Privacy policy
Your brief
stays yours.
This page explains the information used by the commission planner and client portal in plain language.
What is collected
When you submit a commission request, the site stores your contact details, project selections, creative brief, permitted reference links, and planning estimate. The portal also stores messages, quote versions and responses, proof feedback and approvals, invoice links and payment status recorded by Crim, and delivery links and receipts. Crim can keep private project notes to manage the work.
Saved characters and drafts
Your character library stores character names, details, reference links, and links to previous commissions under your account. Only you can open or edit your library; the character details you choose to submit with a commission are shared with Crim as part of that brief. Archiving a character hides it from your active library without deleting its history. Unsubmitted estimate drafts are saved on this device without your contact details or consent. They expire after seven days and are removed when that draft is next accessed. You can discard a draft sooner.
Visual brief boards
Artwork selections and your notes on them are saved on this device. They expire 30 days after your last edit and are removed when you next open or use the board. You can remove individual selections or clear the board sooner. If device storage is unavailable, the board lasts only while the page remains open. A board is not public. Only selections you explicitly attach and submit with a commission become part of that request for you and Crim to review.
Optional portfolio permission and character showcases
After delivery, you can separately authorize selected final and process images for Crim’s portfolio. Crim still chooses whether to create and publish a portfolio draft. Private messages and reference files are not copied into it. You can withdraw permission, which stops new public access through this site to that permission-linked artwork. Optional character showcases use only a separately written public name, introduction, and selected artwork already approved for public display. They do not publish your private character notes or reference links. You can withdraw a showcase, and archiving its character hides it. Copies, screenshots, or posts already saved by other people cannot be recalled.
Sign-in information
The client portal uses Amazon Cognito. After you confirm your email address, the site receives a stable account identifier, verified email address, and any name you choose to provide so it can show the right requests to the right signed-in person.
How it is used
Information is used to review the request, prepare a quote and schedule, communicate about the project, and keep a useful project history. Crimosse does not sell client information.
Files, proofs, and payments
Private commission uploads are stored in an access-controlled Amazon S3 bucket. Files are available only to the client for that request and Crim; unpublished proofs and final files remain artist-only until shared. Proof comments store the file version and the selected position on the image. When Stripe is connected, payments happen on Stripe’s hosted checkout. Crimosse stores payment references, amounts, and payment or refund status, but not card numbers. Share only material you are allowed to share.
Opening alerts and public reviews
Opening alerts require your consent and email confirmation. Every opening announcement includes an unsubscribe link. Subscription and withdrawal records are kept to honor your choice and prevent queued emails from being sent after you unsubscribe. Reviews are optional and available after delivery. Only the display name and review you consent to share can appear with an artwork, after artist approval. Editing or withdrawing a review removes its previous public version.
Storage and service providers
Request data is stored in Amazon DynamoDB, sign-in is handled by Amazon Cognito, notification email can be delivered through Amazon SES, and the website runs on AWS Amplify. Email content and delivery status are retained in an artist-only notification log for up to 90 days, subject to automatic cleanup. Invoice, reference, proof, and delivery links may open external services with their own privacy policies.
Site measurement
The site may use Google Analytics to understand public page visits and basic actions such as starting an estimate. Analytics is disabled on private portal, studio, sign-in, visual brief board, character showcase, and email-confirmation pages. Page-view events omit query strings, and do not include commission briefs, character details, contact details, reference links, or private portal messages. When analytics is enabled, IP anonymization is requested.
Abuse protection
The intake applies short-lived request limits. A one-way hash derived from network and account or contact information is kept briefly so automated submissions cannot overwhelm the commission inbox.
Access, correction, and deletion
Use the request thread to correct project details. To ask for access to or deletion of a request, message Crim through the portal or the official Tumblr profile. Records may be retained while needed to manage a commission or resolve a request.