The Collecting Site Privacy Policy

Effective Date: March 31, 2026 INTRODUCTION The Collecting Site ("TCS," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what personal information we collect, how we use it, and your rights regarding that information. By registering for or using TCS, you agree to this Privacy Policy. If you do not agree, please do not use the site. This policy applies to registered users and visitors to thecollectingsite.com. 1. WHO WE ARE (DATA CONTROLLER) The data controller for personal information processed through The Collecting Site is The Collecting Site. For privacy inquiries, contact us at: [email protected] 2. AGE REQUIREMENT The Collecting Site is intended exclusively for users who are 16 years of age or older. We do not knowingly collect personal information from anyone under the age of 16. If we become aware that a user is under 16, we will promptly delete their account and all associated personal data. If you believe a minor has registered, please contact us immediately at [email protected]. For users in the United States: we do not knowingly collect personal information from children under the age of 13 in compliance with the Children's Online Privacy Protection Act (COPPA). Our 16+ age requirement provides additional protection beyond this minimum. 3. INFORMATION WE COLLECT a. Information You Provide When you register or use TCS, we collect: - Name (first and last) - Email address - Date of birth (used to verify the age requirement; not displayed publicly) - Country and state/province - Phone number (optional) - Password (stored as a one-way bcrypt hash; we cannot read your password) - Communication preferences (email/SMS opt-in status) - The Terms of Service version accepted, acceptance date, and IP address at acceptance - Collection and item data you choose to enter (titles, descriptions, valuations, notes, and custom fields) - Images you upload for collection items b. Information Collected Automatically - IP address (collected when you log in or register, for security and fraud prevention) - Browser user agent string (collected at login/registration for security) - Session cookies (required for login and site functionality) - Usage and analytics data via Google Analytics (pages visited, session duration, and general geographic region) c. Payment Information Payment card and billing details are collected and processed directly by Stripe, our payment processor. TCS does not store or have access to your full payment card details. We receive confirmation of successful payments and retain your Stripe customer ID and subscription status. 4. HOW WE USE YOUR INFORMATION We use your personal information to: - Create and manage your account - Provide the collection management service - Verify that you meet the minimum age requirement (16+) - Send account-related emails (email verification, password reset, subscription notifications) - Send marketing communications if you have opted in (you may opt out at any time) - Process subscription payments securely through Stripe - Protect the security and integrity of the platform - Investigate and respond to reports of policy violations - Analyze site usage and improve the service (via Google Analytics) - Comply with legal obligations 5. LEGAL BASIS FOR PROCESSING (EU / UK GDPR) For users in the European Union (EU), the United Kingdom (UK), and other jurisdictions with similar data protection laws, we process your personal data on the following legal bases: - Performance of a contract: Processing necessary to provide your account and the TCS service (e.g., account data, collection data). - Legal obligation: Processing necessary to comply with applicable laws (e.g., age verification under GDPR Article 8; record-keeping obligations). - Legitimate interests: Processing for our legitimate business interests where these are not overridden by your rights (e.g., site security, fraud prevention, aggregate analytics). - Consent: Where you have given specific consent (e.g., optional marketing emails or SMS; analytics cookies). You may withdraw consent at any time without affecting prior processing. 6. HOW WE SHARE YOUR INFORMATION We do not sell your personal information. We share your information only in the following limited circumstances: - Stripe: Payment processing for subscription services. See Stripe's privacy policy at stripe.com/privacy. - Cloudflare: We use Cloudflare Turnstile on registration and login forms for bot protection. See Cloudflare's privacy policy at cloudflare.com/privacypolicy. - Google Analytics: Anonymized usage analytics. See Google's privacy policy at policies.google.com/privacy. You may opt out via the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout. - Legal requirements: We may disclose information if required by law, court order, or lawful government authority. - Business transfer: If TCS is acquired or merged, your information may transfer to the successor entity, who will be bound by this Privacy Policy. - Public collections: Collection and item data that you choose to make publicly visible will be accessible to other users and site visitors. Your personal details (name, email, DOB) are never displayed publicly. 7. DATA RETENTION We retain your personal information for as long as your account is active or as needed to provide our services. You may request account deletion at any time by contacting [email protected]. Upon account deletion we will remove your personal data, except where retention is required by law or for legitimate business purposes (e.g., transaction records required for tax or financial compliance, which we may retain for up to 7 years). Anonymized aggregate data derived from usage (e.g., analytics summaries) may be retained indefinitely. 8. YOUR PRIVACY RIGHTS Depending on your location, you may have the following rights: EU and UK Residents (GDPR / UK GDPR): - Right of access: Request a copy of the personal data we hold about you. - Right to rectification: Request correction of inaccurate or incomplete personal data. - Right to erasure ("right to be forgotten"): Request deletion of your personal data. - Right to data portability: Request your data in a structured, machine-readable format. - Right to restriction of processing: Request that we restrict processing of your data under certain circumstances. - Right to object: Object to processing based on legitimate interests or for direct marketing at any time. - Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time. - Right to lodge a complaint: You may lodge a complaint with your local supervisory authority (e.g., the UK Information Commissioner's Office at ico.org.uk, or your EU Member State supervisory authority). California Residents (CCPA / CPRA): - Right to know: Request disclosure of the personal information we collect, use, and share. - Right to delete: Request deletion of your personal information, subject to certain exceptions. - Right to correct: Request correction of inaccurate personal information. - Right to opt out of sale: We do not sell personal information. - Right to non-discrimination: We will not discriminate against you for exercising your privacy rights. To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days (or within the timeframe required by applicable law). 9. COOKIES AND TRACKING - Session cookies: Required for login and account functionality. These cannot be disabled without preventing you from logging in. - Google Analytics: We use Google Analytics to understand how users interact with our site. This may set cookies and collect anonymized usage data. To opt out, install the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout. - Cloudflare Turnstile: Used on forms to distinguish humans from automated bots. This may set cookies or use browser signals for this purpose. No personal data is shared with Cloudflare beyond what is necessary for the bot-detection check. 10. DATA SECURITY We take reasonable technical and organizational measures to protect your personal information, including: - Passwords are stored as one-way bcrypt hashes and cannot be reversed. - Payment card data is handled exclusively by Stripe and is never stored by TCS. - Account access is protected by email-verified authentication. No method of data transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at [email protected]. 11. INTERNATIONAL DATA TRANSFERS If you are located outside the United States, your information may be transferred to and processed in the United States or other countries where our service providers operate. Where required by applicable law (e.g., GDPR), we ensure appropriate safeguards are in place for international transfers, such as Standard Contractual Clauses or adequacy decisions recognized by the European Commission or UK government. 12. CALIFORNIA PRIVACY RIGHTS — SUPPLEMENTAL NOTICE (CCPA / CPRA) Categories of personal information collected in the preceding 12 months: - Identifiers: name, email address, IP address - Personal records: date of birth, phone number, country/state - Commercial information: subscription status and payment history - Internet or network activity: site usage data and browser information - Geolocation data: country and state/province only (no precise location) We collect this information for the business purposes described in Section 4. We do not sell or share personal information for cross-context behavioral advertising. For California privacy requests, contact us at [email protected] with the subject line "California Privacy Request." 13. CHANGES TO THIS PRIVACY POLICY We may update this Privacy Policy from time to time. We will notify registered users of material changes by posting a notice on the site or by email. The updated policy will take effect when posted. Your continued use of TCS after changes are posted constitutes your acceptance of the updated Privacy Policy. 14. CONTACT US If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: The Collecting Site Email: [email protected]