BAZANOVA ART
DATA POLICY
Infinite Garments Art and Paintings LLC ("IGAP LLC"), doing business as Bazanova Art
Effective Date: May 29, 2026
Last Updated: October 5, 2026

1. Purpose and Scope
This Data Policy describes how Bazanova Art ("Bazanova Art," "we," "us," or "our") collects, processes, stores, secures, and shares data through its websites, online learning platform, and related services (the "Services"). It supplements our Privacy Policy, available at art-bazanova.com/privacy, and governs the operational handling of all data in our systems, including personal information of customers, students, prospects, employees, contractors, and business contacts.
Where there is any conflict between this Data Policy and the Privacy Policy with respect to the rights of consumers, the Privacy Policy controls.
2. Definitions
Personal Information / Personal Data: information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as defined by applicable U.S. state privacy laws.
Sensitive Personal Information: as defined by applicable U.S. state privacy laws, including but not limited to: government identifiers (e.g., Social Security numbers, driver’s license numbers), financial account credentials, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, biometric data, health data, sexual orientation, and account log-in credentials when combined with information necessary to access the account.
Processing: any operation performed on personal information, whether or not by automated means.
Service Provider / Processor: a third party that processes personal information on our behalf pursuant to a written contract.
Consumer / Data Subject: a natural person about whom we hold personal information.
3. Categories of Data We Process
3.1 Identifiers
Full name, email address, postal address, phone number, account username, IP address, device identifiers.
3.2 Customer Records
Billing address, payment confirmations, transaction IDs, course/tier selected, refund requests. Full payment card numbers are processed by PCI-DSS-compliant payment processors and are not stored on our systems.
3.3 Commercial Information
Records of purchases, products considered, discounts applied, marketing-list membership.
3.4 Internet / Network Activity
Browsing history on our Services, search history, interaction with content and ads, lesson progress, cookies and pixel data, including data collected through the Meta Pixel, Conversions API (CAPI), and similar advertising-tracking technologies.
3.5 User-Generated Content
Photographs of your artwork, homework submissions, chat and forum messages, support tickets, survey responses.
3.6 Inferences
Profiles reflecting preferences, characteristics, predispositions, and aptitudes derived from the data above, used to recommend courses and personalize content.
3.7 Sensitive Personal Information
Account log-in credentials in combination with the information necessary to access the account; date of birth where collected. We do not knowingly collect biometric data, precise geolocation, health data, racial or ethnic origin, religious beliefs, sexual orientation, or union membership from consumers, except as required for employment, payroll, and tax compliance purposes (see Section 16).
3.8 Data Minimization
We collect only the categories of personal information that are reasonably necessary and proportionate to the purposes described in this Data Policy. We do not collect categories of personal information that are not needed for the stated purposes.
4. Sources of Data
• Directly from you when you register, purchase a course, complete a form, contact support, post content, or otherwise interact with the Services.
• Automatically from your devices and browsers through cookies, pixels, SDKs, and server logs.
• From service providers and partners (payment processors, analytics, advertising platforms including Meta, learning-platform vendor, email/SMS delivery).
• From publicly available sources where lawful (e.g., business contact databases for B2B outreach).
5. Purposes of Processing
We process personal information for the following specific, legitimate business purposes:
1. Provide and maintain the Services, including delivering courses and managing your account.
2. Process payments, issue refunds, and detect or prevent fraud.
3. Personalize the learning experience and improve our curriculum.
4. Communicate transactional notices and customer support.
5. Send marketing communications consistent with your preferences and applicable law.
6. Deliver targeted advertising on third-party platforms, including Meta (Facebook and Instagram), and measure advertising performance.
7. Operate the business: accounting, tax, audit, legal compliance, and risk management.
8. Protect the security and integrity of the Services and the safety of our users.
9. Comply with legal obligations and respond to lawful requests.
10. Develop and improve AI-powered features, including course recommendations, content personalization, and automated support tools.
We do not process personal information for purposes that are incompatible with the purposes for which it was originally collected without providing notice and, where required, obtaining consent.
6. Retention Schedule
We retain personal data only for as long as necessary to fulfill the purposes set out in this Data Policy and our Privacy Policy, consistent with the principle of data minimization. The following retention periods apply unless a longer period is required by law:
Data Category Retention Period
Account profile data Duration of the account plus 3 years after closure or last course access
Course progress and certificates Minimum of 5 years to support credential verification
Payment and tax records Minimum of 7 years pursuant to U.S. federal and state requirements
Customer-support correspondence 3 years from the last contact
Marketing preferences and consent records Until consent is withdrawn, plus 3 years for suppression-list purposes
Data subject request (DSR) records Minimum of 24 months, as required by applicable state law
Server logs and security telemetry Up to 12 months on a rolling basis
Backups Up to 12 months on rolling deletion cycles
AI training datasets (de-identified) Up to 3 years, after which de-identified data is purged
Deletion requests are honored in production systems immediately and propagated to backups on the regular rotation cycle.
7. Security Program
We maintain a written information security program designed to protect the confidentiality, integrity, and availability of personal data. Key controls include:
• Encryption: TLS 1.2+ for data in transit; AES-256 (or equivalent) for sensitive data at rest.
• Access controls: role-based access on a least-privilege basis, with multi-factor authentication on administrative accounts.
• Network security: firewalls, intrusion detection, and isolation of production environments.
• Endpoint security: managed device configurations, anti-malware, and screen-lock policies for staff.
• Vendor risk management: due-diligence reviews and written data-processing agreements with all service providers handling personal data.
• Personnel training: mandatory privacy and security training for all employees and contractors with access to personal data.
• Incident response: documented procedures for detection, containment, eradication, recovery, and notification; tested at least annually.
• Patching and vulnerability management: regular patching cycles and periodic vulnerability assessments.
8. Service Providers and Sub-Processors
We engage trusted service providers to perform functions on our behalf. Each provider is bound by a written agreement that limits their use of personal data to performing services for us and requires appropriate safeguards. Current categories include:
• Payment processing: PCI-DSS-compliant payment gateways.
• Cloud hosting and infrastructure: storage, compute, and content delivery providers.
• Learning platform vendor: the operator of painting.eduonline.io.
• Email and SMS delivery: transactional and marketing message delivery.
• Advertising platforms: Meta (Facebook/Instagram) for Pixel, Conversions API, and Custom Audiences; other advertising platforms where used.
• Analytics and product telemetry: usage and performance measurement.
• Customer support tools: ticketing, chat, and knowledge-base platforms.
• AI service providers: AI and machine learning providers for course recommendations, content personalization, and automated support.
• Professional services: accountants, attorneys, and auditors.
A current list of sub-processors is available upon request at info@art-bazanova.com.
9. Cross-Border Data Transfers
We primarily host and process data within the United States. Some service providers may process data outside the United States. Where personal data is transferred internationally, we implement appropriate safeguards, including Standard Contractual Clauses, binding corporate rules, or other legally recognized transfer mechanisms, and conduct transfer impact assessments where required by applicable law.
10. Sale or Sharing of Personal Information
We do not sell personal information as "sale" is defined under applicable U.S. state privacy laws.
We do share personal information with third-party advertising platforms, including Meta (Facebook and Instagram), for purposes of cross-context behavioral advertising. This "sharing" is subject to your right to opt out.
To exercise your opt-out right, you may:
• Click the "Do Not Sell or Share My Personal Information" link on our website.
• Email info@art-bazanova.com with the subject line "Do Not Sell or Share My Personal Information."
• Enable the Global Privacy Control (GPC) signal in your browser, which we honor as a valid opt-out request.
Upon receiving and verifying an opt-out request, we will display a confirmation ("Opt-Out Request Honored") and take the following actions:
• Stop firing the Meta Pixel and other advertising-tracking technologies for your sessions.
• Exclude you from Custom Audiences and similar advertising audiences.
• Apply Meta’s Limited Data Use (LDU) flag to restrict processing of your data.
• Exclude your data from server-side transmissions to advertising platforms.
We will not process personal information in a manner inconsistent with a valid opt-out request after it has been received and verified.
10A. Third-Party Advertising and Meta (Facebook) Integration
We use third-party advertising platforms, including Meta (Facebook and Instagram), to deliver targeted advertising and measure campaign performance. The following applies:
10A.1 Meta Pixel and Conversions API. We use the Meta Pixel and/or Conversions API (CAPI) on our website. These tools collect and transmit the following data to Meta: IP address, browser and device information, page URLs visited, conversion events (e.g., course purchases, registrations), and, where Advanced Matching is enabled, hashed email addresses and phone numbers from form submissions. This data is used for retargeting, conversion measurement, and audience building on Meta platforms.
10A.2 Sharing Disclosure. Sharing data with Meta for targeted advertising constitutes "sharing" as defined under CCPA/CPRA and equivalent state privacy laws. Consumers have the right to opt out of this sharing as described in Section 10.
10A.3 Custom Audiences. We may upload hashed customer contact lists (email addresses, phone numbers) to Meta to create Custom Audiences for advertising. We only upload data from customers who have not opted out of marketing or data sharing. Customer data is hashed (SHA-256) before transmission. We maintain documentation of the legal basis for each Custom Audience and can provide it to Meta upon request.
10A.4 Data Source Declarations. We comply with Meta’s data source declaration requirements and maintain records of the origin, consent basis, and freshness of all audience data used in Meta advertising.
10A.5 Cookie Consent. The Meta Pixel is loaded only after the user has provided consent or, where applicable, has not opted out, consistent with our cookie banner and applicable law. Users may manage cookie preferences through our cookie banner or browser settings.
10A.6 Other Advertising Platforms. Where we use other advertising platforms (e.g., Google Ads, TikTok Ads), the same principles apply: data sharing is disclosed, opt-out is honored, and tracking technologies are loaded only after consent where required by law.
10B. Artificial Intelligence and Automated Decision-Making
We use artificial intelligence (AI) and automated systems to enhance our Services, personalize learning experiences, and improve our curriculum. This section describes how we use AI with personal data and the rights available to consumers.
10B.1 Purposes of AI Processing. We use AI and machine learning for:
• Course recommendations: analyzing learning progress, preferences, and engagement to suggest relevant courses and content.
• Content personalization: adapting learning materials, difficulty levels, and pacing based on individual student performance.
• Automated support: AI-assisted customer support tools (chatbots, ticket routing) that may process user inquiries.
• Analytics and insights: aggregating and analyzing user behavior to improve curriculum design and platform functionality.
• Fraud detection and security: automated systems to detect suspicious activity and protect user accounts.
10B.2 Profiling. We may engage in profiling — automated processing of personal data to evaluate or predict aspects such as preferences, interests, behavior, or performance. Profiling is used solely to personalize the learning experience and improve our Services, not to make decisions that produce legal or similarly significant effects on consumers.
10B.3 Data Used for AI Training. We may use de-identified and aggregated user data to train and improve our AI models. Personal data used for AI training is subject to the retention periods in Section 6. We do not sell personal data to third parties for AI training purposes. Where required by applicable state law (including California AB 2013), we maintain documentation of the categories and sources of data used for AI training and will disclose this information upon request.
10B.4 Sensitive Data. We do not use sensitive personal information (as defined in Section 2) for AI processing, profiling, or automated decision-making without affirmative opt-in consent where required by applicable law.
10B.5 Consumer Rights. Consumers have the following rights regarding AI and automated decision-making:
• Right to opt out of profiling: Consumers may opt out of profiling that produces legal or similarly significant effects by contacting info@art-bazanova.com. Routine personalization and recommendation features do not constitute significant profiling and are not subject to this opt-out.
• Right to know: Consumers may request information about the categories of personal data processed by our AI systems and the purposes of such processing.
• Right to human review: Where automated decision-making produces a significant adverse effect on a consumer, the consumer may request human review of the decision by contacting info@art-bazanova.com.
• Right to correct: Consumers may correct inaccurate personal data used in automated processing.
10B.6 Pre-Use Notice. Where AI is used for consequential automated decisions that materially affect a consumer, we provide notice at or before the point of processing, describing the purpose, logic, and expected outcomes of the automated system, in accordance with California ADMT regulations (effective January 1, 2027) and other applicable state laws.
10B.7 Data Protection Assessments. We conduct data protection assessments for AI systems that present heightened risk to consumers, as required by applicable state privacy laws, including but not limited to Colorado, Connecticut, Maryland, Texas, and Oregon.
10B.8 Transparency. Where AI-generated content is used in our marketing or communications, we disclose its AI-generated nature in accordance with applicable law and platform policies, including Meta’s AI content disclosure requirements.
11. Data Subject Rights and Request Handling
Consumers may exercise rights described in our Privacy Policy, including the right to know, access, correct, delete, port, opt out of sale/sharing/targeted advertising, opt out of profiling, and appeal. Operationally:
• How to submit: Requests may be submitted to info@art-bazanova.com or via the request form on our website.
• Tracking: We log every request and assign a unique tracking ID.
• Identity verification: We verify the requester’s identity using information already in our possession (e.g., account email).
• Acknowledgment: Within 10 business days of receipt.
• Substantive response: Within 45 days, extendable once by an additional 45 days for complex requests, with notice to the consumer.
• Denials: Include the reason for the denial and instructions for appeal; appeals are decided within 60 days.
• Authorized agents: We honor opt-out requests from authorized agents and recognized opt-out preference signals (e.g., Global Privacy Control).
A notice at the point of collection (at or before data is collected) is provided on all registration, purchase, and contact forms, linking to this Data Policy and our Privacy Policy.
12. Data Breach Notification
In the event of a security incident affecting personal data, we will:
• Activate our incident-response plan and contain the incident as quickly as reasonably possible.
11. Conduct a documented investigation, including assessment of risk to affected individuals.
12. Notify affected individuals, regulators, and other parties as required by applicable law. We comply with all applicable federal and state breach notification laws, including but not limited to:
• Florida Information Protection Act (FIPA, Fla. Stat. § 501.171): notification without unreasonable delay and no later than 30 days after determination of a breach affecting 500 or more Florida residents, with notice to the Florida Department of Legal Affairs where required.
• California Civil Code § 1798.82: notification to affected residents in the most expedient time possible and without unreasonable delay.
• All other applicable state breach notification statutes: with timelines and content requirements as required by each respective state law.
13. Cooperate with law enforcement and applicable regulators.
14. Conduct a post-incident review and implement corrective actions.
13. Marketing and Communications
• Email marketing is sent only to recipients who have consented or where permitted under the CAN-SPAM Act. Every marketing email includes an unsubscribe link and a physical postal address.
• SMS marketing, where used, complies with the Telephone Consumer Protection Act (TCPA) and includes clear opt-in disclosures and STOP-to-unsubscribe instructions.
• Transactional communications (e.g., order confirmations, account notices) are not marketing and may be sent regardless of marketing preferences.
14. Cookies and Tracking
We use cookies and similar technologies as described in our Privacy Policy and any cookie banner we display. Users may manage preferences through the banner, their browser, and, where required by law, by exercising opt-out rights for sale/sharing and targeted advertising. We honor Global Privacy Control (GPC) signals from supported browsers.
Advertising-tracking technologies, including the Meta Pixel, are loaded only after the user has provided consent through our cookie banner or, where applicable, has not opted out. Users may withdraw consent at any time through the cookie banner or browser settings.
15. Children’s Data
The Services are intended for adults. We do not knowingly collect personal information from children under 13 in violation of the Children’s Online Privacy Protection Act (COPPA).
• Users between 13 and 17 may use the Services only with the verifiable consent and supervision of a parent or legal guardian, who must complete enrollment and remain responsible for the minor’s account.
• We do not knowingly sell or share for cross-context behavioral advertising the personal information of consumers under 16 without the affirmative consent required by applicable law, including the laws of California (CCPA/CPRA), Connecticut (CTDPA), Oregon (OCPA), and other states with enhanced protections for minors.
• We do not engage in targeted advertising directed at minors under 18 where prohibited by applicable state law, including Maryland’s Online Data Privacy Act (MODPA).
16. Employee and Contractor Data
Personal data of employees, contractors, and applicants — including government identifiers such as Social Security numbers — is processed for human-resources, payroll, tax, benefits, and compliance purposes as required by federal and state law (e.g., IRS reporting, I-9 verification). Internal HR policies govern collection, access, and retention of such data. Government identifiers are collected only from employees and contractors for legally required purposes and are not collected from customers or students.
17. Roles and Responsibilities
• Privacy Officer: oversees this Data Policy, responds to data subject requests, and serves as the primary point of contact for privacy inquiries. Contact: info@art-bazanova.com.
• Security Lead: owns the information security program and incident response. Contact: security@bazanova.art.
• All personnel: must complete privacy and security training and follow this Data Policy.
18. Applicable Law
This Data Policy is governed by the laws of the State of Florida and applicable federal laws of the United States, without regard to conflict-of-laws principles. We additionally comply with the privacy laws of other U.S. states that apply to our processing, including, where applicable:
• California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)
• Texas Data Privacy and Security Act (TDPSA)
• Colorado Privacy Act (CPA)
• Connecticut Data Privacy Act (CTDPA)
• Virginia Consumer Data Protection Act (VCDPA)
• Oregon Consumer Privacy Act (OCPA)
• Maryland Online Data Privacy Act (MODPA)
• And other applicable state privacy laws as enacted and amended.
Where our processing falls below the numerical applicability thresholds of a specific state law, we voluntarily adhere to the principles of that law to the extent reasonably feasible. We monitor changes in state privacy legislation and update our practices accordingly.
We also comply with applicable AI-specific laws, including California AB 2013 (AI training data transparency, effective January 1, 2026), California ADMT regulations (automated decision-making technology, effective January 1, 2027), Colorado AI Act (effective February 1, 2026), and Texas TRAIGA (effective January 1, 2026), to the extent our use of AI falls within their scope.
19. Updates to This Policy
We review this Data Policy at least annually and update it as needed to reflect changes in our practices, technology, legal requirements, or other factors. Material updates will be communicated to affected consumers and posted on our website with a revised "Last Updated" date.
20. Contact
Bazanova Art
Infinite Garments Art and Paintings LLC (IGAP LLC)
1482 Cleveland Street, Apt #1
Clearwater, FL 33755-5250

Phone: +1 (904) 898-1513
Email: info@art-bazanova.com
Security inquiries: security@bazanova.art