This Privacy Policy explains how Colmanac Limited ("Colmanac", "we", "us", or "our") collects, uses, discloses, retains, and protects personal data when you use Colmanac through our website, iOS app, Android app, account system, subscription features, communications, support channels, and related services (together, the "Service").
This Policy applies worldwide and is intended to address UK GDPR, EU GDPR, PECR/ePrivacy, US state privacy laws, App Store, Google Play, and similar transparency requirements. Please also read our Terms of Use, Cookie & Similar Technologies Policy, and Disclaimer.
1. Controller and Contact
Colmanac Limited is the controller of personal data we process for the Service, except where a third-party provider acts as an independent controller for its own services, such as Apple, Google, Stripe, marketplace partners, or other third-party sites you choose to use.
2. Personal Data We Collect
Account and profile data: name, email address, authentication and session identifiers, password hashes handled by our authentication provider, account settings, country, currency and sales-country preferences, marketing preferences, legal agreement records, and account status.
Collection, watchlist, and app content data: items you add, item identifiers, custom prices, notes, quantities, watchlist state, feature settings, saved preferences, and related metadata needed to provide requested features.
Scanner and image data: camera permission state, local scan results, derived model outputs needed for matching, and profile images you choose to upload. Raw camera frames and card photos used for scanner matching are intended to stay on-device unless you separately choose to upload an image for another feature.
Usage, device, and diagnostics data: IP address, device and browser type, operating system, app version, identifiers, pages/screens viewed, interactions, errors, performance events, approximate location derived from IP, security logs, and similar technical data.
Optional analytics data: when you enable analytics, Google Analytics is used on web and Google Analytics for Firebase may be included in our iOS and Android apps. It may process a pseudonymous browser or app-instance identifier, IP-derived approximate location, device, browser and app information, page or screen views, app lifecycle and product interactions, referral information, and purchase or subscription events. We configure Colmanac analytics without Google Signals, advertising identifiers, ad personalization, or an account-level analytics user ID. We do not deliberately send your email address, account name, search terms, URL query strings, collection or watchlist contents, or scanner photos and raw camera frames to Google Analytics.
Payment and subscription data: Super purchase status, entitlement status, product identifiers, trial eligibility, renewal/cancellation state, transaction identifiers, country, tax information, refunds, chargebacks, and support metadata. Full card numbers are handled by payment providers and app stores, not stored by Colmanac.
Communications and support data: messages you send us, bug reports, feedback, support requests, email preferences, and related correspondence.
Public, marketplace, and third-party data: public listings, transaction signals, marketplace information, product data, prices, images, set/card metadata, brand references, and other third-party data points that we collect, license, derive, receive, or process to operate the Service.
Cookies, local storage, app storage, SDKs, and similar technologies: information stored on or accessed from your browser or device as described in our Cookie & Similar Technologies Policy.
3. Sources of Data
You, when you create an account, use features, contact us, subscribe, or adjust preferences.
Your browser, device, operating system, app store, payment provider, and network when you use the Service.
Service providers that help with hosting, authentication, analytics, payments, email, security, support, and product operations.
Public, marketplace, affiliate, licensed, commercial, and third-party sources that provide collectible-related data points.
4. How We Use Data and Legal Bases
Provide the Service: create accounts, authenticate users, run collections, watchlists, scanner matching, price guides, dashboards, subscriptions and support, and resolve requested currency, sales-country and similar display preferences before delivering a web page. Legal basis: contract and legitimate interests.
Protect accounts, users, and Colmanac: security monitoring, abuse prevention, fraud detection, rate limiting, debugging, legal audit trails, and enforcement. Legal basis: legitimate interests and legal obligations.
Improve and develop the Service: diagnose issues, measure performance, improve data quality, improve models and matching, test features, and create aggregated or de-identified insights. Legal basis: legitimate interests and, where required, consent.
Operate analytics, advertising, affiliate, and campaign measurement: measure product usage, marketing performance, referral attribution, ad effectiveness, and partner conversions. Legal basis: consent where required and legitimate interests where permitted.
Communicate with you: service notices, verification emails, security alerts, billing/subscription notices, support replies, product updates, and marketing where permitted. Legal basis: contract, legitimate interests, consent, and legal obligations.
Comply with law and enforce rights: maintain tax, accounting, consumer, privacy, app-store, subscription, dispute, and legal records; respond to lawful requests; and enforce our Terms. Legal basis: legal obligations and legitimate interests.
For UK, EU, and EEA users, we rely on contract, legitimate interests, consent, and legal obligations as described above. Where we rely on legitimate interests, we balance those interests against your rights and freedoms.
5. Data Accuracy, Public Sources, and Derived Outputs
Colmanac uses public, marketplace, user-provided, licensed, and third-party data points. Those sources may be delayed, incomplete, inaccurate, duplicated, misclassified, stale, unavailable, or changed after we process them. Our cleaning, normalization, matching, modeling, valuation, indexing, and enrichment processes are proprietary and may contain errors.
Prices, valuations, indexes, charts, trends, scanner matches, collection values, and other outputs are informational estimates only. They are not guaranteed, may be out of date or incorrect, and should not be relied on as definitive pricing, investment, legal, tax, insurance, lending, appraisal, or purchasing advice.
6. Sharing and Service Providers
Infrastructure, database, auth, storage, and caching providers, including Supabase, Upstash, hosting/CDN providers, and related operational services.
Analytics, ads, attribution, and affiliate providers, including Google Analytics on web, Google Analytics for Firebase in native app versions that include it, affiliate networks, marketplace partners, and similar providers where enabled and permitted.
Payment and subscription providers, including RevenueCat, Stripe, Apple, Google, and related processors, app stores, tax, fraud, and customer-support services.
Email, CRM, support, and communications providers, including Loops or similar tools where configured.
Professional advisers, authorities, courts, regulators, acquirers, successors, or counterparties where necessary for compliance, corporate transactions, legal claims, safety, security, or enforcement.
Aggregated, anonymized, or de-identified information that does not reasonably identify you.
We do not sell personal data for money. Some analytics, advertising, affiliate, or campaign measurement activities may be considered a "sale", "sharing", or targeted advertising under certain US state privacy laws. Where those laws apply, you may opt out through our privacy choices, browser signals such as Global Privacy Control where supported, or by contacting us.
7. International Transfers
We are based in the United Kingdom and use providers that may process data in the UK, EU/EEA, United States, and other countries. Where required, we rely on appropriate safeguards such as adequacy regulations, Standard Contractual Clauses, the UK International Data Transfer Addendum, contractual controls, and provider security measures.
8. Retention
We retain personal data for as long as needed to provide the Service, maintain accounts, operate subscriptions, preserve security and legal audit trails, comply with law, resolve disputes, enforce agreements, and maintain business records. Retention periods vary by data type, legal requirement, account status, and operational need.
If you delete your account or request deletion, we will delete, anonymize, or de-identify personal data unless retention is required or permitted for legal, tax, accounting, fraud prevention, security, dispute, chargeback, app-store, or legitimate business reasons. We may retain aggregated, anonymized, or de-identified data.
9. Security
We use technical and organizational safeguards intended to protect personal data, including access controls, encrypted transport, provider security controls, credential protection, server-side handling of secret credentials, audit records, and security monitoring. No online service, app, network, or storage system is completely secure, and we cannot guarantee absolute security.
You are responsible for keeping your login credentials secure, using strong passwords, maintaining control of your devices and email account, and notifying us promptly about suspected unauthorized access.
10. Your Rights and Choices
Depending on your location, you may have rights to access, correct, delete, port, restrict, or object to processing of personal data; withdraw consent; opt out of sale, sharing, targeted advertising, or profiling where applicable; and appeal certain privacy decisions. UK/EU/EEA users may lodge a complaint with a supervisory authority.
You can manage account details, marketing preferences, privacy choices, and account deletion through available account settings where provided, or by contacting
[email protected]. If Colmanac allows account creation in an app store build, the app must include an in-app path to initiate account deletion.
Web users can manage optional cookies and similar technologies through the consent prompt, cookie settings, browser settings, and Global Privacy Control where supported. First-party session and requested display-preference technologies remain available where needed to sign in securely and deliver the choices the user requests; browser controls can remove them, but doing so may sign the user out or reset those choices. Native app users can use in-app privacy choices where available and operating-system privacy settings. Google Analytics remains off unless analytics is enabled. Turning analytics off stops future collection; on web we also remove known Google Analytics cookies, and native versions that include Firebase Analytics reset the on-device analytics identifier.
We may need to verify your identity before fulfilling a rights request. We will not discriminate against you for exercising applicable privacy rights, but some features may not work without data needed to provide them.
11. Children
Colmanac is intended for users 18 and older and for individuals who can form binding contracts. If you are under 18, use Colmanac only with involvement and consent of a parent or guardian. We do not knowingly collect personal data from children under the age required by applicable law. Contact us if you believe a child provided data.
12. Third-Party Sites, Stores, and Services
The Service may link to marketplaces, app stores, payment providers, advertisers, affiliate partners, social platforms, analytics providers, and other third parties. Their privacy practices, terms, prices, listings, fulfillment, refunds, data accuracy, and security are their responsibility, not ours. Review their policies before using them.
13. Changes
We may update this Privacy Policy. Material changes will be indicated by updating the effective date and, where required, by additional notice. Continued use of the Service after changes take effect means you accept the updated Policy where permitted by law.
14. Contact
Colmanac Limited
Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ