Privacy policy

CuratorSearch is a job board for curatorial, museum and gallery roles. The data controller is Nadim Samman, Urbanstraße 176, 10961 Berlin, Germany, acting as a sole trader. For any question about this policy or your data, or to exercise any of the rights below, contact support@curatorsearch.com.

If you create an account: your email address, your name if you give one, and a one-way hash of your password. We never store your password itself and cannot recover it.

If you subscribe: a customer reference and subscription status from Stripe, our payment processor. Card details are entered on Stripe's systems and never reach our servers or database.

If you post a job: the listing content you submit, linked to your account.

Automatically: ordinary server request logs, which include IP addresses. We also count sign-in and sign-up attempts per email address and per IP address for a short period, to prevent password-guessing attacks.

We run no advertising or cross-site tracking scripts. Our analytics (below) is configured with Google Signals and ad personalization turned off, so it is never used to build advertising profiles. We do not sell or share personal data with third parties for marketing.

We use Google Analytics to see aggregate traffic and which pages get used, in a configuration that sets no cookie: client_storage is set to 'none', so Google Analytics identifies a visit with a temporary, in-memory identifier that does not persist between visits or get written to your device, rather than the _ga cookie it uses by default. IP addresses are anonymized before use.

This cookie-free configuration is a deliberate attempt to stay outside the consent requirement in § 25 TDDDG (and the EU ePrivacy rules it implements), which is triggered by storing information on, or reading it from, your device. Nothing is stored on your device by our analytics. We would rather state that reasoning openly than present it as settled: it has not been tested in court, and if it turns out to be wrong the remedy is a consent banner, not a quieter policy.

One cookie, holding your sign-in session. It is strictly necessary to keep you logged in and is not used for tracking. Signing out or clearing it ends the session. Analytics (above) sets none. Because we set no non-essential cookies, we are not currently showing a consent banner.

Stripe — payment processing and subscription billing. Stripe acts as its own controller for payment data; see stripe.com/privacy.

Google Analytics — traffic analytics, in the no-cookie configuration described above; see policies.google.com/privacy.

Have I Been Pwned — when you choose a password at sign-up, we check whether it appears in known public breaches. This uses a method (k-anonymity) where only the first five characters of a hash of your password leave our server. Your password, your email address and the full hash are never sent.

Railway— hosts the application and the database, both in Railway's EU-West (Amsterdam) region, so account and subscription records are stored inside the EEA.

Book links on our reading list point to Bookshop.org and are affiliate links. Following one takes you to their site, where their own privacy policy and cookies apply. Book cover images are loaded by your browser directly from Open Library (covers.openlibrary.org) and Bookshop.org's image server (images-eu.bookshop.org), which means those two services receive your IP address and browser details when a page showing covers loads. Until 17 August 2026 those images were proxied through our own servers and neither service saw your IP; we changed it so that an outage at one host could not stall the other, and this disclosure is the cost of that change.

Your account and subscription records are stored in the EEA (see Railway, above) and are not transferred outside it by us.

Two of the processors named above are US companies, so using this site does involve transfers to the United States: Stripe if you subscribe, and Google Analytics for the aggregate traffic measurement described earlier. Both self-certify under the EU-US Data Privacy Framework, and both also offer the European Commission's Standard Contractual Clauses. The breached-password check runs against Have I Been Pwned in the UK, which the European Commission has found to provide an adequate level of protection.

Where a processor is certified under the EU-US Data Privacy Framework we rely on that certification; where it is not, we rely on the European Commission's Standard Contractual Clauses. The Framework replaced two predecessors that the Court of Justice annulled — Safe Harbour in 2015, Privacy Shield in 2020 — so we re-check each processor's status periodically rather than treating it as permanent.

Listings are collected from institutions' own public careers pages and from public job boards. Where a listing names a contact person, that information came from the employer's published advertisement. If you are named in a listing and want it removed, contact us and we will remove it and exclude the source.

Providing your account and subscription is processing necessary to perform our contract with you. Security measures such as rate limiting and breached-password checks rest on our legitimate interest in protecting accounts. Aggregating publicly advertised vacancies rests on our legitimate interest in operating a job board.

Account and subscription records are kept while your account exists and for ten years afterwards where needed for tax and accounting. That period is not our choice: § 147 AO requires German businesses to retain accounting records for ten years, and § 257 HGB requires six years for business correspondence. Server logs are kept for 30 days. Rate-limiting counters are held in memory only and expire within an hour.

You have the right to access your data, correct it, delete it, restrict or object to processing, and receive a portable copy. To exercise any of these, email support@curatorsearch.com. You can delete your account at any time, which removes your account record and any job postings attached to it.

If you are in the UK you may complain to the Information Commissioner's Office; in the EU, to your national supervisory authority.

If this policy changes materially we will update the date at the top and, where the change affects you, tell account holders by email.