Version 2026-11-13. This policy explains how Fakewhale handles personal data on the Fakewhale LOG. It applies under the Swiss Federal Act on Data Protection (FADP) and, for people in the European Union and the United Kingdom, under the General Data Protection Regulation (GDPR).
1. Controller
Fakewhale Sagl, Via delle Scuole 3, 6900 Lugano Paradiso, Switzerland, is responsible for the processing described here. For anything about your data, write to info@fakewhale.xyz.
2. The data we process
- Reading the LOG. Technical data sent by your browser (IP address, device and browser type, pages requested), kept in server logs for security and maintenance.
- Newsletter. Your email address, the date and the place where you subscribed, and whether you agreed to receive offers.
- Account. Email address, name, and what you choose to add: your role in contemporary art, Instagram handle, links, photo, a short message. We also keep the choices you make about emails and notifications, the consents you gave with their version and date, the door you joined through, and the date of your last visit.
- Reading on your account. The last 30 pieces you opened, to show you where you stopped on your personal page.
- Membership and purchases. Your plan, its dates, and the record of each payment. Card details are entered on Stripe’s pages and never reach our servers.
- Fakewhale AI Curator. The questions you ask, the images you upload and the voice messages you record, as described in section 5.
- Submissions and Partner Program. What you send in a form: texts, images, titles, credits, links and contact details of the people named.
- Statistics. How the LOG is used, measured through cookies only according to the choice you make in the cookie banner.
3. Why we process it, and on what basis
| Purpose | Legal basis |
|---|---|
| Running your account, Membership, purchases and the AI Curator | Contract |
| Sending the newsletter and notifications you chose | Contract or consent; you can stop them at any time |
| Sending offers about Fakewhale (Membership, programmes) | Consent, given with its own box |
| Examining submissions and publishing selected work | Contract and the licence you accepted in the form |
| Proposals from Fakewhale’s Partner Program to Network profiles | Consent, given when entering the Network |
| Security, protection from bots and abuse, server logs | Legitimate interest |
| Statistics | Consent, through the cookie banner |
| Accounting and tax records | Legal obligation |
4. Who receives the data
We share data only with the providers that run parts of the LOG for us, and only what each one needs.
- Stripe: payments, invoices, the Membership portal.
- beehiiv: newsletter and automatic emails. It receives your email address and the account fields used to choose which emails you get (plan, role, Instagram handle, offers consent).
- Resend and our mail provider: emails sent by the site, such as sign-in codes and receipts.
- OpenRouter and the AI model providers it connects to: answers, image checks and transcriptions for the AI Curator.
- Google: Sign in with Google, if you use it; Google Analytics, if you accept statistics; Google Web Risk, which checks links the AI Curator opens on the web.
- Cloudflare: Turnstile, which protects sign-in and sign-up from bots.
- Complianz: records your cookie choice.
- Our hosting provider: stores the site and its database.
Several of these providers are based in the United States. Transfers take place under the safeguards the law requires, such as the EU Standard Contractual Clauses, the Swiss-US and EU-US Data Privacy Frameworks where the provider is certified, or the provider’s own data processing terms. We never sell personal data.
5. The Fakewhale AI Curator
- Questions. Each question, with the context the answer needs, is sent through OpenRouter to the AI model that writes the answer. Your conversations are kept in your own browser, on your device. On our servers we keep only the number of questions and their cost, to apply the monthly allowance.
- Images. Images uploaded by Members are checked automatically, then stored in a private archive linked to your account. They stay until you delete them from Settings or close your account.
- Voice messages. The audio is transcribed and immediately discarded. It is never stored and never logged.
- Web. When the AI Curator searches the web, only the search terms are sent, never your account details.
- Fakewhale does not use your questions, images or voice messages to train AI models.
6. How long we keep it
- Account data: as long as the account exists. When you delete it, your profile, drafts, images and email preferences are deleted, and the newsletter ends.
- Work already sent under a licence (an exhibition under examination, the material of a paid package) stays with Fakewhale under that licence.
- Sign-in codes: 10 minutes.
- Newsletter subscription without an account: until you unsubscribe.
- Payment and accounting records: 10 years, as Swiss law requires.
- Server logs and security records: for the shortest time needed to protect the site.
7. Your rights
You can ask to access your data and receive a copy, correct it, delete it, receive it in a portable format, restrict or object to its processing, and withdraw any consent at any time. Many of these are in your account: Settings, Privacy has your email choices, a copy of your data sent by email, and the deletion of your account. For the rest, write to info@fakewhale.xyz; we answer within 30 days.
You can also complain to a data protection authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the European Union the authority of the country where you live.
8. Cookies
The cookies and similar technologies used by the LOG, and how to change your choice, are described in the Cookie Policy. You can reopen your choice at any time from “Cookie preferences” at the bottom of every page.
9. Security
Sign-in works through one-time codes or Google, so readers never need to set a password. Connections are encrypted, private archives are separated from public files, and access to data inside Fakewhale is limited to the people who need it.
10. Children
Accounts are for people aged 16 and over. If we learn that an account belongs to someone younger, we close it and delete its data.
11. Changes
We publish every new version on this page with its date. For important changes we write to account holders before they apply.
12. Contact
Fakewhale Sagl, Via delle Scuole 3, 6900 Lugano Paradiso, Switzerland. info@fakewhale.xyz