Privacy Policy

Atelier Corner is a platform for independent creative ateliers to manage their workshops, sessions, bookings and customers. It is still being built and is currently available only to a small number of invited ateliers.

Because the platform is in active development, features, internal processes and this notice may change. Where possible we ask beta testers to work with dummy or non-sensitive information, and to avoid entering personal details that are not needed for testing.

This notice describes how the platform is currently intended to handle personal information. It is not a final, legally reviewed document.

Responsibility depends on the purpose and circumstances of each activity, so the roles below are general descriptions rather than fixed rules.

• Atelier Corner as controller. For the information needed to create and run atelier owner and staff accounts, to provide support, to keep the service secure, to prevent misuse, to operate the platform and to communicate directly about it.
• The atelier as controller. For the information an atelier enters or manages about its participants, guardians, bookings, attendance, waitlists, reviews, loyalty and similar atelier activity.
• Atelier Corner as processor. When we handle that atelier-managed information on the atelier's instructions in order to provide the platform.

Atelier Corner is currently operated by its founder as an independent project in the Netherlands, prior to formal incorporation. Privacy questions can be sent to my.atelier.corner@gmail.com. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) is the competent supervisory authority for the operator.

Not every atelier uses every feature, so not all of the categories below apply to every person. Depending on how the platform is used, we may process:

• Account and profile information, such as name, email address and sign-in details.
• Atelier and staff membership details, including roles and permissions.
• Participant and guardian information entered by an atelier.
• Bookings, booking participants, attendance records and waitlist entries.
• Reviews, ratings, loyalty points, referrals and vouchers.
• Google integration authorisation tokens and related metadata, where an atelier connects Google.
• Email delivery and communication metadata, such as sending status and unsubscribe preferences.
• Demo requests and information from ateliers interested in joining.
• Security, audit and support-session logs.

The likely bases below reflect our current understanding and have not yet been confirmed by legal counsel. Consent is not used as a general basis for everything we do.

• Performing our agreement with an atelier — creating accounts, running bookings, schedules and the platform's core features.
• Legitimate interests — keeping the service secure, preventing misuse, maintaining service integrity and improving the product in a proportionate way.
• Legal obligations — where accounting, tax or similar duties apply.

Each atelier is responsible for identifying and communicating the lawful basis for its own handling of participant information, and for providing its own privacy notice where one is needed.

The following providers support the platform. Contractual arrangements, processing locations and international transfer mechanisms are still being confirmed and should not be treated as verified.

• Lovable Cloud and its underlying hosting and database infrastructure, which run the application and store its data.
• The managed transactional email service used to deliver messages such as booking confirmations and reminders. Messages are sent from the notify.ateliercorner.com sending domain, which is a sending domain rather than the provider itself.
• Google APIs, such as Calendar and Business Profile, only where an atelier chooses to connect them.
• The Lovable AI Gateway and the AI model it routes to, used only by the optional spreadsheet migration assistant.
• Google Fonts, which are currently loaded from Google's servers and may therefore expose visitor IP addresses to Google.

Google integrations are optional and are switched on by an atelier through Google's own authorisation screen. Where an atelier connects Google Calendar, the platform can create and update calendar entries for its sessions and read busy periods so the owner is warned about clashes. Access tokens are stored on the server side and are not made available to the browser. An atelier can disconnect Google at any time from its settings.

When an atelier imports an existing spreadsheet, the platform can optionally ask an AI service to help interpret column headings it does not recognise. Only the column headings and a structural description of each column — for example "looks like a date" or "looks like an email address" — are sent. The actual cell values from the spreadsheet are not sent to the AI service.

Workshop or class names may be sent when the assistant is asked whether two offer names refer to the same class. During the beta we still ask testers to avoid uploading sensitive or unnecessary personal information.

Information is kept only for as long as it is needed for the purpose it was collected for, subject to an atelier's instructions and any applicable legal duties.

We are being open about a current limitation: automated retention schedules, self-service data export, erasure and anonymisation tools are not yet fully built. Requests are handled manually during the beta. If the request concerns information an atelier manages, contact that atelier first; we will assist them where appropriate.

Depending on where you live, you may have the right to:

• Access the personal information held about you
• Have inaccurate information corrected
• Ask for information to be erased
• Ask for processing to be restricted
• Object to certain processing
• Receive your information in a portable form, where applicable
• Withdraw consent where processing relies on consent
• Complain to a competent supervisory authority — for the operator, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

Send requests to my.atelier.corner@gmail.com. Requests about participant information managed by an atelier may need to go to that atelier directly.

The measures described here are the ones actually built into the platform today. We make no claim that the service is fully secure, certified or independently audited.

• Accounts are protected by authentication, with roles controlling what each person can do.
• Every atelier's records are separated at the database level, so one atelier cannot read or change another's data.
• Integration credentials are held server-side and are never sent to the browser.
• Traffic to and from the platform is served over HTTPS.

This notice will be updated as the beta develops. For anything related to privacy, contact my.atelier.corner@gmail.com.

See also our Terms of Use and the draft Data Processing Agreement.