PRIVACY POLICY

Kollectorium, 65, Rue de la Vallée, L-2661 Luxembourg City, Luxembourg

Contact: tribunal@kollectorium.com

Data we collect automatically

When you visit Kollectorium we automatically collect usage data including your IP address, browser type, device information, pages visited, and approximate location (city level). This is used for hosting, security, and spam protection.

Data you give us

When you register or use the platform you provide:

• Account credentials: email address and password (hashed)
• Profile data: username, display name, bio, location, avatar
• Collection data: figures you track including purchase prices, market valuations, condition, acquisition dates, and private notes. This data is stored privately unless you choose to make your collection public.
• Photos: figure photos you upload, stored in Supabase Storage. Visible to other users based on your collection visibility settings.
• Messages: direct messages you send to other users through the platform. Message content is stored to enable communication and may be reviewed by platform administrators in cases of reported abuse.
• Marketplace data: listing prices, item descriptions, and completed transaction history.
• Social activity: follows, ratings, comments, and platform activity (figures added, deals completed, photos uploaded) used to power community features.

Why we collect it

• Running and hosting the platform
• User authentication and account security
• Sending transactional emails (e.g. password resets, deal notifications)
• Spam and bot protection
• Traffic optimisation via CDN
• Aggregated insights: collection, pricing, ratings, and franchise data are used in aggregated, anonymised form to power market and discovery features (e.g. average sale price per figure, figure popularity), and may be shared with partners in non-identifying form. See "Aggregated & Anonymised Insights" below.
• Community features: activity feeds, social graphs, ratings, and discovery features

We use the following trusted services to operate the platform. Each processes your data only to the extent required for their function.

Kollectorium uses only essential cookies. These are strictly necessary for the service to function (authentication session, theme preference). We do not use advertising cookies or cross-site tracking cookies.

For traffic analytics we use a privacy-friendly, cookieless tool (Vercel Web Analytics) that measures aggregate visits and page views without storing cookies on your device or collecting personally identifying information.

We also keep two small counts of our own, in the same spirit: on phones, how many visits there were each day, how many opened the menu, and how many then picked something from it (kept apart for guests, members and the Keep's staff); and how long the Keep's radio plays, as a daily total for each song, with a count of visits with music. These are daily totals and nothing else: no identifier, no time of day, and nothing stored on your device for them. They are not made inside our apps, and if you say no to the optional question below they stop for you at once. If you are signed in, your radio listening is kept with your account, like the rest of what you do there. So that a small "menu" hint shows only until you first find the menu, your phone remembers that it has opened the menu; that stays on your phone and is never sent.

Because no non-essential cookies are set, no cookie consent banner is required under the ePrivacy Directive. You can clear cookies at any time via your browser settings, though this will sign you out.

Optional: which rooms get used. If you choose to allow it, we record which areas of the site a browser tab visits, so we can see which parts of the Keep are actually used and fix what is hard to find. This is off unless you say yes, and saying no changes nothing about how the site works for you.

If you do allow it, what is recorded is the areayou are in (for example "the Archive") and, for public catalogue pages, the public identifier of the page. We do not record what you type, what you search for, the contents of your vault, your messages, your account pages, your payments, your mouse movements or your screen. Private areas are recorded only as "a private room", with nothing inside them. The tab is identified by a short random value that is created only after you agree, lives in your browser's session storage, and is not a cookie, not a fingerprint and not linked to your account name.

This information is visible only to the site's administrator, is kept for minutes rather than months (a session disappears within half an hour of going quiet, and a daily maximum applies in any case), and is deleted outright when you withdraw. You can change your answer at any time, right here, in one tap either way; withdrawing stops the recording immediately and removes what was recorded.

On this browser your answer is: not answered yet.ALLOWNO THANKS

The question is asked once, quietly, from the second page you open in a visit; to know it is your second page, your browser keeps a note for this tab only (session storage) that you have already seen one. It is not sent anywhere and is gone when you close the tab.

Kollectorium produces statistical insights from platform activity: for example collection counts, figure popularity, average prices paid, community ratings, and franchise or manufacturer distribution.

These insights are always aggregated and anonymised. They are reported only at the group level, never below a minimum group size, so that no individual user can be identified or singled out from a statistic. They contain no names, emails, account identifiers, or other personal data.

We use these insights to (a) power platform features such as price history, market values, popularity, and discovery, and (b) potentially share or licence them, in aggregated and anonymised form only, with research, editorial, or commercial partners.

Sold prices you choose to share.When you delete a figure you sold outside Kollectorium, we optionally ask what it went for. That answer is kept in your own private records. If you leave "share this price" ticked, the price, day and condition of the sale (never your name, username or account) also join Kollectorium's price records, where it can appear as one sale among others in a figure's recent sales. Untick it to keep the price to yourself, and remove the sale from your Registry at any time to take it out of the price records too.

Because anonymised aggregate statistics do not identify any individual, they are no longer personal data and fall outside the scope of the GDPR once anonymised. The processing that produces them from your account data is carried out on the basis of our legitimate interest in operating, improving, and sustaining the platform. Where you are in the EU/EEA you may object to processing based on legitimate interest at any time (see "Your Rights" below). We will never share data that could identify you personally with a third party without your explicit consent.

Your personal data is stored securely on Supabase infrastructure (EU, Germany) and served via Vercel (United States). Data is retained for as long as your account is active. If you delete your account, your personal data is permanently erased. Certain records (e.g. transaction history) may be retained for legal compliance for up to 7 years.

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation:

• Right to access: request a copy of the data we hold on you
• Right to rectification: ask us to correct inaccurate data
• Right to erasure: ask us to delete your account and all associated data
• Right to restriction: ask us to limit how we process your data
• Right to data portability: receive your data in a machine-readable format
• Right to object: object to processing based on legitimate interests
• Right to withdraw consent where processing is based on consent
• Right to lodge a complaint with your national data protection authority

To exercise any right, contact us at tribunal@kollectorium.com. We will respond within 30 days.

United Kingdom

UK users have equivalent rights under the UK GDPR and the Data Protection Act 2018, including the right to cancel contracts made online within 14 days.

Brazil

Brazilian users have rights under the LGPD (Lei Geral de Proteção de Dados), including the right of regret for distance contracts within 7 days.

Subscription payments are processed by a third-party payment provider. Kollectorium does not store your payment card details. We receive only confirmation of a successful payment and your subscription status. The payment provider's own privacy policy governs how your payment data is handled. Details of the provider in use will be listed on the checkout page.

If you install the Kollectorium mobile app and grant notification permission, we may send push notifications about trade activity, messages, offers, and platform updates. You can withdraw this permission at any time via your device settings. We do not use push notifications for marketing without your explicit consent.

We may update this policy from time to time. The latest version is always available at this URL with the date of last update noted at the top. Continued use of the platform after changes constitutes acceptance of the updated policy.