Version 2026-10 · effective 18 October 2026
Revart is a website (revart.art) and an iPhone/iPad augmented reality app. Artists upload an artwork and its animation. Visitors point their phone at the artwork and watch it come to life, without an account.
This page explains what data we keep, why, for how long, who we share it with, and how to use your rights. We have tried to keep it short and clear.
In short
- No advertising, no ad trackers, no analytics tool from another company, no data sales.
- The camera image is analysed on your phone. It is never sent, except a video you choose to post.
- Scanning an artwork needs no account. We count scans anonymously, and you can opt out.
- Revart's data (accounts, artworks, videos, statistics) is hosted in Europe (Germany and France). The only exception, a temporary one: emails you write to us go through the United States (§ 6).
- You can export your data and delete your account yourself, from "My account".
1. Who is responsible for your data
Gary Bouvet, sole trader (entrepreneur individuel, EI), publisher of Revart.
Address: Bordeaux Maritime, Bordeaux, France · SIREN number being assigned
Contact about your data: legal@revart.art (answers in French or English).
Revart has no data protection officer (DPO): the law does not require one for a service of this size. Gary Bouvet handles requests himself. He is also the person in charge of the protection of personal information under Quebec's Law 25.
2. What we keep, and why
If you only scan (no account)
| Data | Why | Legal basis |
|---|---|---|
| A random installation identifier on your device (renewed every 30 days in the app, at most every 13 months on the website). The server never stores it as is: it turns it into a hash that changes every day and is erased after 2 days. | Count how many different people scanned an artwork, without knowing who. The result is a plain total per artwork per day. | Legitimate interest: telling artists how often their works are viewed (Art. 6(1)(f) GDPR). You can object (§ 7). |
| A size measurement of the artwork made by your phone, with a hash of the device and of the network (never the IP address itself). | Display the animation at the right size for everyone. | Legitimate interest: display quality. |
| Your IP address, in memory only, never written to disk, forgotten within 24 hours. | Limit abuse (repeated password guesses, mass sending). | Legitimate interest: security. |
| If you report content: the reason, your free text, and a hash of your device (or of your IP address on the website), used only to avoid duplicates and erased as soon as the report is handled. | Handle the report, prevent abuse. | Legal obligation (EU Digital Services Act) and legitimate interest (security). |
If you create an account (15 or older)
| Data | Why | Legal basis |
|---|---|---|
| Email address, display name, password (never in clear: only an argon2id hash), date you accepted the terms. | Create and protect your account, send useful emails (address confirmation, forgotten password). | Performance of the contract (Art. 6(1)(b)). |
| Sessions: a hash of the sign-in token, the client type (website or app), dates. No IP address, no phone model. | Keep you signed in. | Contract. |
| Optional public profile: bio, website, social media handles, photo. | Show it on your public artist page. | Contract. |
| Your artworks: images, videos, sounds, 3D models, label texts, settings, shows, and any link, email or phone number you add to an animation. | Publish and animate them. | Contract. |
| Favourites, followed artists, blocked accounts, private folders. | Make these features work. | Contract. |
| Videos you film of an animated artwork and send (see § 4). | Show them to the artist, then to the public if approved. | Contract. |
| Quality score of an artwork photo (0 to 5), computed automatically. | Warn you if the artwork may be hard to recognise. A low score blocks publishing until you confirm the scan works; it says nothing about you and has no other effect. | Contract. |
| If you report content while signed in: the reason, your free text and your account identifier. | Handle the report, reply to you, spot repeated abusive reports. | Legal obligation (DSA) and legitimate interest (security). |
| Log of emails sent: recipient, subject, date, and whether it was delivered. Never the content or the link. | Know whether an email went out. | Legitimate interest. |
| Security archive (legal obligation): your email, and the date, time and IP address of each creation or change of content. Restricted access, opened only at the request of a judicial authority. | French law requires a host to be able to identify the author of content. | Legal obligation (French LCEN, decree no. 2021-1362; Art. 6(1)(c)). |
We do not ask for your date of birth, postal address, phone number or location. We do not use your device's advertising identifier. Uploaded photos and videos are re-encoded without their metadata (including GPS position).
Display name, email and password are needed to have an account. Everything else is optional.
If you write to us
| Data | Why | Legal basis |
|---|---|---|
| Emails sent to contact@, support@ or legal@revart.art: your address, your name if it appears, the content and attachments. | Reply to you, help you, handle a report or a request about your data. | Legitimate interest (replying to people who write to us); contract (help); legal obligation (reports, data requests). |
These emails go through Porkbun then Gmail, in the United States (§ 6). Please do not include unnecessary sensitive information.
Promoting artists and newsletters
| Data | Why | Legal basis |
|---|---|---|
| If you ticked the promotion box for an artwork: the artwork, its animation and your artist name. | Show your artwork on the website, on app store listings, on Revart's social media accounts and in its newsletters (terms, section 5.3). | Consent (Art. 6(1)(a)), which you can withdraw at any time, artwork by artwork. |
| If you sign up for newsletters (box unticked by default): your email address and sign-up date. | Send you Revart news. Every newsletter has an unsubscribe link. | Consent (Art. 6(1)(a)). |
A post on a social network (for example Instagram, TikTok or YouTube) is public and is also covered by that network's own policy; such networks are often based outside the European Union.
3. Camera and microphone
- Camera: the app (ARKit) and the website (MindAR) analyse the image on your device to recognise the artwork. No image is sent or kept, unless you film a video and choose to post it, or take a photo of an artwork to upload it.
- Microphone: the app does not use it. A filmed video only contains the animation's soundtrack, never the sound of the room.
- Photos: the app asks for access to Photos only to save a video you want to keep. To upload an image, you pick it yourself; the app does not read the rest of your library.
4. Visitor videos
When you film an animated artwork and send the video:
- It stays private until the artist approves it. If the artist rejects it, it is erased 30 days later.
- If approved, it is public on the artwork's page, with your display name.
- By sending it, you agree that it stays on Revart as long as the artwork is online, even if you delete your account. Your name is then removed and it is credited "Filmed by a visitor". This only applies to videos that show no face and no voice.
- The artist can remove it at any time.
Requesting removal. The author of a video can ask for its removal at any time with the "Request removal" form, giving the reason (or at legal@revart.art). The Revart team handles the request within 30 days, and within 24 hours if the video shows a face, a voice or a minor. The video is removed if it shows a face, a voice or another identifiable person (with the author's agreement, muting the sound or blurring the relevant part may be enough), or for any other legitimate reason. Otherwise, it may stay online for as long as the artwork is online, without the author's name, credited "Filmed by a visitor". We explain our decision, which can be challenged. Anyone who was filmed can ask for removal in the same way, with the "Report" link or at legal@revart.art, within the same timeframes; a video showing an identifiable minor is always removed.
Legal basis. For the video's author: performance of the contract (they post their video). For the artist and the public: our legitimate interest in keeping a record of animated artworks, which keeps the work alive. For someone filmed by chance: our legitimate interest, against which you have a right to object (Art. 21 GDPR) and a right to erasure (Art. 17). A video showing an identifiable minor is always removed, within 24 hours.
5. How long we keep your data
| Data | Period |
|---|---|
| Account, profile, artworks, favourites, folders | As long as the account exists. After a deletion request: 30 days (so you can change your mind), then permanent erasure. |
| Account never confirmed and never used | Deletion scheduled after 30 days without activity, with a warning email and 30 days to keep it. |
| Inactive account | After 3 years without signing in: a warning email, then, if you do not sign in within 30 days, the account is deleted. |
| Account suspended by moderation | 1 year after the suspension (evidence in case of dispute), then deleted. |
| Security archive (email, IP of content creation) | 1 year after the content was created or the account closed, then erased. |
| Sessions | 30 days after your last visit. |
| Confirmation and password reset links | 72 hours and 1 hour, erased the day after they expire. |
| Log of emails sent | 30 days. |
| Visitor videos | Rejected: 30 days. Approved: as long as the artwork is online (§ 4). |
| Files uploaded but never used | 7 days. |
| Reports | 12 months after they are handled, with the account identifier of the member who reported (this link disappears if their account is deleted). The device or IP hash is erased as soon as they are handled. |
| Emails you write to us | 12 months after the last exchange; longer only if they are part of a report or a data request (same periods as those) or of a dispute. |
| Newsletter sign-up | Until you unsubscribe. |
| Promotional permission | As long as the artwork is online or until you withdraw it; what is under our control is removed within 30 days. |
| Scan hashes | 2 days. |
| Scan totals per artwork per day | No limit: anonymous figures that say nothing about anyone. |
| Artwork size measurements | 90 days. |
| Technical server logs (date, page requested, status code, duration; no IP, no email) | 6 months at most. |
| Encrypted backups | They rotate: erased data disappears from backups at the latest 35 days later. |
| Fingerprint of an image removed by moderation | No limit, so that a removed artwork does not come back. It is linked to no account. |
6. Who we share your data with
We never sell or rent your data.
Revart's data (accounts, artworks, videos, statistics) is hosted in Europe. These providers have access on our behalf and under our instructions, with a contract under Article 28 GDPR:
| Provider | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Hosts the server, database and media | Germany |
| Scaleway SAS | Keeps an encrypted copy of the backups. It cannot read it: the key stays with us. | France (Paris) |
| Brevo SAS | Sends automatic emails (confirmation, forgotten password). It receives your address and the email text. | France |
The only exception, a temporary one: emails you write to us. Messages sent to contact@, support@ or legal@revart.art go through:
| Company | Role | Location | Transfer safeguard |
|---|---|---|---|
| Porkbun LLC | Our domain name registrar: it forwards these emails to our inbox. | United States | Porkbun is not certified under the Data Privacy Framework. The transfer is covered by the European Commission's standard contractual clauses (module 2) included in its data processing addendum. |
| Google (Gmail) | Hosts the inbox where these emails arrive. We use the consumer Gmail service: Google provides it under its own terms and privacy rules, not under a processing contract negotiated with us. | United States (and other countries where Google has servers) | Google LLC is certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023). |
We plan to move to a European email provider; this page will then be updated.
Apple only distributes the app on the App Store. What Apple knows about your download is covered by Apple's own privacy policy; Revart sends Apple no data from your account.
The public sees what you publish: display name, artist profile, artworks, approved videos.
Authorities may obtain data where the law requires it (court order, injunction). We only answer lawful requests.
Transfers outside the European Union: only the emails you write to us (see above) and, if you accepted promotion, posts on Revart's social media accounts (§ 2). The website loads nothing from third parties: fonts, scripts, 3D and AR engines are served by our own server, so your IP address is not sent to any other company when you visit revart.art.
7. Statistics: opting out of being counted
Artists see how many times their artworks are scanned, and by how many different devices. This count is made by Revart alone, with no tool from another company, and cannot identify anyone.
You can opt out at any time:
- in the app: Settings → "Don't count my scans";
- on the website: the "Don't count my scans" link at the bottom of every page.
Your choice is stored on your device. Scanning works exactly the same.
8. Cookies and other trackers
Revart only uses trackers that are strictly necessary for the service or for a preference you chose. The law does not require your consent for these (Art. 82 of the French Data Protection Act), which is why the website shows no banner. There are no advertising cookies, no third-party analytics cookies, no social media buttons that follow you.
On the website (revart.art)
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
t3_session | Cookie (HttpOnly, Secure) | Keep you signed in. Set only when you sign in. | 30 days; erased when you sign out |
t3_lang | Cookie | Remember the language you chose (French or English). | 1 year |
t3-install | Local storage | Anonymous installation identifier for scan counts and reports (§ 2). | Renewed at the latest after 13 months |
t3-studio-… | Local storage | Studio preferences (room, panel, brush, hidden layers). Artists only. | Until you clear your browser storage |
t3-flash, t3-welcome… | Session storage | Messages from one page to the next ("session expired", "welcome"). | Erased when the tab closes |
| AR artwork preparation | IndexedDB | Keep an artwork's recognition image so it opens faster. | Until you clear your browser storage |
| "Don't count my scans" choice | Local storage | Remember your opt-out. | Until you change it |
In the app
- The sign-in token is stored in the iOS Keychain, on this device only (never synced or backed up).
- Your settings (theme, language, video quality, scan opt-out) and the installation identifier are kept in the app's preferences.
- The history of your last 50 scans, your profile and artworks downloaded for offline use (1 GB at most) stay on your phone. They are not sent and are excluded from iCloud backup. Signing out erases the profile and downloaded artworks; deleting the app erases everything.
- The app does no advertising tracking and does not ask for Apple's tracking permission (App Tracking Transparency), since it does no tracking.
You can clear cookies and storage at any time in your browser settings. You will then be signed out, and the AR artwork will load more slowly the first time.
9. Your rights
You have the right:
- to access your data and get a copy (Art. 15);
- to have it corrected (Art. 16);
- to have it erased (Art. 17);
- to restrict its use (Art. 18);
- to receive it in a machine-readable format (Art. 20);
- to object to processing based on our legitimate interest, such as scan counting or keeping a video in which you appear (Art. 21);
- to give instructions about what happens to your data after your death (Art. 85 of the French Data Protection Act): keep it, erase it, or entrust it to someone you name. Write to us; without instructions, your heirs can ask for the account to be closed.
Do it yourself, from "My account" (website or app):
- edit your profile;
- export your data: a JSON file with your account, artworks, videos, favourites, statistics and a link to each of your files;
- delete your account (permanent erasure after 30 days; "Restore my account" until then).
For anything else, email legal@revart.art. We answer within one month at most (two more months if the request is complex; we will tell you). We may ask you to confirm the request comes from you, by writing from your account's email address.
Complaints. If you think your rights are not respected, you can complain to the French data protection authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at cnil.fr), or to the authority of the EU country where you live.
10. Minors
You must be 15 or older to create an account: this is the minimum age chosen by Revart. Scanning an artwork needs no account and is open to everyone. If we learn that an account belongs to someone under 15, we delete it. A parent can write to legal@revart.art.
11. Security
Encrypted connection (HTTPS) everywhere. Hashed passwords (argon2id). Sign-in tokens stored only as hashes. Server closed to all access except the website. Uploaded files never served as is. Backups encrypted before they leave the server, with a restore tested every week. If a data breach puts you at risk, we notify the CNIL within 72 hours and, if the risk is high, we tell you directly.
12. Changes
If this policy changes in an important way, we will tell you by email or in the app at least 30 days in advance. The version date is at the top of the page. Previous versions are available on request.
This policy exists in French and English. In case of difference, the French version prevails.