How Vasari Social Ltd uses your personal data

Last updated: 28 April 2026

1. Who we are

We are Vasari Social Ltd, a company registered in England and Wales (company number 17125401) with our registered office at 104 Stapleton Hall Road, London, England, N4 4QA. We run an AI-powered Instagram management platform for galleries and the artists they represent.

In this policy, “we”, “us” and “our” mean Vasari Social Ltd. If you have any questions about how we use your data, contact us at lou@vasari.social.

We are the controller of your personal data for the purposes set out in this policy.

2. Who this policy applies to

This policy explains how we handle personal data of the following people:

Visitors to our website at vasari.social.
Galleries and gallery staff who use our services.
Artists whose social media we manage.
Followers, collectors, curators, press contacts and other people who interact with the social media accounts we manage on behalf of artists and galleries.
People who contact us about our services or apply for jobs.

3. The data we collect, why we collect it, and our lawful basis

We only collect personal data where we have a clear reason to and a lawful basis under UK data protection law.

Website visitors

If you visit our website we may collect: your IP address, the device and browser you use, the pages you visit and the time you spend, and any information you submit through forms.

Why: To run and improve the website and to respond to enquiries.

Lawful basis: Our legitimate interests in operating our business; consent for non-essential cookies; and where you contact us, the steps necessary to take action at your request.

Galleries and gallery staff

If you are a gallery or gallery employee using our services, we collect: your name, role, business email and phone number, the gallery’s commercial information, your CRM contents (where you choose to share them), payment and invoicing details, and records of our communications with you.

Why: To provide our services, manage our contract with you, send you reports, take payment and run our business.

Lawful basis: Performance of our contract with you, our legitimate interests in running and improving our business, and compliance with our legal obligations (for example, tax and accounting).

Artists

If you are an artist whose accounts we manage, we collect: your name, contact details, biographical information, financial details (where relevant to our services), social media account credentials and access tokens, your archetype survey responses, brand and content plans, and information about your artworks, exhibitions and commercial activity.

Why: To deliver the services agreed with you and the gallery, including running your social media accounts, producing content, building your audience and reporting on performance.

Lawful basis: Performance of our contract with you (or the gallery, where you are a beneficiary), and our legitimate interests in providing our services and improving our platform.

Followers, collectors, curators and other end users

When we manage an artist or gallery account, we may process limited personal data of the people who interact with that account: their public profile information, the contents of direct messages they choose to send to the account, engagement data (likes, comments, saves, link-clicks) and any context we add to identify them as a possible collector, curator or press contact (a “Lead”).

Why: To manage interactions on behalf of the artist or gallery, identify and qualify Leads, and pass warm Leads to the gallery’s sales team.

Lawful basis: Our legitimate interests, and those of the artist or gallery, in growing the artist’s audience and managing commercial relationships, balanced against your interests and rights. You can object to this processing at any time using the contact details above.

Job applicants

If you apply to work with us, we collect the information you give us in your application and any information from your referees.

Why: To consider your application.

Lawful basis: Steps taken at your request before entering into a contract; legitimate interests in recruitment.

4. How we use AI

Our platform uses AI tools to help generate and adapt content for artist accounts. AI is always used under human review: a real person reviews and approves content before it is published. We do not use AI to make decisions about you that have a legal or similarly significant effect. We do not feed your personal data into third-party AI tools to train their public models.

5. Who we share your data with

We share personal data only with people who need it to help us run our service:

Service providers we rely on (for example, our hosting provider, AI provider, customer relationship management tools, email service, analytics and payment processor). They process data on our instructions under written contracts that meet UK data protection requirements.
Galleries and artists, where the data relates to their account or their leads. Galleries are the controllers of CRM data and Leads we deliver to them.
Meta (the operator of Instagram), where we publish content and read account data through their official APIs, in line with their terms.
Professional advisers (lawyers, accountants, auditors) where we need their advice.
Law enforcement, regulators, courts or others where we are legally required to share information, or where we need to do so to protect our or others’ rights.

6. International transfers

Some of our service providers are based outside the United Kingdom, including in the United States. Where we transfer personal data outside the UK or the European Economic Area, we make sure there are appropriate safeguards in place, usually the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or another mechanism approved under UK data protection law. You can contact us for details of the specific safeguards used for any transfer.

7. How long we keep your data

We keep your personal data only for as long as we need it. The headline rules:

Customer and contract records: for the duration of our relationship and up to 7 years afterwards (to meet tax and accounting rules).
Artist account access (credentials and tokens): until the end of the engagement, then deleted within 30 days.
CRM data and Leads: returned or deleted at the end of the engagement, in line with our services agreement.
Marketing contacts: until you ask us to stop or three years after our last meaningful interaction.
Job applicants: 12 months after the recruitment decision, unless you ask us to delete sooner.
Website analytics: as set out in our Cookie Notice.

Our full retention schedule is available on request.

8. Your rights

Under UK data protection law you have the right to:

Ask for a copy of the personal data we hold about you.
Ask us to correct data that is wrong or incomplete.
Ask us to delete your data, where we no longer have a good reason to keep it.
Ask us to restrict or stop our use of your data, in some cases.
Object to our use of your data where we rely on legitimate interests.
Ask us to transfer your data to another provider (where the data is something you gave us and we are processing it on the basis of consent or a contract).
Withdraw any consent you have given us.

To exercise any of these rights, email us at lou@vasari.social. We will respond within one month. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

9. Security

We use appropriate technical and organisational measures to protect your data, including access controls, encryption in transit, secure credential storage, regular review of our suppliers, and staff training on data protection. No system is perfectly secure, but we treat data security seriously and have a documented breach response plan.

10. Cookies

Our website uses cookies. See our separate Cookie Notice for what we use, why and how you can change your settings.

11. Changes to this policy

We may update this policy from time to time. The version on our website is always the current one, with the date at the top showing when it was last changed. If we make a material change we will tell you by email or a prominent notice on the site.

12. Contact us

Questions, requests or complaints: lou@vasari.social, or by post to Vasari Social Ltd, 104 Stapleton Hall Road, London, England, N4 4QA.