Last updated: 11 September 2026. Art Roll is operated by Habitat Marketing Pty Ltd (ABN 66 632 437 980).
Questions: letsroll@artroll.com.au
Who we are and what this covers
Art Roll is an Australian public art and mural discovery platform: a public map of murals, a directory of the artists who paint them, and a jobs board that will connect artists with people commissioning work. In this policy, “Art Roll”, “we” and “us” mean the operating company named at the top of this page. Our contact address for anything in this policy is letsroll@artroll.com.au.
We apply the Australian Privacy Principles in the Privacy Act 1988 (Cth) as our standard for handling personal information. This policy is written to describe what the site actually does, in plain language. It is organised by who you are: a visitor using the map, a member of the public sending us a mural or a report, or an artist with a profile. Many people are more than one of these, so read the sections that apply to you.
If you are browsing the map or the artist directory
You do not need an account to browse Art Roll, and browsing does not ask you for your name, email address or anything else about you. What is collected without you typing anything:
- Ordinary web traffic information. Our hosting provider (Vercel) receives the requests your browser makes, which include your IP address, the page you asked for and your browser type, and keeps server logs of them for operating the site and investigating problems. Our own error logs refer to accounts by an internal identifier, never by name or email address.
- Site analytics. Vercel Web Analytics records page views, the page you came from, approximate location by country, and device type. Its vendor describes it as cookieless; it does not set a cookie and does not follow you across other sites.
- Advertising and analytics tags. On the live site we load Google Tag Manager, which runs Google Analytics, Google Ads tags and the Meta Pixel. See Cookies, analytics and advertising below for what each does and how it is configured.
- Bot protection. Public forms and the sign-in page use Cloudflare Turnstile to tell people from scripts. When a form is submitted, Cloudflare receives your IP address and technical signals from your browser to check the result.
- Security logs. To stop automated abuse we record the IP address of each submission to a public form, and of each attempt to check whether an email address matches a claimable artist profile. These records exist only to count attempts per address over a short window and are deleted automatically within hours (after the greater of one hour or twice the window in use) - no one reads them and nothing is kept from them.
- Browser security reports. Your browser may send us an automatic report if a page tried to load something our security policy blocks. That report names the page you were on and the blocked resource; it goes to our server log and nowhere else.
Your location
The artworks page has a “Closest to Me” sort and the map has a locate button. Both use your browser’s own location permission. The coordinates are used inside your browser to sort the list or centre the map, and are not sent to us or stored by us. You can refuse the permission and everything else keeps working. The map tiles themselves come from Mapbox, which receives the ordinary web requests needed to draw the map, including your IP address; the map’s location control is configured not to track your position.
Favourites (hearts)
If you are not signed in, the murals you heart are stored in your own browser and never reach our servers. If you are signed in as an artist, your favourites are saved to your account so they follow you between devices, and they are deleted with the account.
Links out
Directions open in Google Maps, and artist profiles link to artists’ own websites and social media. Those services have their own privacy practices; we send them nothing about you beyond what is in the link you chose to open.
If you send us a mural, a photo, a report or a request
Everything in this section is optional and starts with you choosing to fill in a form. All of these forms are protected by Cloudflare Turnstile and by the rate limits described above.
Submitting a mural you have spotted
Where this feature is available, you can add a mural to the map without an account. You must confirm you are 18 or over before we ask you anything; if you are under 18 we collect nothing and ask you to have a parent or guardian send it in. We then collect a description, the location you confirm on the map, your photographs, your name and email address, and an optional photo credit.
- Your name and email address are never shown publicly. We use them only to get in touch about that mural.
- The photo credit is public. Whatever you type into it appears next to your photograph on the mural page, and may appear if we share the photograph on Art Roll’s own social media accounts. Leave it blank for no credit.
- Photographs are private until a moderator reviews them. Nothing you send is published automatically. We ask for photographs of the mural, not of people. A photograph showing a child is cropped to the mural or not published; one showing adults may be published, cropped or declined at the moderator’s discretion, and anyone shown in it can ask us to take it down. Location data embedded in a photo file is stripped on our server - the only location we keep is the one you confirmed on the map.
- The permission you accept is recorded against each photograph, word for word, with the time you accepted it, so we can show later exactly what was agreed. The wording is reproduced in the Website & Map Terms.
- You get a receipt after submitting. It is the only way to withdraw your own photographs later without an account, so keep it. We store only a hashed form of it.
- If your submission is not published, your photographs, name, email address, credit and description are deleted 7 days after the decision. What survives is a non-identifying line: the suburb, the date, and a coded reason.
- If your photograph is published, we keep the permission record and a contact point for as long as the photograph is public, and delete them when it comes down. Files uploaded but never submitted are removed after 24 hours.
Reporting a problem with a mural
The “Report a Problem” form on a mural page asks what the problem is, for optional notes, and for your name and email address. We use your name and email only if we need to follow up on the report; they are never published. Reports are advisory - a moderator checks before anything changes on the map.
Asking for a photograph to be removed
Anyone can ask for a photograph to come down without an account: the photographer, the artist, the mural’s copyright owner, a person shown in a photograph, a child’s parent or guardian, or a property owner. You tell us who you are in relation to the photo and can add details; a name and email address are optional. If you mark a request as urgent because it involves a child’s or someone’s personal safety, the photograph is hidden immediately, before a person looks at it. Requests are kept as a record of what was asked and what we did, including requests we declined.
Claiming an artist profile
If you believe an artist profile is yours, the claim page checks whether your email address matches a claimable profile and, if it does, emails you a sign-in link. It gives the same answer for an address that is already claimed and one that is not on file, so it cannot be used to look people up. If your listing shows an old address, the request form collects your name, your current email address, a link that shows it is you (such as your Instagram or website) and a message. We use these only to verify the claim and set up your login; none of it is published.
Jobs board interest list
The jobs board is not open yet. If you register interest we collect your name, business name (if any), email address, your role and what you intend to use the board for, and we record the time you gave consent. We will email you once when the board opens, only about Art Roll, with an unsubscribe link.
If you are an artist
Artists give us the most: a name, an email address and password, a public profile with images, biography and professional details, private business details such as a mobile number, ABN and rates, and, optionally, cultural identity and community connection entries, some of which are sensitive information. What is public, what stays private, the consent we ask for before publishing sensitive information, the emails we send, the profiles carried over from the previous website, and what you can change or delete yourself are all set out in the “Your information” section of the Artist Terms, which is the artist part of this policy. Everything else on this page - browsing, cookies and tags, our providers, where information is stored, how long we keep it, and how to complain - applies to artists too.
Cookies, analytics and advertising
Art Roll sets the cookies needed to keep an artist signed in, and remembers in your browser that you have seen our cookie notice. Beyond that, on the live site we load Google Tag Manager, which runs these tags:
- Google Analytics and Google Ads tags. These run from the first page you view, whether or not you have pressed OK on the cookie notice. They set cookies in your browser so Google can count your visits to Art Roll, tell returning visitors from new ones, and measure our advertising, and they send Google the pages you view, the page you came from, and your browser and device type.
- The Meta Pixel. This tag also runs from the first page. It reports the pages you view to Meta and may set a cookie in your browser and use it, together with any Meta account you are logged into, for measuring our advertising and for audience features under Meta’s own terms.
- Vercel Web Analytics, described above, which does not use cookies.
The cookie notice is a notice, not a gate: pressing OK only dismisses it, and you can use every part of Art Roll without pressing it. You can block or clear cookies in your browser settings, and browser tracking protection and content blockers will stop these tags loading; the map, the directory and every form keep working with them blocked. If we add, remove or reconfigure a tag, we will update this section.
Who else handles your information, and where
We do not sell personal information. The services below process it to run Art Roll. Our database, including every artist email address, is hosted in Singapore; the others operate mainly from the United States and global networks. Overseas providers are subject to the laws of the countries they operate in.
| Provider | What for | What it receives | Where |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | All account, profile, mural, submission and form data; uploaded images | Singapore |
| Vercel | Website hosting, image resizing and site analytics | Web requests including IP address; server logs; page-view analytics | United States and global edge locations |
| Mapbox | Map tiles and map display | The web requests needed to draw the map, including IP address | United States |
| Resend | Sending our email | Recipient address, message content, delivery and click events | United States |
| Cloudflare | Bot protection (Turnstile) on forms and sign-in | IP address and browser signals when a form is submitted | Global network |
| Tag Manager, Analytics and Ads tags | Pages viewed, referring page, browser and device type, plus cookie identifiers for counting visits and measuring advertising | United States and global | |
| Meta | Meta Pixel | Page views and pixel cookie data for advertising measurement | United States and global |
How we protect it
Sign-in is handled by our authentication provider with hashed passwords and bot protection on the sign-in page. Every database table is protected by row-level access rules, so an artist can read and change only their own records and public pages can read only the public view of artist profiles. Uploaded images are checked for type and size, and publicly contributed photographs sit in private storage until a moderator publishes them. Public forms are rate-limited and bot-protected, and the site enforces a content security policy in the browser. Our database provider keeps automated daily backups. Every profile, profile change, mural and public contribution is reviewed by a person before it goes live. No internet service can promise absolute security, and we do not.
How long we keep things
- Artist accounts and profiles: until you delete the account or ask us to remove a listing.
- Deletion audit record: the display name for 30 days, then a non-identifying record.
- Public mural submissions that are not published: photographs and personal details for 7 days after the decision, then a non-identifying line.
- Published public photographs: the permission record and a contact point while the photograph is public.
- Uploaded files never submitted: 24 hours.
- Security rate-limit records (IP addresses): deleted automatically within hours.
- Problem reports, claim requests, removal requests and the jobs-board interest list: kept while they are being actioned and as a record of what was asked; you can ask us to delete yours.
- Removed photographs: gone from Art Roll immediately, though copies already generated by our hosting provider’s image cache can remain reachable at their direct address for up to 31 days.
- Anything under an active legal, copyright or safety dispute is held until the dispute is resolved.
Access, correction, complaints
You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing letsroll@artroll.com.au. We may need to check that you are who you say you are before we change or hand over account-level information. We aim to respond within 30 days, and will tell you if we need longer and why.
If you have a complaint about how we have handled your information, email us with enough detail for us to look into it. We will acknowledge it, investigate fairly, and give you a substantive answer within 30 days. If you are not satisfied with our answer, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).
Changes to this policy
We will update this policy when the site, our providers or the law changes, and the date at the top will change with it. If a change materially affects how we handle information artists have already given us, we will give reasonable notice where we can.