Built for Material That Isn't Public Yet
Unpublished exhibitions, embargoed news and loan details need care. Here is how Cartella handles them.
See Our SubprocessorsHosted in the EU
Your database and files are stored on servers in the European Union.
Never used for training
Your texts, images and contacts are never used to train AI models.
Separate space per institution
Each organisation's data is fully separated. Nothing is shared between customers.
Embargo controls
Press pages go live at the time you set. Sensitive projects are visible only to the people on them.
Access roles
Decide who can edit, who can approve and who can only read. Reviewers get links that expire.
Full audit log
Every approval, export and publish is recorded with who and when.
Compliance
GDPR
Cartella is built for European institutions and follows the GDPR.
Data processing agreement
Every customer signs a DPA with us before any data goes in.
Our Approach
Cartella is made by people who have worked inside a museum press office. We know what an early leak of an exhibition, a loan or a director's quote would mean.
So we keep it simple: as little data as needed, separated per institution, stored in the EU, never used to train AI models, and every important action logged. People approve everything that goes out.
Questions
What data does Cartella store?
The material you add to a project (texts, documents, images, contacts), the drafts and plans made from it, and who approved what and when.
Where is it hosted?
The database and files are hosted in the EU. [Where AI processing happens is being confirmed per provider and will be stated here before launch.]
Who can see our data?
Only the people you invite to your organisation, and only the projects they are on. Our team can access an account only for support, when you ask, and every access is logged.
Is our material used to train AI?
No. Your texts, images and contacts are never used to train AI models. Where the AI provider offers it, we also switch off data retention.
Can we delete everything?
Yes. You can delete projects and contacts, and export them first. When you leave, we delete your organisation's data.
How does the journalist database handle GDPR?
It holds only public, professional information, such as bylines, mastheads and outlet contact pages. Journalists are told when they are added, can see and correct their profile, and can opt out, which removes them everywhere.