PRIVACY POLICY

Kollectorium, 65, Rue de la Vallée, L-2661 Luxembourg City, Luxembourg

Contact: tribunal@kollectorium.com

Data we collect automatically

When you visit Kollectorium we automatically collect usage data including your IP address, browser type, device information, pages visited, and approximate location (city level). This is used for hosting, security, and spam protection.

Data you give us

When you register or use the platform you provide:

• Account credentials: email address and password (hashed)
• Profile data: username, display name, bio, location, avatar
• Collection data: figures you track including purchase prices, market valuations, condition, acquisition dates, and private notes. This data is stored privately unless you choose to make your collection public.
• Photos: figure photos you upload, stored in Supabase Storage. Visible to other users based on your collection visibility settings.
• Messages: direct messages you send to other users through the platform. Message content is stored to enable communication and may be reviewed by platform administrators in cases of reported abuse.
• Marketplace data: listing prices, item descriptions, and completed transaction history.
• Social activity: follows, ratings, comments, and platform activity (figures added, deals completed, photos uploaded) used to power community features.

Why we collect it

• Running and hosting the platform
• User authentication and account security
• Sending transactional emails (e.g. password resets, deal notifications)
• Spam and bot protection
• Traffic optimisation via CDN
• Aggregated insights: collection, pricing, ratings, and franchise data are used in aggregated, anonymised form to power market and discovery features (e.g. average sale price per figure, figure popularity), and may be shared with partners in non-identifying form. See "Aggregated & Anonymised Insights" below.
• Community features: activity feeds, social graphs, ratings, and discovery features

We use the following trusted services to operate the platform. Each processes your data only to the extent required for their function.

Kollectorium uses only essential cookies. These are strictly necessary for the service to function (authentication session, theme preference). We do not use advertising cookies or cross-site tracking cookies.

For traffic analytics we use a privacy-friendly, cookieless tool (Vercel Web Analytics) that measures aggregate visits and page views without storing cookies on your device or collecting personally identifying information.

Because no non-essential cookies are set, no cookie consent banner is required under the ePrivacy Directive. You can clear cookies at any time via your browser settings, though this will sign you out.

Kollectorium produces statistical insights from platform activity: for example collection counts, figure popularity, average prices paid, community ratings, and franchise or manufacturer distribution.

These insights are always aggregated and anonymised. They are reported only at the group level, never below a minimum group size, so that no individual user can be identified or singled out from a statistic. They contain no names, emails, account identifiers, or other personal data.

We use these insights to (a) power platform features such as price history, market values, popularity, and discovery, and (b) potentially share or licence them, in aggregated and anonymised form only, with research, editorial, or commercial partners.

Because anonymised aggregate statistics do not identify any individual, they are no longer personal data and fall outside the scope of the GDPR once anonymised. The processing that produces them from your account data is carried out on the basis of our legitimate interest in operating, improving, and sustaining the platform. Where you are in the EU/EEA you may object to processing based on legitimate interest at any time (see "Your Rights" below). We will never share data that could identify you personally with a third party without your explicit consent.

Your personal data is stored securely on Supabase infrastructure (EU, Germany) and served via Vercel (United States). Data is retained for as long as your account is active. If you delete your account, your personal data is permanently erased. Certain records (e.g. transaction history) may be retained for legal compliance for up to 7 years.

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation:

• Right to access: request a copy of the data we hold on you
• Right to rectification: ask us to correct inaccurate data
• Right to erasure: ask us to delete your account and all associated data
• Right to restriction: ask us to limit how we process your data
• Right to data portability: receive your data in a machine-readable format
• Right to object: object to processing based on legitimate interests
• Right to withdraw consent where processing is based on consent
• Right to lodge a complaint with your national data protection authority

To exercise any right, contact us at tribunal@kollectorium.com. We will respond within 30 days.

United Kingdom

UK users have equivalent rights under the UK GDPR and the Data Protection Act 2018, including the right to cancel contracts made online within 14 days.

Brazil

Brazilian users have rights under the LGPD (Lei Geral de Proteção de Dados), including the right of regret for distance contracts within 7 days.

Subscription payments are processed by a third-party payment provider. Kollectorium does not store your payment card details. We receive only confirmation of a successful payment and your subscription status. The payment provider's own privacy policy governs how your payment data is handled. Details of the provider in use will be listed on the checkout page.

If you install the Kollectorium mobile app and grant notification permission, we may send push notifications about trade activity, messages, offers, and platform updates. You can withdraw this permission at any time via your device settings. We do not use push notifications for marketing without your explicit consent.

We may update this policy from time to time. The latest version is always available at this URL with the date of last update noted at the top. Continued use of the platform after changes constitutes acceptance of the updated policy.