abuse logs: purged after 180 days.
• Search queries: retained in aggregate for up to 12 months, then deleted or fully anonymised.

You have the right to access, correct, port, restrict, object to, and delete your personal data. Signed-in members can do this without contacting us: visit Account & security to download a full JSON copy of your data or permanently close your account. You can also email hello@getmostra.com and we will reply within 30 days. You can lodge a complaint with the UK Information Commissioner's Office (ICO) or your local EU supervisory authority.

We use a small set of cookies, grouped into four categories.

• Strictly necessary. Sign-in session and security. Always on, cannot be turned off.
• Functional. Remembering your currency, theme, and preferences. On by default, can be turned off.
• Performance and analytics. Aggregated, privacy-respecting usage stats. Off until you opt in.
• Marketing. We do not run third-party advertising trackers on Mostra.

You can change your choices at any time from the Cookie preferences link in the footer.

Mostra is not directed to children under 16. If you believe a child has given us personal data, contact us and we will remove it.

We will update this page when our practices change and revise the date at the top. Material changes will be announced by email or in-app banner.

This policy and any dispute relating to it are governed by the laws of England and Wales and subject to the exclusive jurisdiction of the courts of England and Wales.