What we hold, and why

Lumiere is a gallery where architecture students publish their studio work. This notice covers everybody who visits the site, and everybody who holds an account.

Lumiere decides what is collected and why, which in data protection language makes us the controller. We are based in Ontario, Canada.

• Your email address. Needed to create an account, sign you in, and send password resets. It is never shown in full to other people.
• Your name and school. Your name appears publicly on the projects you publish, which is the point. Your school is worked out from your email domain.
• Your bio, if you write one. Public.
• The work you upload: images, PDFs, titles, descriptions, course and year. All public.
• Basic technical records kept by our hosting and database providers: IP addresses and request logs, used to keep the site up and to stop attacks.

We do not use advertising trackers, we do not sell anything to anyone, and there is no analytics script following you around.

Different bits of your information are held for different reasons, and the law wants us to say which is which:

• To run your account (your email, your password, your name): we cannot provide the service you asked for without it. This is the contract between us.
• To publish your work (your projects, your name on them, your bio): you choose to publish, and you can unpublish at any time. That choice is your consent, and you may withdraw it by deleting the project.
• To keep the site standing (request logs, rate limiting records): we have a legitimate interest in not being knocked over by attacks or spam.

• Anyone on the internet: your published projects, your name on them, your school and course, and your bio.
• Other signed-in students: a masked hint of your email (like ma•••@uwaterloo.ca) when they search for you to add to a team project. This exists so two students with the same name can be told apart. Nobody can retrieve your full address through the site.
• Us: your full email address, so we can contact you about your account.
• Nobody else. We don't share personal data with third parties beyond the service providers below, who process it on our behalf and only on our instructions.

Published projects are meant to be found. Search engines index them, and a link preview may show your project title, your name and your cover image. If you would rather that did not happen, do not publish the project.

• Supabase stores the database, your uploaded files, and account credentials. Passwords are stored hashed; not even we can read them.
• Our web host serves the pages and keeps short-lived request logs.
• Our email provider delivers account emails such as confirmations and password resets.

These companies may keep data on servers outside your country, including in the United States. When they do, they are bound by standard contractual clauses or an equivalent safeguard, which is the mechanism the law provides for sending personal data abroad.

• Passwords are hashed, never stored in a readable form, and checked against a strength rule before they are accepted.
• Every request runs over https, and the session cookie is restricted so another site cannot borrow it.
• The database enforces per-row permissions, so one student's account cannot read or change another's.
• Sign-in and password reset attempts are rate limited, so an address cannot be guessed at by brute force.

No site can promise perfect security. If a breach ever affects your personal data, we will tell you and the relevant regulator as quickly as we reasonably can.

Your account and projects stay until you delete them. Deleting a project removes both the page and the uploaded files. Deleting your account removes your profile and everything you published. Technical logs are kept by our providers for a short period, typically days to a few weeks, and then discarded.

One honest caveat: if you were credited on somebody else's group project, your name may remain on their project, because that record is theirs to edit. Ask them, or ask us and we will.

You can ask us to:

• Give you a copy of everything we hold about you.
• Correct anything that is wrong.
• Delete your account and your work.
• Hand your data over in a portable file, or send it to another service.
• Stop a particular use of your data, or object to it.

Email us and we will do it within 30 days. You do not have to give a reason, and asking costs nothing. If you think we have handled your data badly, you can also complain to the privacy regulator where you live; in Canada that is the Office of the Privacy Commissioner, and in the UK the Information Commissioner's Office.

One cookie, and only once you sign in: it keeps you signed in. There is no advertising or tracking cookie, which is why this site has no cookie banner nagging you.

Accounts are for university students, and you must be at least 16 to hold one. We do not knowingly collect anything from children. If you believe a child has created an account, tell us and we will remove it.

If we change how we handle your information in a way that matters, we will email account holders before it takes effect, and update the date at the top of this page. Smaller wording fixes just get the new date.

You can reach us with privacy questions, a request to see or delete your data, or anything here that looks wrong.

The terms of service cover the rest of the relationship: what you may publish, and what we may do about it.