Privacy Policy

This summary highlights the main points of this Privacy Policy. Please read the full Policy for details.

• What we collect: information you give us when you sign up, build a profile, list, buy, send messages, or contact us; limited technical information recorded automatically; and information from Stripe, Google, and our email provider (Section 3).
• What is public: Creative profiles, listings, reviews, follows, and uploaded media can be seen by anyone. A Buyer’s first name and last initial appear next to reviews the Buyer writes (Section 4).
• No ads, no sale, no AI training: we do not show ads, sell or rent personal information, or build advertising profiles. We do not use your content to train AI models and do not currently use AI to analyze your content (Section 5).
• Payments: Stripe handles card details and Creatives’ identity verification. Koave does not receive full card numbers or identity documents (Section 7).
• Messages: private messages can be read only by you and the other participant through the Site (Section 8).
• Your account: you can deactivate or delete your account at any time (Section 13).
• Contact us: email privacy@koave.art or choose the “Privacy” topic on our contact form (Section 19).

This Privacy Policy (this “Policy”) explains how Koave, LLC, a California limited liability company (“Koave,” “we,” “us,” or “our”), collects, uses, shares, keeps, and protects personal information when you visit koave.art (the “Site”), create an account, or use our marketplace. Koave is an online marketplace for independent creatives that combines portfolios, a shop for digital products, bookable services with staged payments, private messaging, and checkout. “Personal information” means information that identifies you or is reasonably linked to you. “You” means any person who uses the Site.

• Who uses Koave: this Policy applies to people who browse our public pages without an account (“Visitors”); account holders who browse, follow Creatives, send inquiries and messages, buy, leave reviews, and report content (“Members,” or “Buyers” when they buy); Members who also build a public profile to sell digital products and services (“Creatives”); and Koave staff, who use a separate admin dashboard to handle reports, disputes, removal requests, and contact messages.
• What this Policy does not cover: this Policy does not cover services that Stripe or Google provide under their own terms, such as Stripe Link, Stripe’s identity verification of Creatives, or your Google account. Those services are governed by the Stripe Privacy Policy (stripe.com/privacy) and Google’s privacy policy (policies.google.com/privacy). This Policy works together with our Terms of Service.
• United States only: Koave is intended for users in the United States (Section 17). Koave is in open beta, and we will update this Policy as our services change (Section 18).

We collect personal information from three sources: information you give us, information collected automatically when you use the Site, and information we receive from other companies.

(a) Information you give us

• Account login: your email address and password. Passwords are stored only in hashed (scrambled) form by our sign-in service, and our staff cannot see them.
• Identity and age: your first name, last name, and date of birth. Each Member must provide these before using the Site, and we use your date of birth to confirm that you are 18 or older.
• Terms acceptance: whether, when, and which version of our Terms of Service you accepted. We ask you to accept again when the Terms change.
• Creative profile information: handle, display name, professional title, bio, U.S. city or town, disciplines, skills, availability for work, seller type, and website and social media links (for example, Instagram, TikTok, LinkedIn, X, and YouTube). A creative profile is optional for Buyers and required to sell.
• Images and audio: profile photos and banners (we keep the uncropped originals alongside the cropped versions), portfolio images, short audio clips, and listing photos. When you upload a photo, we remove hidden file details, such as the camera model and the GPS location where the photo was taken.
• Listings: titles, descriptions, prices, payment terms, and files for sale. Digital files for sale are stored privately and released only to Buyers.
• Inquiries and messages: the service wanted, creative direction, timeline, budget range, message text, and any note a Creative adds when declining an inquiry.
• Invoices and project work: invoice titles, line items, amounts, due dates, and milestone deliverable notes and links, which are shared between the Buyer and the Creative.
• Reviews: star ratings, written reviews, and Creatives’ replies.
• Reports: the category of a report (spam or scam, impersonation, stolen work, inappropriate content, harassment, or other), the details you provide, and your identity as the reporter.
• Disputes: the reason for a dispute, written statements, and uploaded evidence such as images and PDFs.
• Contact form: your name, email address, topic (general, order, privacy, or other), and message. You do not need an account to contact us.
• Content removal requests: your name, email address, the location of the content, a description, and your sworn statement. You do not need an account to submit a request.
• Preferences and activity: email notification settings, your light or dark theme choice, the Creatives you follow, “notify me when available” requests, and seller discount codes.

(b) Information collected automatically

• IP address: used only to limit abuse of our contact form and content removal request form. We delete these entries after about one hour.
• Sign-in session: a sign-in token stored in your browser.
• Account timestamps: when your account was created, last updated, and last signed in, and a count of sign-ins that we use to time an invitation to become a Creative.
• Read receipts: the time a message was read.
• Device type: the Site checks whether it is running on a phone to choose a layout. We do not store this information.
• Email delivery events: whether each email we send was delivered, bounced, or marked as spam. Open and click tracking are turned off.
• Server and backend logs: our hosting providers keep standard server logs, and our backend logs record some email addresses and account IDs.
• Site analytics: our hosting platform, Lovable, runs built-in analytics that collect visitor statistics.

(c) Information from other companies

• Stripe, about Buyers: the email used at checkout, payment and refund status, and Stripe’s reference numbers for the customer, payment, and saved card. We do not receive your full card number.
• Stripe, about Creatives: whether identity and bank verification is complete, and Stripe’s account reference. The verification details themselves (legal name, date of birth, tax ID, address, and bank account) stay with Stripe.
• Google: if you choose to sign in with Google, Google shares your name and email address with our sign-in service.
• Our email provider: notices that an email bounced or was reported as spam, which we use to stop emailing those addresses.

Some information on Koave is public by design, and Members do not currently have a setting to make a profile private. The following information can be seen by anyone, including people without an account:

• Creative profiles: display name, handle, professional title, bio, city or town, disciplines, skills, social links, ratings, and join date.
• Listings: titles, descriptions, prices, photos, and availability, unless our staff have taken a listing down.
• Reviews and ratings: star ratings, written reviews, and Creatives’ replies, while the reviewed account is active. Reviews removed by our staff are hidden.
• Follows: who follows whom, while the followed account is active.
• Uploaded media: profile photos, banners, portfolio images and audio, and listing photos can be viewed by anyone who has the link.
• Buyer names on reviews: a Buyer’s first name and last initial appear next to each review the Buyer writes.
• Buyer profiles: profiles of Members who have not created a creative profile are hidden from other people. People a Buyer messages, buys from, or invoices with can see the Buyer’s full name and photo.
• Deactivated accounts: deactivating your account hides your profile and listings until you sign back in and reactivate.
• Public content can spread: public content may be cached, indexed by search engines, or copied by others, and it may remain available elsewhere even after you change or remove it on Koave.

We use personal information to:

• Run accounts and the marketplace, including sign-in, profiles, search (profile and listing text is indexed so others can find it), listings, follows, inquiries, messages, invoices, and reviews.
• Confirm that each Member is 18 or older by checking the date of birth once against our age requirement.
• Process payments, including checkout, deposits and installments, staged (milestone) payments, Creative payouts, refunds, and discount codes. If a Buyer does not respond within 14 days, a milestone payment is released to the Creative automatically (Section 7).
• Send service emails about your account, password resets, orders, messages, inquiries, invoices, milestones, disputes, reviews, removal requests, and account suspensions.
• Send platform announcements from Koave staff, which you can turn off (Section 8).
• Email you when a service you asked about becomes available again.
• Email you a daily digest of new work from Creatives you follow.
• Keep the Site safe, including through an automatic word filter on public text, Member reports, review removal, listing deactivation, and account suspension.
• Prevent fraud and abuse, including through Stripe’s fraud screening (Radar) on payments and short-lived IP address limits on our public forms.
• Meet legal duties, including acting on content removal requests within 48 hours under the federal TAKE IT DOWN Act, responding to card disputes (chargebacks) with order records, and keeping financial records.
• Enforce our Terms of Service, respond to lawful requests, and protect the rights, safety, and property of Koave, our Members, and others.
• Improve the Site using our hosting platform’s built-in visitor analytics.

What we do not do: Koave does not show advertising, sell or rent personal information, or build advertising profiles. We do not send your content or personal information to AI services, do not use your content to train AI models, and do not currently use AI to analyze your content. If we add features that use personal information in new ways, we will update this Policy first.

Koave does not sell personal information or share it for cross-context behavioral advertising. We do not disclose personal information to third parties for their own direct marketing purposes. We share personal information only as described below.

Service providers: the six companies below handle personal information to provide services to Koave. None of them is an advertiser or a data broker.

• Supabase: database, file storage, sign-in, backend processing, and scheduled jobs. Supabase handles the information described in Section 3 and stores it in the United States (East US region, in Ohio).
• Stripe: payments, Creative payouts, and fraud screening (Radar). Stripe handles Buyers’ names, email addresses, card and billing details, any shipping address, order details, Koave’s Buyer and Creative references, and dispute evidence we submit. Stripe acts under its own privacy policy when it verifies Creatives’ identities through Stripe Express and when Buyers choose to use Stripe Link (Section 7).
• Lovable: builds and hosts the Site and runs its visitor analytics. Lovable handles visitor traffic and analytics data and has technical development access to the systems that hold user data.
• Resend: sends Koave’s emails. Resend handles each recipient’s name and email address and the email contents, including message previews, inquiry details, and order details.
• Zoho Mail: hosts our email inboxes, including contact@koave.art and removals@koave.art. Zoho handles copies of contact messages and removal requests, including the sender’s name, email address, and message.
• Google: provides the Site’s fonts and Google sign-in. Google receives your IP address and browser details when fonts load. If you sign in with Google, Google shares your name and email address with us, and we use them to create and run your Koave account, consistent with the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy). Your Google account itself is governed by Google’s own privacy policy.

• Other Members: we share information between Buyers and Creatives as needed to complete inquiries, orders, and projects. Creatives see the name and photo of Buyers they work with, but not a Buyer’s email address. Creatives may use a Buyer’s information only to fulfill the order, must keep it confidential, and may not use it for marketing, as set out in our Terms of Service.
• Card disputes: when a Buyer disputes a staged-payment charge with their bank, we automatically send Stripe the project’s payment timeline and service details as evidence on the Creative’s behalf.
• Legal and safety: to comply with law, legal process, or lawful government requests; to handle content removal requests, including telling the owner of removed content; and to protect the rights, safety, and security of Koave, our Members, and others, such as when investigating fraud or abuse.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets, subject to appropriate confidentiality protections.
• With your consent: when you ask us to share information or agree that we may.
• De-identified or aggregated information: information that has been de-identified or combined so that it no longer reasonably identifies you.

Links to Members’ social media profiles are plain links; we do not embed social media widgets or tracking pixels. The list of U.S. cities on the Site comes from public U.S. Census Bureau data, and no user data is sent to the Census Bureau.

Stripe handles payments and sensitive payment and identity data. Buyers pay on Stripe’s own checkout pages, so card details do not pass through Koave.

• Order records: for each order, we keep what was bought, the amount, Koave’s fee, the Creative’s share, payment and refund status, dates, the Buyer’s email address, and Stripe’s reference numbers.
• Saved cards for staged payments: when you book a service with staged payments, your card is saved with Stripe so that we can charge later milestone payments automatically, without you being present. At checkout we ask for your authorization: “By booking, you authorize Koave, through Stripe, to save your card and charge the remaining milestone payments on the schedule shown.”
• Deposits and installments: for deposit and installment plans, Stripe emails invoices directly to the Buyer.
• Stripe Link: Buyers may choose to save their payment details with Stripe Link for faster checkout on other sites. That relationship is between the Buyer and Stripe, under the Stripe Privacy Policy (stripe.com/privacy).
• Refunds: a refunded Buyer loses download access to the purchased file.
• Creative payouts and verification: Creatives open a Stripe Express account, and Stripe collects and verifies their legal name, date of birth, tax ID, address, and bank account under its own privacy policy. Koave keeps only Stripe’s account reference and whether verification is complete. When a Creative deletes their Koave account, their Stripe account is queued for closure, and Stripe keeps verification records under its own legal obligations.
• Fraud screening: Stripe screens payments for fraud using its Radar service.
• Koave disputes: either party can open a dispute and upload written statements and evidence. Our staff review the dispute and decide it.

• Messages and inquiries: a conversation starts with an inquiry, which the Creative accepts or declines with an optional note. Only the two participants can read a conversation through the Site. Our automatic word filter does not scan private messages, and our staff dashboard cannot open them. People with direct administrator access to our database, and Lovable through its development access, could technically read them. We record when each message is read.
• Notification emails include content: a new-message email includes a preview of the message, and a new-inquiry email includes the inquiry details. That text passes through our email provider, Resend, and ends up in the recipient’s inbox.
• Account emails: signup confirmation, password reset, sign-in link, email change, and identity re-check emails, and a welcome email when you join Koave or become a Creative, are always sent.
• Notification emails: emails about new messages, new orders, order updates, new reviews, new inquiries, service availability, and new activity from Creatives you follow are on by default. You can turn off each type in your account settings, and you can turn off the follow digest for a single Creative.
• Announcements: platform-wide announcements from Koave staff are on by default. Announcements identify Koave as the sender, include our postal address, and include a way to opt out. You can turn them off in your account settings or through the unsubscribe link.
• Unsubscribing and delivery: each notification email includes an unsubscribe link that works without signing in and turns off that type of email. Addresses that unsubscribe from announcements, bounce, or report spam go on a do-not-send list. Open and click tracking are turned off. We keep a log of the emails we send and delete the recipient’s address from that log after one year.

Koave does not set advertising or tracking cookies. The Site uses the following items in your browser:

• Sign-in session (set by Koave): keeps you signed in until you sign out.
• Theme choice (set by Koave): remembers light or dark mode until you clear it.
• Return page (set by Koave): remembers the page you were trying to reach for up to one hour, so we can take you back to it after you sign in.
• Sign-out marker (set by Koave): notes the moment you sign out, so that pages open in your other tabs don’t save themselves as the page to return to next time.
• Site analytics (set by Lovable, our hosting platform): collects visitor statistics using its own technology.
• Fonts (set by Google): loads the Site’s typeface. Google receives your IP address and browser details.
• Checkout pages (set by Stripe): used for payment processing, fraud screening, and Stripe Link.
• Google sign-in (set by Google): used only when you choose to sign in with Google.

• Your browser choices: you can block or delete cookies and browser storage through your browser settings. If you block Koave’s sign-in storage, you will not be able to stay signed in.
• Do Not Track and Global Privacy Control: Koave does not currently respond to Do Not Track or Global Privacy Control signals. Because we do not sell personal information or share it for cross-context behavioral advertising, there is no sale or sharing for those signals to stop.
• Tracking by other companies: Google (through fonts and sign-in), Stripe (on its checkout pages), and Lovable (through site analytics) may collect information about your activity over time and across different websites under their own policies.

• Automatic word filter: we block a short list of words in public text, such as names, handles, titles, bios, disciplines, skills, portfolio entries, listings, reviews, and review replies. The filter is deliberately narrow so that legitimate art terms are allowed. It does not scan private messages.
• Member reports: Members can report profiles and reviews. We record who filed each report.
• Staff actions: our staff may remove reviews, deactivate listings, and suspend or reinstate accounts. We record the reason for each suspension and email the Member about it.
• Content removal requests: anyone may ask us to remove intimate imagery under the federal TAKE IT DOWN Act, without an account, including requests about images of minors. Our staff act on requests within 48 hours, with automatic reminders as the deadline nears. The requester receives a reference code. Removed files are moved to private storage, the owner is told, and the files are permanently deleted after 90 days unless a legal hold applies.
• File clean-up: a daily check finds uploaded files that no longer belong to anything so that they can be removed.
• Handles: some handles are reserved. A deleted Member’s handle becomes available again after 30 days.

• Staff access: Koave staff sign in to a separate admin dashboard with their own accounts and an admin role.
• What staff can see: profiles, including hidden ones; listings; orders, invoices, and payment stages; disputes and their evidence; reviews and reports, including who filed each report; suspensions; contact messages; and removal requests.
• What staff tools cannot show: private messages and inquiries, dates of birth, passwords, card numbers, and Creatives’ identity documents (which Stripe holds).
• Technical access: whoever holds owner-level access to our database has full technical access to the information stored there, as does Lovable through its development access.

We keep personal information for as long as we need it to run the Site, complete transactions, resolve disputes, prevent fraud, enforce our agreements, and meet legal, tax, and accounting duties. Specific periods are:

• Account and profile information: while your account exists, plus 30 days after you delete it (Section 13).
• IP addresses used for form rate limits: about one hour.
• Recipient address in our email log: one year, then deleted. The rest of the log entry is kept.
• Orders, invoices, payment stages, disputes, and dispute evidence: seven years after the transaction or dispute closes.
• Messages: if you delete your account, your messages stay visible to the other participant, with you shown as “Deleted user.” Messages tied to an order are kept for the period that applies to orders.
• Contact messages and content removal requests: three years.
• Files removed after a content removal request: 90 days in private storage, then permanently deleted, unless a legal hold applies.
• A deleted Member’s handle: reserved for 30 days.
• Do-not-email list: for as long as needed to honor your choice, with no fixed end date.
• Information held by other companies: Stripe, Resend, Lovable, Google, and Zoho keep information under their own policies.

• Deactivation: deactivating your account hides your profile and listings. You can reverse it by signing back in and choosing to reactivate.
• Deletion: deleting your account requires your password or a one-time code we email to you. On the same day, sign-in is blocked, your profile and listings are hidden, and you appear as “Deleted user” across the Site. We cannot delete your account while you are holding a Buyer’s money for unfinished work.
• After 30 days: we permanently delete your profile, listings, uploaded photos and files, date of birth, notification settings, follows, “notify me” requests, discount codes, reports you filed, reviews written about you, replies you wrote, and records tied to your email address (such as the waitlist). We also remove the link to your Stripe account and queue that account for closure.
• What we keep: conversations and messages (still visible to the other participant), orders, invoices, payment stages, disputes and dispute evidence, and reviews you wrote (shown as “Anonymous”) are kept for the periods in Section 12. We also keep a minimal record of your deleted account ID and the deletion dates.

• Self-service controls: you can edit or remove profile information; correct your date of birth (it cannot be removed while your account exists); change your email notification settings or unsubscribe from any notification email; and deactivate or delete your account (Section 13).
• Requests available to U.S. users: we offer the following to users in the United States, whether or not a law requires it. You may ask us to (a) tell you what personal information we hold about you and give you a copy; (b) correct inaccurate information; and (c) delete your information, subject to the exceptions in Sections 12 and 13. We do not have a self-service download tool, so we prepare copies manually and provide them in a machine-readable format.
• How we handle requests: we verify requests through your signed-in account or a matching email address. You may use an authorized agent, who must provide proof of authorization, and we may ask you to confirm your identity directly. We respond within 45 days and may extend that period once by another 45 days if we tell you.
• Appeals: if we deny your request, you may appeal by replying to our decision email.
• No discrimination: we will not treat you differently for making a request.
• No sale opt-out needed: because Koave does not sell personal information or share it for cross-context behavioral advertising, there is nothing to opt out of. If that changes, we will update this Policy first. To make a request, contact us as described in Section 19.

We use safeguards designed to protect personal information. Traffic to the Site is encrypted using HTTPS. Our database provider, Supabase, states that customer data is encrypted at rest with AES-256 and in transit using TLS. Passwords are stored only in hashed form.

Our database enforces rules about who may see each record, so those protections apply even if someone bypasses the website. Purchased files, dispute evidence, and removed content are kept in private storage that can be reached only through links that expire. Card numbers and Creatives’ identity documents are held by Stripe rather than Koave. Our age check is enforced by our servers, our public forms are rate limited to block automated abuse, and staff access depends on an admin role tied to each staff member’s own account.

No method of transmission or storage is completely secure. Please keep your password confidential. If a security incident affects your personal information, we will notify affected users and authorities as required by law. To report a security concern, email privacy@koave.art.

Koave is for adults only. You must be 18 or older to use the Site, and the Site is not directed to children. We do not knowingly collect personal information from children under 13 or allow anyone under 18 to use the Site.

After creating a login, each Member must enter a date of birth before using the Site, and our servers reject any date of birth less than 18 years ago. Your date of birth is kept private and is not shown on your profile. You can correct it, but you cannot remove it while your account exists. It is permanently deleted with your account.

If someone under 18 tries to sign up, their email address (and any name they entered) may be recorded before the age check. We automatically delete these partial accounts within 30 days. If you believe a person under 18 has given us personal information, contact us as described in Section 19, and we will delete it.

We store our database and files in the United States, with Supabase in its East US region in Ohio. Our service providers may process information in other locations. The Site is intended for users in the United States. If you use it from outside the United States, your information will be processed in the United States.

We may update this Policy to reflect changes in our practices, services, or the law. When we do, we will update the Effective Date at the top of this Policy. If we make material changes, we will notify Members by email or by a notice on the Site at least 14 days before the changes take effect, where practicable. If we add features that use personal information in new ways, we will update this Policy first.

• Privacy questions and requests: email privacy@koave.art or use the contact form on the Site and choose the “Privacy” topic.
• Content removal requests: use the content removal request form on the Site or email removals@koave.art.
• Security reports: email privacy@koave.art.
• Mailing address: Koave, LLC, 2650 W Temple St Ste 104 PMB 1005, Los Angeles, CA 90026, United States.