Privacy Policy

Last updated: April 2026

This Privacy Policy explains how ARTIFACT collects, uses, and protects your personal data when you use our platform at artifact.io-research.org. We are committed to protecting your privacy and complying with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR 2016/679), and the Data Protection Act 2018.

1. Data Controller

The data controller for ARTIFACT is IO Research, operating as part of the CreativePEC Research Network project at Indiana University. For data protection enquiries, contact us at artifact@io-research.org.

2. What Personal Data We Collect

We collect personal data in the following circumstances:

• Account registration: If you create an account, we collect your name and email address.
• Content submission: If you submit records (people, publications, projects, datasets, events), any personal information included in those submissions is stored as part of the platform's research database.
• Server logs: Our hosting infrastructure automatically collects standard log data, including IP addresses, browser type, pages visited, and timestamps. This data is used solely for security and operational purposes.
• Cookies: We use session cookies to maintain your login state. See our for details.

3. How We Use Your Personal Data

We use your personal data for the following purposes:

• To provide the platform: Managing your account, authenticating your login, and enabling you to submit and edit content.
• To maintain platform security: Detecting and preventing abuse, unauthorised access, and technical issues.
• To communicate with you: Responding to enquiries sent to artifact@io-research.org.
• To fulfil our research mission: Researcher profiles and publication records submitted to the platform are published as open-access research infrastructure.

4. Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 UK/EU GDPR:

• Contract (Article 6(1)(b)): Processing necessary to provide your account and the services you have requested.
• Legitimate interests (Article 6(1)(f)): Maintaining platform security, preventing abuse, and operating server logs. We have balanced these interests against your rights and concluded they do not override them.
• Consent (Article 6(1)(a)): Where you have provided explicit consent, such as agreeing to these terms on registration. You may withdraw consent at any time.

5. Sharing of Personal Data

We do not sell your personal data. We may disclose data only if required to do so by law or in response to valid legal processes.

ARTIFACT is hosted on AWS Lightsail. As our infrastructure provider, AWS processes technical data (such as server logs and network traffic) as part of standard hosting operations. AWS is not granted access to personal data beyond what is incidental to providing hosting services, and operates under appropriate data processing terms.

Researcher names and institutional affiliations submitted to ARTIFACT are published openly as part of the platform's public research database. Do not submit personal information you do not wish to be publicly visible.

6. Data Retention

• Account data: Retained for as long as your account is active. Upon deletion, account credentials are removed within 30 days.
• Submitted research content: Retained indefinitely as part of the open research record unless you request removal.
• Server logs: Retained for up to 90 days for security purposes, then deleted.

7. Your Rights

Under UK/EU GDPR, you have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete data.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to legal obligations.
• Right to restriction: You may request that we restrict processing of your data in certain circumstances.
• Right to data portability: Where processing is based on consent or contract, you may request your data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at artifact@io-research.org. We will respond within 30 days.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted connections (HTTPS), access controls, and regular security reviews. However, no internet transmission is completely secure, and we cannot guarantee absolute security.

9. Supervisory Authority

If you are located in the UK or EU and have concerns about how we handle your personal data, you have the right to lodge a complaint with a supervisory authority:

• UK: Information Commissioner's Office (ICO) — ico.org.uk
• EU: Your local data protection authority — edpb.europa.eu

We encourage you to contact us first at artifact@io-research.org and we will do our best to resolve your concern.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

11. Contact Us

For any questions or requests relating to this Privacy Policy or your personal data, please contact: artifact@io-research.org