Master Ecosystem Privacy Policy

1.1 Information We Collect Across the Main Portal

When you browse instatearts.com, read regional Arts News articles, interact with our State Arts & Culture Trivia, Area Code, or ZIP Code discovery tools, or submit an inquiry through the ISA Support Center, we collect two primary categories of information:

• Voluntarily Submitted Information: Your name, email address, phone number, organization name, state/region, and message details when you submit a contact form, support ticket, newsletter signup, or partnership inquiry.
• Automated Technical & Usage Data: Standard browser and device metadata—such as IP address, browser type, operating system, referring URLs, pages viewed, and interaction timestamps—collected via cookies and analytics scripts to maintain site security, prevent automated abuse, and improve cultural discovery performance.

1.2 Cookies, Session Management & Analytics

We use essential cookies to keep you signed into member portals, preserve your directory search preferences, and secure checkout sessions. We also utilize aggregate performance analytics to understand how visitors explore state cultural hubs. You may configure your browser to block non-essential cookies, though doing so may limit certain interactive directory or member portal features.

1.3 No Sale of Personal Information

In State Arts, LLC does not sell, rent, or trade your personal contact information to data brokers or third-party marketers. We use your information solely to deliver the ecosystem services, directory visibility, workspace operations, and media fulfillment you request.

2.1 Public Profile Information vs. Private Account Data

The primary purpose of our Regional State Directories (including the Colorado Arts Hub & Directory and future state directories) is to connect artists, organizations, venues, and businesses with the public across our five community hubs (InJoy, InClusion, InTriguing, InSpire, and InCompaz). Accordingly, we maintain a strict distinction between public listing data and private account data:

• Public Directory Listing Data: Information that you intentionally place in your public directory profile—such as your public artist/business name, biography, public business address or service area, public website link, social media links, portfolio media, published events, coupons, and articles—is publicly accessible and indexed by search engines so patrons and partners can discover you.
• Private Account & Administrative Data: Your login password, private administrative email address or direct phone number (when toggled off from public display), “Claim Your Listing” verification documents, internal support tickets, and billing history are kept strictly private and are never displayed on your public profile.

2.2 Preliminary Public Records & Opt-Out Requests

Where ISA compiles a preliminary directory profile for a cultural venue or organization from publicly available business or non-profit registries, the authorized representative of that organization may claim and customize the listing at any time, or request removal of the unclaimed profile by submitting a request through the ISA Support Center.

3.1 Multi-Tenant Data Separation & Client Confidentiality

Organizations subscribing to InCompaz+ (or deploying seasonal/campaign funnels via a custom sidecar subdomain such as outreach.[yourdomain].org) are provisioned with a logically isolated digital workspace. With respect to the patron lists, donor records, leads, and customer communications stored inside your workspace, you are the Data Controller and In State Arts, LLC acts solely as a Data Processor / Service Provider on your behalf.

ISA enforces strict tenant isolation: your workspace contacts and campaign performance data are never shared with, visible to, or accessible by any other ISA directory member, organization, or advertiser.

3.2 Mandatory Mobile Messaging & A2P 10DLC Privacy Protection

If you opt in to receive SMS or MMS notifications from In State Arts or through an InCompaz+ workspace form (such as appointment reminders, support ticket updates, onboarding alerts, or community announcements), message frequency varies based on your activity. Standard message and data rates may apply. You may opt out of SMS communications at any time by replying STOP to any message, or reply HELP for assistance.

4.1 PCI-Compliant Payment Processing

All membership enrollments, InCompaz+ subscriptions, and Service Marketplace orders are processed through industry-standard, PCI-DSS Level 1 compliant payment processing infrastructure. In State Arts, LLC does not store your full credit card number, CVV security code, or raw payment card credentials on our servers.

4.2 Creative Briefs, Brand Assets & Fulfillment Sharing

When you purchase written editorial packages or True North Grid Media Collective placements through the Service Marketplace, we collect your project intake briefs, target audience parameters, logos, graphics, audio/video spots, and scheduling preferences. We share these campaign-specific creative assets solely with:

• ISA Editorial & Creative Production Teams: Assigned writers, editors, and quality assurance specialists bound by confidentiality obligations to draft and refine your commissioned content.
• Participating Media & Broadcast Networks (True North Grid Orders Only): Regional print publications, streaming audio networks, connected television (CTV) platforms, and digital out-of-home (DOOH) screen networks strictly as required to clear, schedule, traffic, and broadcast your reserved advertisement.

5.1 Your Rights Under Colorado & U.S. State Privacy Laws

Depending on your state of residence (including residents protected under the Colorado Privacy Act and comparable U.S. state consumer privacy statutes), you have the right to:

• Right to Access & Portability: Request confirmation of whether we process your personal data and obtain a copy of the personal data you have provided to us.
• Right to Correction: Update or correct inaccuracies in your account profile or directory listing at any time through your member dashboard or by contacting us.
• Right to Deletion: Request deletion of your personal data maintained by ISA, subject to statutory exceptions for active contractual fulfillment, tax/accounting retention, and security logs.
• Right to Opt Out: Opt out of promotional communications, targeted advertising, or any sale of personal data (note: ISA does not sell personal data).

5.2 Data Security & Retention

We implement administrative, technical, and physical safeguards—including TLS/SSL encryption in transit, role-based access controls, and isolated tenant databases—to protect your information against unauthorized access or disclosure. We retain personal data only for as long as necessary to provide active memberships or workspace services, comply with legal and financial reporting obligations, and resolve disputes.

5.3 Children’s Privacy

The ISA Ecosystem is not directed to children under the age of thirteen (13), and we do not knowingly collect personal information from children under 13.

5.4 How to Exercise Your Rights or Contact Us

To submit a privacy inquiry, exercise your data rights, or request assistance with your directory profile or InCompaz+ workspace, please contact In State Arts, LLC via our official ISA Support Center. We will verify your identity and respond within the timeframe required by applicable law.