Privacy Policy.

This policy is written in plain language to be practical and readable. It is provided as a working baseline and should be reviewed and approved by qualified legal counsel before you rely on it for any regulated compliance obligation.

Department of Creative Pursuits ("DOCP", "we", "us") operates a creative studio, membership, and events venue in Denver, Colorado. We publish this website and the DOCP OS platform (departmentdenver.com) used to book studios, manage membership, and coordinate access.

Contact: create@docp.studio · 2150 Market Street, Denver, CO 80205.

Account information. Name, email address, password (hashed), and — when you sign in with Google — the profile fields Google returns (name, email, profile image, unique ID).

Profile information. Optional details you add: pronouns, discipline, bio, links, photo, and Creative Index profile fields.

Booking and access data. Studio, event, and meeting bookings; guest counts; timestamps; membership status; promo codes; signed booking agreements; and Certificate of Insurance uploads when required.

Payment data. Membership and booking payments are processed by Stripe. We store non-sensitive metadata (amount, status, Stripe IDs). We do not store full card numbers.

Access-control data. Kisi access grants tied to a booking (email, resource, time window) used to issue and revoke door access.

Applications. Residency and program applications you submit, including files and long-form answers.

Communications. Emails you send us, contact-form submissions, and notification preferences.

Technical data. Standard server logs (IP, user agent, timestamps) for security and reliability, and cookies required for authentication.

To create and secure your account; to process bookings and payments; to issue Kisi door access; to sync bookings to our shared Google Calendar for staff coordination; to send transactional emails (confirmations, receipts, access instructions, password resets); to review residency and program applications; to operate the Creative Index and member directory; and to respond to inquiries.

The Creative Index displays profiles that members choose to publish. Fields you mark public (name, discipline, bio, links, photo) may be visible on public pages and indexed by search engines. You can unpublish or edit a profile at any time from your account.

The member directory is opt-in. If you opt in, other signed-in members can see the fields you chose to share. Opting out removes you from the directory.

Booking agreements you accept are stored with your name, IP, timestamp, and the version of the agreement text. Certificates of Insurance you upload are stored privately and shared only with staff reviewing your booking.

Bookings are synced to a single shared Google Calendar used by DOCP staff for scheduling. The event includes booking metadata (title, time, resource, requester name, contact email). Kisi is used to grant temporary door access matched to your booking window; grants are revoked when the window ends or when the booking is canceled.

We send transactional emails you would reasonably expect from booking, membership, and access activity. You can opt out of non-essential emails through your account. Transactional emails required for account, payment, and access cannot be disabled while your account is active.

We use strictly necessary cookies for authentication and session management. If we enable analytics in the future, we will update this policy and, where required, request consent before enabling non-essential trackers.

We rely on a small set of vendors to operate the platform:

• Supabase — database, authentication, and file storage for the DOCP OS backend.
• Stripe — membership and booking payments; PCI-scope card data.
• Google — Google Sign-In and Google Calendar sync.
• Kisi — physical access control at 2150 Market Street.
• Email delivery providers used to send transactional email from our verified sender domain.
• Hosting infrastructure that serves the website and platform.

Each vendor processes only the data required for its function and is bound by its own terms and privacy policy.

We do not sell personal information. We share data only with the vendors above to operate the service, with law enforcement when required by valid legal process, and with your consent (for example, when publishing a public profile).

We keep account, booking, payment, and access records for as long as your account is active and for a reasonable period afterward to meet tax, accounting, safety, and dispute-resolution obligations. Signed agreements and COI uploads are retained for the life of the record. You may request deletion of your account; we will remove or anonymize records that we are not required to retain.

You can update or delete profile information from your account, opt out of the member directory, unpublish your Creative Index profile, revoke Google Sign-In from your Google account, and request account deletion by emailing create@docp.studio. Residents of jurisdictions with additional privacy rights (access, correction, portability, deletion) may exercise them by contacting us.

We use industry-standard practices: encrypted transport (HTTPS), hashed passwords, row-level security on member data, service-role keys held server-side only, HMAC-verified webhooks, and audited access to production systems. No system is perfectly secure; report any suspected vulnerability to create@docp.studio.

DOCP OS is not directed to children under 13. We do not knowingly collect information from children under 13. Contact us if you believe a child has provided personal information.

We will update this policy when our practices change. Material changes will be announced by email or an in-platform notice. The "Last updated" date at the top reflects the current version.

Department of Creative Pursuits
2150 Market Street
Denver, CO 80205
create@docp.studio