Effective Date: January 1, 2025  ·  Last Updated: April 2025

Nhamsa, operated in partnership with the Himalayan Art Council ("HAC", "we", "us"), is committed to the responsible handling of personal data. This Policy explains what information we collect, how we use it, and your rights in relation to it. Because the Platform includes features that create permanent public records (the HAC Provenance Ledger), please read this Policy carefully before submitting artwork or collection data.

01Information We Collect

Account data: Name, email address, password (hashed), profile photo, and account type (collector, artist, or gallery) provided at registration.

Transaction data: Shipping address, billing information, order history, and payment confirmations. Full payment card details are processed and held exclusively by our payment processor (Stripe) — we do not store them.

Artist and gallery data: Portfolio images, biography, lineage documentation, pricing history, payout bank details, and HAC certification records submitted for listing or certification.

Collector Vault data: Artworks you add to your personal Vault, including images, metadata, location notes, private notes, estimated values, and documentation uploads. This data is private and stored on Nhamsa's secured servers.

Usage data: IP address, browser type, device identifiers, pages visited, search queries on the Platform, and interaction data (saves, follows, time spent). This is collected automatically via cookies and analytics tools.

02The HAC Provenance Ledger and IPFS Records

When an artwork is HAC-certified, a provenance record — containing artwork metadata such as title, medium, dimensions, artist name, lineage, exhibition history, and certification ID — is written to IPFS (InterPlanetary File System), a decentralised permanent storage network.

This record is permanent and publicly accessible. It cannot be deleted, modified, or hidden once committed. The purpose is to create an authoritative, tamper-proof cultural archive of Himalayan art for collectors, institutions, scholars, and future generations.

We do not write personal data (home address, payment details, private notes, email) to IPFS. Only artwork-level, culturally relevant provenance data is stored on the public ledger. By submitting a work for HAC certification, artists and galleries explicitly consent to the permanent public archival of that work's provenance record.

03How We Use Your Information

To operate the Platform: Process transactions, manage your account, issue HAC Digital Passports, and fulfil orders including shipping coordination.

To personalise your experience: The Collector Vault uses your saved artworks, followed artists, and interaction data to generate personalised recommendations, aesthetic profiles, and acquisition suggestions. You can opt out of personalisation in your account settings.

To communicate with you: Send order confirmations, shipping updates, certification notices, and — with your consent — the Himalayan Art Bulletin, newly archived art digests, and artist alerts.

For export compliance: Where required by Nepali law or regulation, artwork transaction and export data may be shared with the Department of Archaeology, Nepal, or other relevant government authorities.

To improve the Platform: Anonymised and aggregated usage data is analysed to improve Platform performance, discover collector preferences, and produce the annual "State of Himalayan Art" cultural report. No individual is identifiable in published reports.

04Sharing Your Information

We do not sell your personal data. We share data only in the following circumstances:

Service providers: Payment processors (Stripe), shipping carriers, cloud hosting providers, and email delivery services — each bound by data processing agreements limiting their use of your data.

IPFS network: Artwork provenance metadata for certified works is distributed across IPFS nodes globally. This is a consequence of permanent archival and is disclosed explicitly in Section 02.

Galleries and artists: When you purchase an artwork or make an enquiry, your name and shipping address are shared with the relevant gallery or artist solely to fulfil the transaction.

Legal and regulatory: We may disclose data when required by court order, applicable law, or to cooperate with Nepali government authorities on heritage export compliance.

05Cookies and Analytics

We use cookies and similar technologies for session management, preference storage, and platform analytics. Analytics tools (including Google Analytics) collect anonymised behavioural data to help us understand how the Platform is used. You may disable non-essential cookies via our cookie preferences banner or your browser settings; this may limit some Platform features. We do not use cookies for third-party targeted advertising.

06AI-Powered Features

The Collector Vault and recommendation engine use AI models trained on aggregated, anonymised Platform data to generate aesthetic profiles, suggest artworks, and produce collection insights. Your personal Vault data is not shared with third-party AI providers in identifiable form. AI-generated valuations and suggestions are indicative only and do not constitute professional advice.

07Data Retention

Account and transaction data is retained while your account is active and for seven years thereafter to satisfy accounting, tax, and legal obligations — after which it is deleted or anonymised.

Collector Vault data is retained while your subscription is active. Upon account deletion, Vault contents are deleted within 30 days unless you export them first.

HAC Provenance Ledger records on IPFS are permanent and cannot be deleted as a technical property of the network. Artist and artwork names within these records will persist indefinitely as part of Nepal's cultural heritage archive.

08Your Rights

Depending on your jurisdiction, you may have the right to: access a copy of your personal data; correct inaccurate data; request deletion of data we hold about you (subject to legal retention obligations and the IPFS limitation above); object to or restrict certain processing; and request a portable copy of your data.

To exercise any of these rights, contact us at privacy@nhamsa.com. We will respond within 30 days. Note that rights over IPFS-archived provenance records cannot be fulfilled due to the technical permanence of that system.

09Security

We implement TLS encryption for data in transit, AES-256 encryption for sensitive data at rest, role-based access controls, and regular security audits. No system is entirely secure; in the event of a data breach affecting your personal data, we will notify you as required by applicable law and take immediate remediation steps.

10International Data Transfers

The Platform is operated from Nepal. If you access it from outside Nepal, your data may be transferred to and processed in Nepal or in other countries where our service providers operate (including for IPFS node distribution globally). By using the Platform, you consent to such transfers. We take steps to ensure appropriate safeguards are in place in line with applicable data protection standards.

11Children's Privacy

The Platform is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us immediately and we will delete it promptly.

12Changes to This Policy

We may update this Policy to reflect changes in the Platform, applicable law, or our data practices. Material changes will be communicated by email or a prominent notice on the Platform at least 14 days before taking effect. Your continued use of the Platform after that date constitutes acceptance.

13Contact

For privacy questions, data requests, or concerns, contact our Data Protection Officer at privacy@nhamsa.com — Nhamsa / Himalayan Art Council, Kathmandu, Nepal.