Payment and security

This article is for buyers who want to understand how a payment works on Khroma: who collects, how your data is protected, and who issues the invoice. If you're an artist, see Set up Stripe Connect instead.

Khroma connects, the artist sells

On Khroma, a purchase is a direct sale between you and the artist. Khroma acts as a technical platform: we provide the publishing tool, the checkout, and the payment infrastructure. But the sale contract is concluded directly with the artist offering the work.

Concretely:

• Money does not pass through Khroma. It moves directly from your card to the artist's Stripe account.
• The invoice you receive is issued in the artist's name, with their business name, address, and VAT number if applicable.
• Delivery, returns, and after-sale obligations rest with the artist.

This is reminded at the last step of checkout: By placing your order, you accept the Terms of Sale of {artist} and acknowledge that you are buying directly from the seller. KHROMA acts as a technical platform.

Checkout step by step

When you click an artwork's buy button, you land on a checkout page. It's organised into several sections.

Order summary

To the right (or at the top on mobile), you see the purchased artwork: photo, title, dimensions, technique, price.

The price breakdown is shown below the artwork:

• Artwork price (incl. VAT) — the final retail price.
• Discount (if promo code) — amount removed, code shown in monospace.
• VAT included ({rate}%) — VAT is included in the displayed price. If the artist has VAT exemption, the No VAT label replaces this line.
• Shipping — calculated based on your country and the artwork's class. Can be Free, a fixed amount, or Custom quote (in which case you can't order online).
• Total — the grand total.

If shipping is international (non-EU from an EU seller, or vice versa), a discreet note appears: Customs duties and local taxes may apply upon import. These charges are the buyer's responsibility. This is an unavoidable reality of international trade: the artist has no control over customs duties.

Delivery address

You enter:

• Email — where you'll receive confirmation and notifications.
• Country — selected from the list of countries the artist ships to.
• First name + Last name.
• Address line 1 — your street and number.
• Address line 2 (optional) — staircase, floor, recipient name if different.
• City + Postal code.
• Phone (optional) — useful for the carrier.

Promo code

A Promo code field lets you apply a discount if the artist gave you a code. Entry is uppercase, the code is server-validated (existence, usage conditions, minimum order). Once applied, the breakdown updates and a green badge confirms.

Payment method

The payment block is provided by Stripe Payment Element. Depending on your country and the artist's Stripe account, you see:

• Bank cards — Visa, Mastercard, American Express most often.
• Wallets — Apple Pay and Google Pay if your device supports them.
• Bank transfer — in certain regions, under certain conditions.

You enter your information directly in the Stripe iframe; Khroma never receives this data.

Payment button

The final button shows the amount to pay: Pay {amount}. Above it, a Secure payment by Stripe note is shown.

Payment security

End-to-end encrypted data

Your bank information (card number, CVV, expiry) never touches Khroma's servers. It transits over encrypted HTTPS directly between your browser and Stripe's infrastructure, which is PCI-DSS Level 1 certified (the highest industry certification level).

Stripe stores your data in its secure environment, never Khroma.

3D Secure (SCA)

For payments from Europe, Stripe automatically applies Strong Customer Authentication (SCA) required by the PSD2 directive. Concretely, during payment you may be redirected to:

• Your bank's mobile app, which asks you to validate the transaction.
• A 3D Secure page where you enter a code received by SMS.
• Biometric validation (Face ID, Touch ID) if your bank supports it.

This extra step protects both parties: if the transaction is validated by your bank, the bank assumes the risk in case of subsequent fraud.

Fraud detection

Stripe permanently runs fraud detection models (Stripe Radar). If a transaction shows suspicious signs (stolen card, unusual behaviour, inconsistent geolocation), it is blocked automatically and you see an error message.

If you think a legitimate transaction has been blocked by mistake, contact your bank to verify that the card is enabled for online purchases.

The invoice

After payment, you receive two things immediately:

1. A confirmation email: Order confirmation — {artwork}. It contains your order summary and a link to download your PDF invoice.
2. A PDF invoice generated by Stripe. This invoice carries:
   • The selling artist's name and address.
   • Your name and delivery address.
   • The net / VAT / gross detail.
   • The invoice number (incremental, specific to the artist).
   • The footer note set by the artist (for example VAT not applicable, art. 293 B of the CGI if they have VAT exemption).

The invoice is legally issued by the artist, not Khroma. It is the document that counts for your personal or professional accounting.

No mandatory signup

You can buy without creating a Khroma account. All communication goes through the email you entered at checkout.

Khroma still offers you a free account (Track your orders in one click — Create a free account to access your orders and invoices). Useful if you buy regularly: you find your orders, your invoices, your address pre-filled.

When something goes wrong

My payment was refused

Common causes:

• Card expired or blocked by your bank.
• Payment ceiling reached.
• 3D Secure not validated (timeout on the bank app).
• Fraud detection by Stripe Radar.

Solution: try with another card, or contact your bank to verify the card is allowed for online purchases.

My payment went through but I didn't receive a confirmation email

Check your spam folder. If nothing in spam, contact the artist directly (Contact page on their site) with the date and time of payment. The transaction is in their Khroma dashboard, they can find it and send you the invoice.

I'm unsure about the legitimacy of the shop

Khroma puts artists through a Stripe identity verification before they can collect payments. The Verified seller (identity confirmed via Stripe) badge on the payment page signals that this verification succeeded.

If the badge is absent, the artist hasn't (yet) finished verification. Payment is still possible but with a lower level of guarantee.

Frequently asked questions

Does Khroma keep any record of my bank data?

No. Your bank data is entered in the Stripe iframe and travels to its secure infrastructure. Khroma never sees or stores your card number, CVV, or expiry date.

Why is 3D Secure asked for some purchases and not others?

3D Secure is mandatory in Europe above certain thresholds (variable by card and bank). For very small amounts or recurring purchases, authentication can be considered already established by your bank. Beyond that, it's asked systematically.

Can I pay in instalments?

This option depends on the artist's Stripe account. Most don't enable instalment payment (which adds fees). If the option is available, it appears in the Stripe payment block.

Is my payment insured against fraud?

If you pay by card and notice fraud (stolen card, non-conforming delivery), your bank protects you under its standard guarantees. For Khroma, see Returns and refunds for recourse in case of dispute.

I'm buying from a non-EU country, do I have to pay VAT?

It depends on the seller-artist's tax rules and the delivery country. The checkout summary shows the detail. For non-EU exports from an EU artist, VAT can be reduced to 0 and customs duties apply on import on your end (at your charge).