Privacy Policy
1. Summary
We collect only what is needed to prepare your Dossier, keep it encrypted, never sell or share it for marketing, and delete source files after delivery unless you ask us to keep them.
2. What we collect
- Enquiry data: if you request a recommendation: name, email, tier, approximate number of pieces, categories, purpose, and optional notes.
- Client Materials: images and documents you upload about your items (e.g. photographs, receipts, certificates, serial numbers).
- Order data: name, email and phone number collected at checkout, the commission purchased, and its status.
- Payment data: processed by Stripe. We receive confirmation and limited billing details, not full card numbers.
- Site data: basic server logs kept by our hosting provider. We use no analytics or advertising cookies. Your private upload page stores an unsent draft of your item notes in your own browser until you submit it.
We do not require your home address or the location of your items.
3. How we use it
- To recommend a commission and communicate with you.
- To prepare, deliver, revise and (if subscribed) refresh your Dossier.
- To process payments and meet legal, tax and accounting obligations.
We do not use Client Materials to advertise, and we do not identify clients or describe their collections in any marketing.
4. Software and AI processing
We use software tools, including AI services, to catalogue documents and prepare drafts. Client Materials may be processed by these providers solely to deliver the service, under terms that [TODO: confirm per vendor] prohibit use of your data to train their models. Every Dossier is quality-checked before delivery.
5. Sharing
We do not sell or rent personal information. We share it only with service providers acting on our behalf (payment processing, encrypted file storage, email, AI processing) under confidentiality obligations, or where required by law. Current providers: Stripe (payments), Cloudflare (website hosting, encrypted file storage and email forwarding), and [TODO: confirm AI processing provider(s)].
6. Security
Client Materials are exchanged through a private upload page reachable only by a unique, unguessable link issued to you after purchase. They are encrypted in transit and at rest, and access is limited to the systems and operator preparing your Dossier. Anyone who holds your link can view that page, so please keep it private. No system is perfectly secure; we will notify you of any breach affecting your data as required by law.
7. Retention
- Client Materials: deleted automatically 30 days after delivery, unless you request retention for the Annual Refresh. If nothing is submitted, uploads are deleted 30 days after your upload link expires (45 days after purchase).
- Delivered Dossier: a copy retained for 12 months to support revisions and re-downloads, then deleted, unless you hold an active Annual Refresh.
- Billing records: retained as required by tax law.
8. Your rights
You may request access to, correction of, or deletion of your personal information at any time by emailing concierge@collectiondossier.com. Depending on where you live (e.g. California, EU/UK), you may have additional rights; we honour them. [TODO attorney: CCPA/GDPR specifics if applicable.]
9. Children
The service is not directed to anyone under 18.
10. Changes and contact
We will post updates here with a new date. Contact: Tomas Baker, doing business as Collection Dossier · concierge@collectiondossier.com.