Your archive belongs to you.

Who is responsible.

Samlio is a private archive for artists and collectors, operated by Techxtr AB. We decide why and how your personal data is handled here, which makes us the controller under the GDPR.

Anything in this policy, and any request about your own data, reaches a person at hi@samlio.com. We answer within a month, usually the same week.

Techxtr AB, org. nr 559277-5943, Vettekullavägen 97-9, 374 30 Karlshamn, Sweden.

What we hold, and why.

Four things, each for its own reason. Nothing is collected because it might be useful later.

• Your archive. The works you record and the images, measurements, prices, provenance notes and documents you add to them, along with your collections and the viewing rooms you share. We hold it to run the service you signed up for, which is our contract with you. It stays until you delete it.
• Your account. Your email address, sign-in credentials, workspace role and, if you pay, your subscription status. Also our contract with you. Payment card details never reach us: Stripe handles them.
• Collected, our letter. Your email address, the date you confirmed, the words you agreed to and where you subscribed. This one runs on your consent, which you can withdraw at any time.
• How the site is used. Pages visited and how you arrived, kept for security and so we can see what works. The basic first-party record uses no cookies and cannot identify you. Everything beyond it waits for your consent in the cookie banner.

We do not sell data, we do not profile you, and your archive is never made publicly searchable. A viewing room is visible only to whoever holds its link, and only until you close it.

Images, and where AI comes in.

When you ask Samlio to look at a photograph of a work, the image is sent to Anthropic, which returns suggested details for you to accept or ignore. Nothing is filled in on your behalf, and the material is not used to train anyone's model.

Uploaded image files are stored in a bucket that is readable by anyone holding the file's exact address. The addresses are long random strings that we never publish, and the app itself only ever shows you your own works, but we would rather say this plainly than imply a lock that is not there yet. Moving to signed, expiring links is on the build list.

Who else touches it.

We use a small number of companies to run Samlio. Each one may process your data only on our instructions and only for what is listed here.

• Supabase. The database and file storage where your archive lives.
• Vercel. Hosting and delivery of the site itself.
• Stripe. Payments and subscriptions. Card details stay with Stripe.
• Resend. Sends our emails, including Collected.
• Loops. Holds contact records for mail about your own account.
• Sentry. Error reports, so a fault can be found and fixed.
• Anthropic. The image analysis described above, only when you ask for it.
• Cookiebot. Records your cookie choices and holds the other tags back until you make them.
• Google Analytics, Google Tag Manager and Microsoft Clarity. Statistics, loaded only if you accept statistics cookies.
• Meta and TikTok. Advertising measurement, loaded only if you accept marketing cookies.

Several of these are based in the United States, so some data is transferred outside the EU and the EEA. Those transfers rest on the European Commission's standard contractual clauses, and on the EU-US Data Privacy Framework where the company is certified under it. Ask us for the paperwork and you will get it. An institution that needs a data processing agreement with us should write to hi@samlio.com.

Cookies.

Only what is needed to sign you in and keep the session safe is set without asking. Statistics and marketing cookies wait for your consent, and nothing loads before you give it. You can change or withdraw that choice at any time through the cookie banner.

The cookie policy lists each one and what it does.

Collected, and how to leave it.

You are added to the letter only after you click a link in an email we send you, which is why an address typed by mistake never receives anything. We keep the date of that click, the wording you agreed to and where you subscribed, so we can show why you are on the list.

Every issue carries an unsubscribe link, and one click removes you everywhere at once. We do not use tracking pixels to see whether you opened an email.

How long we keep things.

• Your archive and account: until you delete them. Closing an account starts a 30-day window, so a change of mind costs nothing, and after it the records and files are removed.
• Backups: overwritten on a rolling basis, so deleted material disappears from them within a few weeks.
• The letter: your consent record is kept while you are subscribed, and for a period afterwards so we can show you were not written to without permission.
• Invoices and payment records: kept as long as Swedish accounting law requires, currently seven years.
• Usage and security logs: kept in a form that cannot identify you.

What you can ask of us.

The GDPR gives you the following, and none of it costs anything.

• A copy of what we hold about you, and an export of your archive, which you can also take yourself at any time from your account.
• Correction of anything wrong.
• Deletion of your account and its contents.
• Your data in a portable form, to take elsewhere.
• Restriction of, or objection to, a particular use.
• Withdrawal of any consent you have given, without affecting what was done before you withdrew it.

Write to hi@samlio.com and we will do it. If you think we have handled your data badly, you are entitled to complain to the Swedish Authority for Privacy Protection, IMY, and we would rather you told us first so we can put it right.

How it is kept.

Connections are encrypted, access is tied to your account, and what a collaborator can see is set per collection rather than all or nothing. Two-factor authentication is available in your account settings and worth turning on.

We claim no certifications, because we hold none. If a breach ever affects you, we will tell you and the authority within the time the law allows, and we will tell you what happened rather than what sounds best.

Age.

Samlio is made for professional and personal archives and is not intended for children under 16. We do not knowingly hold data about them.

Changes to this policy.

If we change how we handle your data we will update this page and, where the change matters to you, write to you about it. The date below is always the date of the current version.