DUCKCOLLECT

duckcollect

Privacy Policy

Effective from 30.07.2026

1. Data controller

  1. The controller of your personal data is Duckcollect (the "Operator").
  2. Contact regarding personal data: [email protected].

2. What we collect and why

  1. Account data: e-mail address, username and password (never stored in plain text) — to provide the Service (contract performance, art. 6(1)(b) GDPR).
  2. Collection data: cards, sealed products, purchase prices, notes and photos you upload (including grading photos) — to provide the Service.
  3. Market data: offers, orders, shipping addresses you enter at checkout, seller payment details (BLIK phone / bank account) you configure, order messages and ratings — to enable transactions between users. Shipping addresses and payment details are shown only to the other party of the order.
  4. Technical data: IP address (rate limiting, abuse prevention — legitimate interest, art. 6(1)(f) GDPR) and standard server logs.
  5. We do NOT use tracking cookies or third-party analytics. The only cookies are session cookies required to sign you in.

3. Recipients

  1. The other party of a transaction sees the data needed to complete it (address, payment details, messages).
  2. Infrastructure providers processing data on our behalf: hosting, e-mail delivery (password resets, verification), and the AI provider (Anthropic) that processes card photos when you request an AI grading — photos are sent for analysis and are not used to train models per the provider’s API terms.
  3. Public content: your public profile, public collection items, offers, grading reports you mark public, and ratings are visible to anyone.

4. Retention

  1. Account data: until you delete your account (profile settings). Deletion removes your data; order snapshots kept by the other party remain (they are that party’s transaction record).
  2. Server logs and backups: rotated and deleted automatically after a short period.

5. Your rights

  1. Access, rectification, erasure, restriction, portability and objection — contact the Operator at the e-mail above.
  2. You can delete your account yourself at any time in the profile settings.
  3. You have the right to lodge a complaint with the supervisory authority (in Poland: Prezes UODO).