Privacy policy

Who operates Collector Showplace

Collector Showplace is operated by Cathy Shapiro, based in Tennessee, United States. Contact [email protected] for privacy questions, requests or further information about the operator. This notice covers visitors, members and workspace collaborators.

Information we collect

We handle your name, email address, username, sign-in identifiers, workspace membership, preferences and trial information. Email-code sign-in verifies access to your inbox. Google and Facebook supply an account identifier and permitted profile information; we do not ask for your Google or Facebook password. Facebook sign-in is being configured and is not yet publicly available.

We store collection records, photographs, documents, notes, values, contact details, provenance and other information you or your authorized collaborators submit. Support emails, import files and AI requests may also contain personal information. Only upload information you have permission to use.

We process technical and security information such as sessions, network/browser signals, request and error details, usage counts and AI cost metadata. Payment providers process payment information when billing is used. Current Stripe tests use sandbox payments; real charges remain disabled.

How we use information

We use information to provide and secure accounts, store and organize collections, manage permissions, process requested imports and exports, display content you publish, provide AI assistance, send service notices and respond to support requests. Optional marketing preferences are separate from necessary account messages.

Where applicable, we rely on performing the service you request, legitimate interests in security and reliable operation, consent for optional communications or other processing requiring consent, and legal obligations. Contact us to ask about the basis for a particular use or to withdraw consent; withdrawal does not affect earlier lawful processing.

Private collections and public websites

Workspace records are restricted to authorized users unless you choose to publish content. Public collections show selected fields and photographs; private notes, acquisition costs and document attachments are not automatically published. Review text and images before publishing. Other people may copy public information, and unpublishing cannot recall their copies.

Administrators and service providers may access information as needed for support, maintenance, security, recovery or legal obligations. Private workspaces are not end-to-end encrypted. Revoking access does not erase copies previously downloaded by a collaborator.

AI assistance and service providers

AI assistance sends the conversation and information needed for the requested feature to OpenAI and/or TypeSafe/Jev. Import assistance may include spreadsheet headers, sample rows, descriptive fields, source material and mapping discussions. General help does not automatically receive your entire collection. Import discussions, proposals, accepted changes and usage records may be stored. Do not send passwords or unnecessary sensitive information to AI tools.

We use Railway for hosting and databases, Backblaze for offsite backups, Cloudflare for traffic protection and Turnstile, Google for sign-in and business email, Resend for service emails, OpenAI and TypeSafe/Jev for AI features, and Stripe for billing tests and future payments. When enabled, Facebook Login uses Meta. Providers process information needed for their services under their own applicable agreements. AI requests are not a promise of zero provider retention.

We may disclose information when required by law, to protect rights and security, or as part of a business transfer with applicable safeguards and notices. We operate in the United States; providers may process data in other countries. Contact us for information about the providers and safeguards relevant to your data.

Cookies and security

We use session, sign-in, trial and security cookies to keep you signed in, verify requests and prevent abuse. The public assistant uses a visitor identifier for usage limits. Cloudflare and Turnstile process browser and connection signals. Blocking necessary cookies can prevent sign-in and other features from working.

We use access controls, secure connections, backups and abuse protections. No service can guarantee absolute security. Tell us promptly if you suspect unauthorized access.

Retention and deletion

Collection information is retained to provide the service until you delete it or an applicable account-retention process applies. Archiving is not deletion. Permanent item deletion initiates removal of associated records, photos and documents; cleanup failures may require retries. Trial expiration and automatic deletion are currently paused. The trial policy explains the planned schedule when those controls are enabled.

Account deletion requests are handled by the operator. Limited records may remain where needed for security, legal obligations, shared-record integrity or trial-abuse prevention. Backups do not disappear immediately when live records are deleted. Our offsite backups do not currently have automatic age-based pruning, so we do not promise complete erasure from every backup within a fixed number of days. We will explain retained information and any remaining limitations when responding to your request.

Your choices and rights

You can edit permitted records, choose what to publish, export information and permanently delete individual items. Email [email protected] to request account deletion, access, correction or other privacy assistance. We may verify your identity proportionately; do not send your password. See Data deletion instructions for the steps.

Depending on applicable law, you may have rights to access, correction, deletion, portability, restriction or objection and to complain to a data-protection authority. Mandatory rights are not removed by these policies. If another workspace owner controls the information, we may need to coordinate with them. We respond within applicable legal deadlines and explain any permitted extension or exception.

The service is not directed to children. Contact us if you believe a child has provided personal information improperly. We will update this page when practices change and provide additional notice or obtain consent where required.