Legal
Privacy Policy
Last updated: July 25, 2026
Stoff, LLC ("Stoff," "we," "us," or "our") operates the Stoff platform (the "Service"), a marketplace and portfolio platform for visual artists, galleries, and collectors. This Privacy Policy explains what information we collect, how we use it, and the choices you have. This policy applies to users located in the United States.
By using Stoff, you agree to the collection and use of information as described in this policy.
1. Information We Collect
1.1 Information You Provide
- Account information: name, email address, username, password, date of birth, profile details (bio, links, profile type — Creator, Gallery, or Viewer).
- Content you post: artwork images, descriptions, titles, pricing, collections, and other listing content.
- Messages and communications: any messages, chats, or comments you send through the Service.
- Transaction information: shipping address, order details, and purchase history. Payment card details are not collected or stored by Stoff — all payment processing is handled by Stripe, and Stoff never receives or stores your raw card number. (See Section 4.)
1.2 Information Collected Automatically
- Device and usage data: IP address, browser type, device identifiers, pages viewed, and general usage patterns, collected via our hosting and logging infrastructure (AWS).
- Error and diagnostic data: technical error reports collected through Sentry to help us identify and fix bugs. This may incidentally include fragments of app state at the time of an error.
1.3 Information from Sellers' Activity on Stoff
If you sell on Stoff, we have visibility into your sales activity, transaction history, and account performance on the platform, which we use to operate the marketplace, calculate fees, generate tax forms, and provide seller-facing analytics.
2. How We Use Chats, Messages, and Images
We want to be direct about this, since it differs from some other platforms:
- Messages and chats are stored on our servers and are not end-to-end encrypted. Stoff administrators can access message content, primarily for trust & safety purposes — for example, investigating reports of abuse, harassment, fraud, or policy violations.
- Images you upload are automatically scanned using an automated content-moderation tool (Amazon Rekognition) to detect potentially inappropriate content (such as nudity). Content flagged by this automated scan is placed in a private review queue and evaluated by human moderators before being approved for public display.
- Suspected child sexual abuse material (CSAM): Stoff is registered with the National Center for Missing & Exploited Children (NCMEC) and, after internal manual review confirming a violation, we are legally required to and will report suspected CSAM to NCMEC's CyberTipline. Any such content and related account information may be preserved and shared with NCMEC and law enforcement as required by law.
We do not use message or chat content to train AI models, and we do not sell message content to third parties.
3. Legal Basis / Purpose for Processing
We use the information above to:
- Operate, maintain, and improve the Service
- Process transactions and payouts
- Facilitate communication between buyers, sellers, and galleries
- Detect and prevent fraud, abuse, and policy violations
- Comply with legal obligations, including tax reporting (see Section 5)
- Provide customer support
- Communicate with you about your account or transactions
4. Third-Party Service Providers
We share information with the following service providers, each of whom processes data only to provide their service to us:
| Provider | Purpose | Data Shared |
|---|---|---|
| Stripe | Payment processing, seller payouts | Transaction amounts, buyer/seller identity info, bank account info for payouts. Stripe collects and stores payment card data directly — Stoff never receives raw card numbers. |
| Amazon Web Services (AWS) | Hosting, file storage, server logs, automated image moderation (Rekognition) | Uploaded images, application data, server/usage logs |
| Resend | Transactional and account emails | Email address, name, relevant email content |
| Sentry | Error monitoring and debugging | Technical error data, which may include limited app-state context |
We do not sell your personal information to third parties, and we do not share message content or images with advertisers.
5. Tax Reporting (Form 1099-K)
As a marketplace facilitator, Stoff is required by the IRS to report seller earnings on Form 1099-K once applicable federal or state reporting thresholds are met. If you sell on Stoff, we collect the tax information necessary to prepare this form (such as your legal name, address, and Taxpayer Identification Number) and will issue 1099-K forms to qualifying sellers and file corresponding reports with the IRS and, where required, state tax authorities.
6. Data Retention
We retain account information, transaction records, and messages for as long as your account is active and as needed to comply with legal, tax, and accounting obligations (generally at least 7 years for transaction and tax records). You may request deletion of your account as described in Section 8, subject to information we're required to retain by law.
7. Data Security
We use industry-standard measures to protect your information, including encryption in transit, access controls limiting internal access to user data, and secure infrastructure through AWS. No system is completely secure, and we cannot guarantee absolute security.
8. Your Rights and Choices
- Access/Update: You can access and update most account information directly in your account settings.
- Deletion: You may request deletion of your account by contacting support@stoff.app. We will delete or anonymize your information except where retention is required by law (e.g., tax records).
- California residents: If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. Stoff does not sell personal information. To exercise these rights, contact support@stoff.app.
- Marketing communications: You may opt out of non-essential emails via the unsubscribe link in any marketing email. You cannot opt out of essential transactional or legal notices.
9. Children's Privacy
Stoff is intended for users 18 years of age and older. At registration, users must confirm they are 18 or older and provide a date of birth; accounts entering a birthdate indicating an age under 18 are blocked from registering. Sellers are additionally subject to Stripe's own identity and age verification requirements before they can receive payouts.
These measures are self-reported and are not a substitute for independent age verification. We do not knowingly collect information from anyone under 18. If we learn that a user has misrepresented their age and is in fact under 18, we will terminate the account and delete the associated information.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or a notice on the Service before the changes take effect.
11. Contact Us
Questions about this policy or your data:
- Support: support@stoff.app
- General inquiries: contact@stoff.app
- Mailing address: [Stoff, LLC registered address — TBD once registered]
This document is a draft prepared with AI assistance based on Stoff's actual data practices as described by its founder. It has not been reviewed by an attorney and should be reviewed by one — particularly Sections 4, 5, and 9 — before publication, especially once the LLC is formally registered and a governing state is confirmed.