Privacy Policy

This policy explains how Collectaneum ("we", "us", "our") collects, uses, discloses and retains personal information when you use our website, registry, mobile applications and related services (together, the "Service").

Collectaneum is a registry for collectors, not a marketplace. You control the collecting information you choose to record. Some content can be submitted for inclusion in the shared catalogue; this is different from making your own collection public.

Collectaneum is operated by Centrillio Limited, registered in England and Wales, company number 12189838. Centrillio Limited is the controller of personal information covered by this policy. You can reach us through our Contact page.

• Account and profile: account name, email, authentication identifiers, preferences and account status. Password verification is handled by our authentication provider; we do not keep a readable copy of your password.
• Registry and ownership: collections, owned items, product and variant links, titles, descriptions, condition, completeness, acquisitions, valuations, storage locations, provenance, ownership events and notes.
• Additional content: photographs, documents, research, wanted items, custom fields and other information you choose to provide.
• Imports and exports: uploaded spreadsheet values, original import rows, normalised values, mapping or matching outcomes and records needed to prepare exports.
• Shared catalogue contributions: proposed products, variants, taxonomy, identifiers, supporting evidence, contribution status and associated contributor information.
• Subscriptions: billing provider, subscription and entitlement identifiers, trial and payment status, renewal or expiry dates and cancellation information. Your payment provider handles complete card details.
• Technical and security information: IP addresses, device or browser information, service logs, sign-in events, errors and security-related activity as needed to operate and protect the Service.
• Communications: support enquiries, account communications and any optional marketing preferences.

Registry entries may include personal information about you or other people, such as a seller or former owner. Only include information that is appropriate and necessary for your collecting records.

• Provide the Service (contract): create accounts; store, organise, search, match, import and export registry content; and support normal account features.
• Administer subscriptions (contract): recognise valid entitlements, manage access, support renewals and cancellations, and apply subscription-expiry states.
• Security and reliability (legitimate interests and, where applicable, legal obligation): prevent abuse, investigate incidents, maintain logs and operate a reliable service.
• Customer support (contract or legitimate interests): respond to enquiries and resolve account or technical problems.
• Shared catalogue integrity (legitimate interests, where justified): review submitted information, check identifiers, reduce duplication and maintain reusable factual records for collectors.
• Accounting and legal compliance (legal obligation): retain records we must keep for tax, accounting, regulatory or lawful-request purposes.
• Optional marketing or non-essential tracking (consent or another lawful basis where applicable): only where the applicable rules permit this, with appropriate choices.

Where we rely on legitimate interests, these include protecting the Service and maintaining an accurate, useful shared catalogue. We balance those interests against individuals' rights and expectations. If we ask for consent, it can be withdrawn without affecting earlier lawful processing.

Your personal registry is distinct from the shared catalogue. Recording an owned item, photograph, purchase or private note does not by itself publish it to other collectors.

You may separately submit product information and supporting material for catalogue review. Approved public catalogue records can be used by other collectors to identify their items.

If you later delete your account, we may retain accurate, non-personal catalogue facts needed for the continuity of shared records, while removing or anonymising your personal association with those records where appropriate. This does not mean that all contributed content is exempt from deletion. Photographs, identifiable provenance, personal descriptions and other material will be assessed in light of applicable rights, licences and legal requirements.

Private drafts and unapproved contributions will normally be removed as part of permanent account deletion unless a lawful reason requires a different outcome.

We use third-party services to provide essential infrastructure and particular features. Depending on the feature you use, these include:

• Supabase: account authentication, database services and file storage.
• Vercel: website and web-application hosting.
• Stripe: web subscription and payment processing.
• Apple or Google: authentication or app-store subscriptions where those features are offered and used.
• Open Library: bibliographic lookup for supported book identifiers.
• Other necessary operational providers: communications, support, reliability and security services where applicable.

Providers do not all have the same legal role: some process information for us, while payment or platform providers may independently control information they receive. We share information only where needed for the relevant purpose or where disclosure is legally required. We do not sell your personal information to advertisers.

Some providers may process personal information outside the United Kingdom. Where required, we rely on applicable adequacy arrangements or appropriate transfer safeguards, taking account of the relevant provider and destination. Contact us for information about the safeguards relevant to your data.

Cancelling a subscription does not request deletion of your account. If you cancel, access normally continues until the current valid subscription or trial entitlement ends.

• Active or trialling: full access while your entitlement is valid.
• Read-only, days 1-90 after expiry: you can sign in, view your registry and use supported exports, but cannot make normal registry changes or use paid write/processing features.
• Protected retention, following 12 months: after read-only access ends, the account is not available for normal customer access, but its registry data is securely retained for the agreed recovery period.
• Pending purge: after the retention period ends, the account becomes eligible for permanent removal through our deletion process.
• Purged: applicable live account and private registry records are removed; residual copies in protected backups expire under the relevant backup cycle.

Separate periods may apply to financial records we must retain by law, security evidence, limited operational records and appropriately anonymised shared catalogue facts. We do not promise that every such record is erased on exactly the same day as the private registry.

Retention following subscription expiry differs from the faster process for an explicit account deletion request, described below.

You can request deletion of your Collectaneum account through account management or by contacting us. Deleting your account and cancelling a subscription are separate actions.

When you request account deletion, a 30-day cancellation window begins. During this period you can withdraw the request. If you withdraw it, your account returns to the appropriate previous access state; doing so does not automatically reinstate a subscription that was already cancelled or expired.

After the cancellation window, the account moves towards permanent purging of associated personal and private registry content, subject to applicable lawful retention requirements and the shared catalogue distinction explained above. Some backup copies expire later under the backup policy.

You can also use our Contact page to request deletion if you cannot access the app. Where your subscription is managed by an external payment provider, follow the relevant provider's subscription-management instructions as well.

Collectaneum supports export of your registry information, including collections, owned items, related structured records, photographs and documents. Exports also include research, wanted items and retained original and normalised spreadsheet import information.

Supported exports remain available during the read-only access period. You can also request access to personal information within the scope of your applicable data protection rights. Internal records that are not part of an ordinary registry export may still fall within those rights.

The mobile scanner reads barcode values to look for existing products. For supported ISBNs, Collectaneum may request bibliographic information from Open Library. Information returned by external services may be shown for your review and, if you choose to contribute a catalogue record, saved with source references and supporting information.

The identifier used for the lookup may be sent to the external source. Camera permissions are needed for camera-based scanning; you can enter identifiers manually where supported.

Essential browser storage and related technologies support authentication, security and normal operation. Diagnostic or analytics information may be used to maintain and improve reliability. Where non-essential cookies or similar tracking require consent, we will request that consent before using them and provide applicable controls.

We use technical and organisational controls designed to protect accounts and registry content, including authentication, access restrictions and database-level controls. Private registry records are separated from public catalogue information, and access is limited according to the needs of the Service. No system can guarantee absolute security.

See our Security page for information about responsible vulnerability reporting.

Subject to the conditions and exceptions in applicable law, you may request access to, correction or erasure of personal information; restriction of processing; portability of applicable data; and objection to certain uses, including processing based on legitimate interests. You can withdraw consent where we rely on it.

To exercise your rights, contact us using our Contact page. You also have the right to complain to the UK's Information Commissioner's Office at ico.org.uk.

Collecting records can include information about past owners, sellers, contributors or other individuals. Only record or share such information when appropriate. Do not publish another person's private contact details or sensitive information without a proper basis. We may restrict, correct or remove material where necessary to protect privacy or comply with law.

Collectaneum is designed for collectors and is not specifically directed at children. The minimum permitted account age and any parental-consent arrangements are governed by our applicableTerms of Service. Where we become aware that information has been collected contrary to applicable requirements, we will take appropriate steps.

We may update this policy as the Service develops or legal requirements change. We will publish the revised policy with an updated effective date and take reasonable steps to notify users about material changes.

Centrillio Limited (company number 12189838), operator of Collectaneum. For privacy enquiries and requests, use our Contact page.