Privacy Policy
1. An overview of data protection
General information
The following information will provide you with an easy to navigate overview of what will happen with your personal data when you visit this website. The term “personal data” comprises all data that can be used to personally identify you.
Data recording on this website
Who is the responsible party for the recording of data on this website?
The data on this website is processed by the operator of the website, whose contact information is available under section “Information about the responsible party” in this Privacy Policy.
How do we record your data?
We collect your data as a result of your sharing of your data with us. This may, for instance be information you enter into our contact form.
Other data shall be recorded by our IT systems automatically or after you consent to its recording during your website visit.
What are the purposes we use your data for?
A portion of the information is generated to guarantee the error free provision of the website. Other data may be used to analyze your user patterns.
What rights do you have as far as your information is concerned?
You have the right to receive information about the source, recipients, and purposes of your archived personal data at any time without having to pay a fee for such disclosures.
Analysis tools and tools provided by third parties
There is a possibility that your browsing patterns will be statistically analyzed when your visit this website.
2. Hosting and Content Delivery Networks (CDN)
External Hosting
This website is hosted externally. Personal data collected on this website are stored on the servers of the host.
We are using the following host:
Vercel Inc.
c/o EDPO
Avenue Huart Hamoir 71
1030 Brussels
Belgium
Data processing
We have concluded a data processing agreement (DPA) for the use of the above-mentioned service.
Cloudflare
We use the “Cloudflare” service provided by Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA.
3. General information and mandatory information
Data protection
The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations.
Information about the responsible party
The responsible party for data processing on this website is:
Kollekto GmbH
Ostdorf 15
59069 Hamm
Phone: +49 170 436 7790
Email: admin@kollekto.de
Storage duration
Unless a more specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for which it was collected no longer applies.
SSL or TLS encryption
For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption.
4. Recording of data on this website
Cookies
Our websites use so-called “cookies”. Cookies are small data packages and do no harm to your device.
Server log files
The provider of this website and its pages automatically collects and stores information in so-called server log files.
Contact form
If you submit inquiries to us via our contact form, the information provided in the contact form will be stored by us.
Registration on this website
You have the option to register on this website to be able to use additional website functions.
Registration with Google
Instead of registering directly on this website, you have the option to register using Google. The provider of this service is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
5. Analysis tools and advertising
Google Analytics
This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
6. Plug-ins and Tools
Google Fonts (local hosting)
This website uses so-called Google Fonts provided by Google for the uniform display of fonts. The Google Fonts are installed locally.
Google reCAPTCHA
We use “Google reCAPTCHA” on this website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
7. eCommerce and payment service providers
Processing of Customer and Contract Data
We collect, process, and use personal customer and contract data for the establishment, content organization, and amendment of our contractual relationships.
Payment services
We integrate payment services from third-party companies into our website.
Stripe
The provider for customers in the EU is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.
8. Kollekto Mobile App
This section supplements the notes above for the use of the Kollekto mobile app (iOS and Android). The responsible party is Kollekto GmbH as specified in section 3.
8.1 Account creation and authentication
Using the app requires a Kollekto account. You can register and sign in three ways:
- Email + password: we store your email and a salted hash of your password to recognise you next time.
- Sign in with Apple: Apple sends us an identifier and — with your consent — your name and email. Apple lets you use a relay email; in that case we only see the anonymised relay address.
- Sign in with Google: Google sends us an identifier, your Google profile email and optionally your profile picture.
Legal basis: Art. 6(1)(b) GDPR (contract performance).
8.2 Profile data
You can optionally set a display name, a username, and a profile picture in the settings. These details are visible to other collectors in trade and chat contexts.
8.3 Collection data
Which stickers you own, hold as duplicates or need is stored per album in our database. By default this information is visible to other app users for trade matching. You can disable visibility at any time in the app settings (“Collection private”).
If you submit sticker photos, they are stored in encrypted storage and shown to all collectors as the image for that sticker once approved by our moderators.
8.4 Chat and messaging
When you message other collectors via the trade feature, your messages and trade offers are stored in our database so the app can show the history. Messages are only visible to the conversation participants and to our moderation team.
8.5 Content moderation, reporting and blocking
You can report other users (harassment, spam, inappropriate content, fake collection) and block users. Reports are stored with a timestamp, reason, the reported content and an optional note, and triaged manually. Blocks are symmetric — once you block someone, neither side sees the other in trade lists or chat.
8.6 Push notifications
If you allow push notifications, the app registers an anonymous device token with Expo's push service (see 8.8) and stores it against your profile so we can deliver new chat messages directly. You can disable push at any time in your iOS / Android system settings.
8.7 Backend (Supabase)
All app data (auth, profile, collection, chat, storage uploads) is processed via the Supabase cloud platform (Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992). Supabase acts as a data processor under Art. 28 GDPR. We have a corresponding data processing agreement and Standard Contractual Clauses in place. Hosting region is the EU (Frankfurt).
8.8 OTA updates and push relay (Expo)
The app uses Expo (Expo Inc., 650 Castro Street Suite 120-219, Mountain View, CA 94041, USA) for over-the-air software updates and as a relay for push notifications. Expo may process the app version, your device token and technical diagnostic data. A data processing agreement (DPA) is in place with Expo.
8.9 Account closure and deletion
You can permanently delete your account at any time from within the app via “Settings → Permanently delete account”. This irreversibly removes your profile, collection entries, messages and any other data linked to your account. Reported content remains in anonymised form until the moderation review is closed, after which it is also deleted.
8.10 What we do NOT collect
The Kollekto app does not request your location, does not read your contacts or calendar, and does not use any tracking or advertising identifiers (no IDFA access). No external analytics library (Google Analytics or similar) is integrated.