How Debuted collects, uses, discloses, and retains personal information.
Last updated
This policy covers Debuted’s marketplace, websites, and related services. Depending on how you use Debuted, we collect identifiers and contact details; account and profile data; seller application and verification status; artwork and listing content; orders, shipping addresses, transaction and tax records; communications and support requests; device, log, approximate location, and usage data; and inferences used for security and product improvement.
Debuted does not store seller identity documents. Stripe collects identity and bank information for Stripe Connect verification and payouts. Payment card details are collected by Stripe rather than stored by Debuted.
We receive information from you, other marketplace users, service providers, and automatically from your device. We use it to provide accounts and marketplace transactions; verify sellers; process payments, tax, transfers, refunds, and disputes; deliver and improve the service; communicate about orders and support; prevent fraud and abuse; enforce policies; and comply with legal, tax, accounting, and recordkeeping duties.
When configured, Debuted uses PostHog in cookieless mode with in-memory persistence to understand product usage. This setup does not place a PostHog analytics cookie, but it still sends events and technical data such as page activity, device information, and IP-derived information to PostHog. We use Sentry for error monitoring; error reports may include device, request, diagnostic, and limited account context. We do not intentionally send artwork payment details, passwords, or message contents in analytics events.
We disclose information as needed between buyers and sellers to complete orders, and to vendors that process data for us: Stripe, Stripe Connect, and Stripe Tax for payments, seller verification, payouts, and tax; Google Cloud Platform, including Cloud Run, Cloud Storage, Cloud Tasks, and Cloud Vision SafeSearch, for hosting and media processing; Firebase Authentication by Google for sign-in and verification; Neon for database hosting; Resend for transactional email; PostHog for product analytics; and Sentry for error monitoring.
We may also disclose information to professional advisers, during a corporate transaction, to protect users and the service, or when required by law. We do not sell personal information for money. Debuted does not use cross-context behavioral advertising at launch. If those practices change, we will update this policy and provide required choices.
We retain information while an account is active and as reasonably necessary for the purposes above. Tax, payment, order, fraud, and dispute records may be kept for legally required periods. When an account is deleted, Debuted deletes or de-identifies profile information where practical and anonymizes completed order records rather than deleting financial records. Backups expire on their normal schedule.
We use administrative, technical, and physical safeguards designed to protect information, but no system is completely secure. The service is hosted in the United States, and users outside the United States direct their information to the United States.
California residents may request to know the categories and specific pieces of personal information collected, sources, purposes, and disclosures; request deletion; request correction; and receive a portable copy, subject to legal exceptions. Residents also have rights to opt out of sale or sharing and to limit use of sensitive personal information when those practices apply. Debuted does not sell or share personal information for cross-context behavioral advertising at launch.
We will not discriminate against you for exercising a privacy right. We will verify requests and may ask an authorized agent for proof of authority. Submit requests to privacy@debuted.com. California metrics and any legally required “Do Not Sell or Share” mechanism will be added if Debuted becomes subject to those requirements or its practices change.
Debuted is for people aged 18 or older and is not directed to children. If we learn that we collected personal information from a child, we will take appropriate steps to delete it. International users understand that U.S. privacy protections may differ from those in their country.
We may update this policy and will change the last-updated date. We will provide additional notice when required. Contact privacy@debuted.com with questions or requests. Debuted’s legal entity name and mailing address must be inserted before launch.