Data practices
Privacy Policy
Effective September 1, 2026 · Version 2026-09-01-v3
This Policy explains how Collectible 101 handles information across accounts, social features, dealer tools, listings, payments, shipping, live events, analytics, authentication, disputes, and security.
1.Scope and roles
This Policy applies to Collectible 101 services. Independent dealers, payment providers, carriers, insurers, video platforms, and other integrated services may separately determine how they process information under their own notices.
2.Account information
We process identifiers and profile information such as name, display name, email, role, account status, credentials or authentication tokens, privacy choices, interests, and account settings. Passwords are handled through protected authentication systems rather than displayed to other users.
3.Transaction and commercial information
We process listings, offers, bids, purchases, subscriptions, invoices, payout references, payment status, taxes, shipping charges, insurance details, refunds, disputes, and related records. Payment providers process full payment credentials; we receive references and status information needed to operate and evidence transactions.
4.Shipping and identity information
We process recipient name, delivery address, phone number where supplied, carrier, service, package details, tracking, signature, delivery status, and insurance or claim information. Dealers, carriers, insurers, and administrators receive the information reasonably necessary to fulfill or resolve a transaction.
5.Collectible and provenance data
We process photographs, descriptions, serial and reference details, provenance, authentication materials, condition information, certifications, ownership or source records, and inspection results. Some listing and registry information may be public; sensitive source or buyer records are restricted according to the feature.
6.Social and communication data
Posts, profiles, follows, likes, comments, polls, circles, messages, reports, livestream participation, bids, and other interactions are processed to provide community features. Public content can be viewed, copied, or reshared by others. Private communications may be accessed when needed for safety, support, disputes, or legal compliance.
7.Device and usage data
We may process IP address, browser and device details, timestamps, session identifiers, pages viewed, searches, clicks, feature use, referral information, approximate location derived from IP, and diagnostic events. Precise location is used only when a feature requests it and permission is granted.
8.Cookies and local storage
Cookies, local storage, session storage, and similar technologies support login, security, preferences, checkout continuity, performance, analytics, and fraud prevention. Browser controls may limit these technologies, but essential features may then stop working.
9.How information is used
We use information to provide and personalize the service; authenticate users; process and evidence transactions; route payments; fulfill shipping; operate social and live features; provide alerts; support users; prevent fraud; enforce policies; moderate content; improve reliability; comply with law; and protect users, dealers, Collectible 101, and the public.
10.Automated marketplace systems
Submitted text, images, files, listings, and relevant context may be processed by automated systems to generate search results, summaries, recommendations, images, risk signals, moderation decisions, estimates, or authenticity-support output. Automated output may be reviewed and should not be treated as professional advice or guaranteed fact.
11.Information sharing
We share information with the dealer or buyer involved in a transaction; payment, shipping, insurance, authentication, hosting, communications, analytics, security, and professional-service providers; connected services chosen by the user; authorities or affected parties when legally required or reasonably necessary to protect rights; and a successor in a lawful business transaction.
12.No sale of personal information
Collectible 101 does not sell personal information for money. We do not knowingly share personal information for cross-context behavioral advertising as those terms are defined by certain privacy laws. If practices change, this Policy and any required controls will be updated.
13.Legal bases
Depending on location, processing may rely on performance of a contract, legitimate interests in operating and securing the marketplace, compliance with legal obligations, protection of vital or legal interests, and consent where required. Consent may be withdrawn prospectively where consent is the legal basis.
14.Retention
Information is retained for as long as reasonably necessary for accounts, transactions, tax and financial records, shipping, warranties, disputes, insurance, fraud prevention, safety, legal obligations, and enforcement. Public content may remain in backups or evidence records after deletion where lawful and necessary.
15.Security
We use administrative, technical, and organizational safeguards appropriate to the service and information. No online system is completely secure. Users must protect credentials, devices, access codes, and recovery methods and promptly report suspected compromise.
16.International processing
Information may be processed in countries other than the user's country. Where required, we use lawful transfer mechanisms and safeguards. Local authorities may have access rights under applicable law.
17.Children
The service is not directed to children under 13, and transaction features are not intended for anyone who cannot legally contract. If we learn that prohibited child data was collected, we may delete it and restrict the account.
18.Privacy choices and rights
Account settings provide certain profile, wishlist, purchase-history, and communication choices. Depending on law, a person may request access, correction, deletion, portability, restriction, objection, or appeal. Requests may be submitted through the account or report/support tools and may require identity verification.
19.Transaction and legal records
Some records cannot be deleted immediately because they are required for payment, tax, dispute, fraud, insurance, shipping, legal, or security purposes. Acceptance evidence includes policy version, timestamp, user and transaction references, IP address, device information, and a document digest so the accepted terms can be identified later.
20.Dealer, staff, and business records
Dealer applications and operations may involve legal and business names, email, phone, business address, website, social handle, specialties, selling experience, references, category enrollment, staff permissions, subscription status, connected payment-account identifiers and capabilities, payout status, inventory, performance, trust, dispute, withdrawal, and compliance records. Access codes and credential verifiers are protected and are not displayed as ordinary public profile information.
21.Membership, preference, and discovery records
We process membership tier and status, renewal and change dates, shopping interests, watchlists, saved searches, wants, follows, favorites, circles, profile-visibility choices, discovery interactions, and alert settings to provide subscribed features, personalize feeds and live content, and deliver requested availability or price notifications.
22.Sourcing and uploaded-file records
Custom sourcing may process a buyer's category, budget, condition, package preference, desired model, reference or serial criteria, notes, uploaded reference photograph, digitally generated reference image, generated dealer brief, matched dealer count, offers, messages, and resulting order records. Other uploaded images, audio, documents, inspection evidence, and private files are processed for the feature selected. Private files may use time-limited access links, while public listing media may remain publicly reachable.
23.Visibility and recipient controls
Public listings, dealer storefronts, public profiles, posts, comments, live events, and selected ownership or provenance facts are intentionally disclosed to service users or the public. Buyer identity for sold-item intelligence, private vault records, private sourcing listings, negotiation content, shipping addresses, payment references, internal administrative notes, and nonpublic authentication evidence are restricted by role and transaction context. Visibility settings reduce platform disclosure but cannot retract copies lawfully made by recipients.
24.Communications and notifications
We process contact information, recipient identifiers, message content, delivery status, notification preferences, and event context to send account, transaction, negotiation, sourcing, watchlist, follower, auction, giveaway, dealer, security, and policy communications. Registered users may receive platform email; mobile push is used only where a native app and permission are configured. Operational messages may be necessary to perform a contract or protect an account and may not be fully suppressible.
25.Service providers and data processors
Infrastructure, authentication, hosting, file storage, database, email, automated processing, analytics, payment, video, shipping, insurance, security, and support providers process information under their own contractual and legal obligations. We provide only information reasonably necessary for the service involved. Full card numbers and card security codes are handled by payment providers rather than stored in Collectible 101 marketplace records.
26.Deidentification and aggregated analysis
We may aggregate or deidentify information to measure category demand, pricing, conversion, trust, marketplace health, fraud patterns, feature performance, and business operations. We take reasonable measures not to reidentify information maintained as deidentified and may use and disclose aggregated or deidentified information where permitted by law.
27.Automated decisions and human review
Automated tools may prioritize content, identify suspicious activity, estimate price or grade, generate imagery or text, match requests to dealers, moderate content, or recommend enforcement. Material outcomes may also depend on human review, provider decisions, documentary evidence, and applicable law. Where a legally required right to explanation, review, or appeal applies, a request may be made through the available account or support process.
28.Deletion limitations and durable ledgers
Deletion of an account does not necessarily erase records that must be retained for completed or attempted payments, invoices, taxes, payouts, shipping, ownership, provenance, authentication, disputes, fraud prevention, sanctions screening, safety, legal claims, consent evidence, or immutable audit and equity ledgers. Where correction is appropriate, an append-only system may retain the original event and add a superseding or explanatory record.
29.Changes and contact
The effective date identifies the current Policy. Material changes will receive notice or renewed consent when required. Privacy questions and rights requests may be submitted through the in-app account and report/support tools. We may need to authenticate the requester, clarify scope, protect another person's rights, or retain a legally required record before fulfilling a request.
30.Categories of sources
We receive information directly from users; from dealers, buyers, consignors, staff, and other transaction participants; automatically from browsers, devices, cookies, logs, and use of the service; from payment processors, carriers, insurers, authentication providers, video and communications services; from connected services selected by a user; from public sources; and from fraud-prevention, sanctions, identity, analytics, and security providers. Information supplied about another person must be lawfully provided.
31.Identifiers and account credentials
Collected identifiers may include name, display name, username, email, telephone number, postal address, account number, user ID, dealer ID, referral or invitation code, social handle, IP address, device or session identifier, authentication token, passcode verifier, and related account references. We process credential verifiers and authentication events, but do not make passwords or one-time verification codes public.
32.Sensitive and high-risk information
Depending on the feature, we may process precise delivery addresses, identity or business-verification materials, signatures, tax documents, payment and payout references, account security events, private ownership or provenance records, and contents of private files or dispute evidence. We use such information only for the requested feature, transaction, security, compliance, or another legally permitted purpose and restrict access according to role and need.
33.Payment and financial data
Payment providers collect card, bank, billing, and verification information under their own notices. We may receive customer or merchant identifiers, payment intent or checkout references, amount, currency, status, last-four or payment-method descriptors when supplied, invoice, refund, chargeback, subscription, payout, reserve, and reconciliation data. We do not require users to place full card numbers or security codes in messages, listings, or ordinary platform records.
34.Purchases, offers, and marketplace activity
We collect searched and viewed items, favorites, saved searches, watchlists, offers, counteroffers, bids, auction participation, baskets, purchases, cancellations, refunds, source requests, listing interactions, dealer relationships, prices, currencies, fees, tax and shipping calculations, transaction references, and fulfillment status. These records support performance, personalization, fraud prevention, accounting, evidence, and marketplace operations.
35.Media, documents, and technical files
We process photographs, video, audio, livestreams, thumbnails, captions, metadata, scans, certificates, invoices, labels, ownership papers, condition evidence, tax forms, dispute documents, and other files users upload or authorize. Files may reveal location, device, identity, or background information; users should remove unnecessary data before upload. Public media may be copied by viewers, while designated private files use restricted access controls.
36.Location information
We may infer approximate location from IP address and process addresses or routing locations for account security, dealer discovery, delivery, taxes, sanctions, availability, and fraud prevention. A feature that requests device-based or precise location will depend on user permission. Disabling location permissions may limit that feature but does not prevent processing of transaction addresses or approximate network location where otherwise lawful.
37.Livestream, auction, and event information
We process stream identity, schedules, video-platform references, chat, reactions, moderation events, bids, lot activity, queue position, reminders, access restrictions, audience and performance metrics, recordings or archives where enabled, and checkout outcomes. Public participation can be visible to hosts and viewers. Timing and interaction logs may be retained to resolve disputes and enforce event rules.
38.Social graph and community information
We process profiles, biographies, follows, connections, circles, memberships, endorsements, likes, comments, polls, posts, shared collectibles, messages, reports, blocks, moderation history, audience settings, and related engagement. Public profile and post information is intentionally disclosed according to selected settings; recipients may retain copies outside our control.
39.Support, complaints, and dispute information
We collect questions, reports, claim narratives, communications, evidence, witness or expert materials, authenticity and condition opinions, carrier and insurer correspondence, payment disputes, enforcement history, appeal materials, and resolution records. Information may be shared with affected parties and professional or service providers where reasonably necessary to investigate, respond, defend rights, or comply with law.
40.Fraud, integrity, and security information
We process login attempts, credential changes, session history, risk indicators, device and network attributes, unusual activity, duplicate identities, sanctions or restriction signals, moderation events, evidence integrity, transaction anomalies, audit trails, and account enforcement records. We may combine signals across features to identify abuse, protect users, and maintain reliable records.
41.Purposes by category
Identifiers support accounts and communication; commercial records support transactions, fulfillment, accounting, and recommendations; internet and device activity supports security, analytics, and reliability; location supports shipping, tax, fraud, and regional availability; media and collectible data support listings, authentication assistance, provenance, and disputes; communications support social features and safety; and sensitive records support identity, payment, legal, and security functions. We do not use a category for a materially incompatible purpose without notice or another lawful basis.
42.Advertising, measurement, and cross-context tracking
We may measure visits, referrals, campaign performance, and feature engagement using first-party analytics and service providers. We do not state that every browser signal is legally equivalent in every jurisdiction. Where applicable law treats a practice as targeted advertising, sharing, or a sale and requires an opt-out, we will provide or honor the legally required control. Browser settings alone may not block essential security or account technologies.
43.Global Privacy Control and Do Not Track
Because industry responses to Do Not Track are not uniform, the service may not respond to every DNT signal. Where legally required and technically recognized, we treat Global Privacy Control or a comparable universal opt-out mechanism as a request for the browser or device from which it is sent. Account-level verification or additional information may be required to apply a request beyond that browser.
44.United States state privacy disclosures
Residents of certain states may have rights to know or confirm processing, access categories or specific pieces, correct, delete, obtain a portable copy, opt out of qualifying sale, sharing, targeted advertising, or profiling, limit certain sensitive-data uses, and appeal a denial. Rights, exceptions, verification, authorized-agent rules, and response periods vary. We do not discriminate for exercising a right, although a feature may be unavailable when required data cannot lawfully be processed.
45.California notice at collection
The categories described in this Policy may include identifiers; customer records; commercial information; internet or electronic activity; approximate or transaction-related geolocation; audio, electronic, visual, and similar information; professional or employment information for dealer and staff accounts; inferences; and sensitive personal information where a selected feature requires it. We collect and disclose these categories for the purposes and retention considerations stated here. We do not sell personal information for money.
46.EEA, United Kingdom, and similar rights
Where applicable, individuals may have rights of access, correction, erasure, restriction, portability, objection, withdrawal of consent, and complaint to a supervisory authority. Contract processing is necessary to provide requested accounts and transactions; legitimate interests include security, fraud prevention, service improvement, and defense of rights; legal obligations include financial, tax, sanctions, safety, and law-enforcement requirements. Withdrawal of consent does not affect earlier lawful processing.
47.Verification of privacy requests
A privacy request may require confirmation through an account, email, transaction detail, signed declaration, or other proportionate evidence. We may deny or limit requests we cannot verify, that conflict with another person’s rights, seek legally protected material, are manifestly unfounded or excessive, or concern records subject to a lawful exception. Authorized agents may be required to prove authority and the individual may be asked to confirm the request directly.
48.Retention criteria and deletion process
Retention periods depend on record type, account activity, transaction lifecycle, warranty or claim exposure, tax and accounting requirements, payment-provider rules, security needs, limitation periods, legal holds, and backup cycles. Content scheduled for deletion may persist temporarily in backups and may remain in deidentified, aggregated, immutable, or evidentiary records where lawful. We securely delete, anonymize, or restrict information when retention is no longer justified.
49.Limits of privacy and security
No platform can guarantee that information will never be accessed, intercepted, altered, copied, or disclosed without authorization. Collectible 101 is not responsible for a user’s voluntary public disclosure, recipient’s independent use, compromised credentials or devices, third-party practices, or information supplied outside the service, except to the extent responsibility cannot lawfully be excluded. Nothing in this Policy waives statutory privacy rights or duties.