Privacy Policy

Information you provide directly

• Contact details such as name, email address, phone number, and shipping address.
• Artwork preferences, sizing requirements, and framing selections supplied by you.
• Payment information (processed securely by our PCI-compliant payment providers).
• Support communications, feedback, and marketing preferences.

Information collected automatically

• Device telemetry from collection stations, including firmware version, sensor calibration status, and anonymized session identifiers.
• Technical logs and analytics from our web and mobile applications (IP address, browser type, operating system, referring pages, usage timestamps).
• Firebase Messaging may initialize automatically in our mobile applications and collect a Firebase Installation ID and FCM registration data before you choose whether to enable notifications. Google processes this information as our service provider to operate message delivery infrastructure.
• After notification registration, we store the APNs or FCM push token associated with your app installation and account so we can deliver requested account, transaction, and security notifications. These tokens are device or other identifiers, may be refreshed by the mobile platform, and are deleted from your account when you sign out or delete your account.
• AI capture artifacts such as anonymized feature vectors used to improve measurement accuracy.
• Location data (general geographic region inferred from IP address; precise location only with your consent).

Information from partners

• Order fulfillment updates from gallery labs and shipping carriers.
• Identity verification and fraud-prevention signals from payment providers.
• Gallery account data (e.g., authorized curators, location information) from our business partners.

• Image-derived geometry data is processed in real-time to extract measurement coordinates; raw images are not stored after processing unless you explicitly consent to save a reference photo.
• We do not use facial recognition for identification purposes. The geometry data extracted is used only for sizing and placement workflows.
• If you are in Illinois, Texas, Washington, or another state with biometric privacy laws, we will obtain informed consent when required and comply with applicable retention and destruction requirements.
• You may request deletion of any stored geometry data by contacting privacy@collectapro.com.

Types of cookies we use

• Essential cookies: Required for basic site functionality (authentication, shopping cart, security).
• Functional cookies: Remember your preferences such as language and display settings.
• Analytics cookies: Help us understand how visitors interact with our services so we can improve the user experience.

Your cookie choices

• Most browsers allow you to block or delete cookies through settings. Note that blocking essential cookies may impair site functionality.
• We honor Global Privacy Control (GPC) signals where required by law.
• We do not respond to "Do Not Track" browser signals as there is no industry-standard interpretation, but we do not track users across third-party websites for advertising purposes.

• Delivering core services: providing vision measurements, processing artwork orders, and managing collector sessions.
• Maintaining platform integrity: diagnosing issues, monitoring for abuse, auditing access, and ensuring device safety.
• Improving experiences: training and validating AI models, calibrating collection sensors, and conducting user research with de-identified data.
• Communicating with you: sending transactional updates, responding to support requests, and delivering marketing communications (where permitted).
• Complying with legal obligations: responding to lawful requests, maintaining records as required, and protecting our legal rights.

Service providers

• Art handlers that prepare your artwork.
• Payment processors (such as Stripe) that handle transactions securely.
• Shipping carriers that deliver your orders.
• Cloud infrastructure providers that host our platform.
• Analytics services that help us improve our products.

Other disclosures

• With professional advisors (lawyers, auditors) under confidentiality obligations when necessary to protect our business.
• With government authorities or law enforcement when required to comply with applicable laws or lawful requests.
• With corporate affiliates or in connection with a merger, acquisition, or sale of assets, subject to appropriate protections.

• Account information: Retained while your account is active and for a reasonable period afterward to handle inquiries.
• Order and provenance data: Retained for seven (7) years to support warranty claims, regulatory requirements, and potential disputes.
• Log and analytics data: Retained for up to twenty-four (24) months unless extended for security or auditing purposes.
• Marketing preferences: Retained until you unsubscribe or request deletion.
• Image-derived geometry data: Deleted within 3 years of collection or upon your request, whichever is sooner, unless required for an ongoing transaction.

Rights that may be available to you

• Right to know: Request information about what personal data we collect, use, and disclose.
• Right to access: Obtain a copy of your personal information.
• Right to correction: Request correction of inaccurate personal data.
• Right to deletion: Request deletion of your personal information, subject to legal exceptions.
• Right to portability: Receive your data in a structured, machine-readable format.
• Right to opt out: Opt out of the sale or sharing of personal information (we do not sell your data).
• Right to limit use of sensitive data: Restrict processing of sensitive personal information.
• Right to non-discrimination: Exercise your rights without facing discriminatory treatment.

How to exercise your rights

• Submit a request by emailing privacy@collectapro.com with sufficient details to identify you.
• We will verify your identity (or the identity of your authorized agent) before fulfilling any request.
• We will respond within the timeframe required by applicable law (typically 45 days) and explain any denial or limitation placed on your request.
• You may designate an authorized agent to submit requests on your behalf with proper verification.

• We do not sell personal information as defined by the CCPA.
• We do not share personal information for cross-context behavioral advertising.
• You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• You may request deletion of personal information we have collected from you.
• You may request correction of inaccurate personal information.
• We will not discriminate against you for exercising your CCPA rights.
• California residents under 16 years of age may not create Collecta accounts; any supervised use must occur through an adult account controlled by a parent or legal guardian.

• Nevada residents: We do not sell your personal information. If you have questions, contact us at privacy@collectapro.com.
• We honor opt-out preference signals such as Global Privacy Control (GPC) where required by applicable law.
• If we deny your privacy request, you may appeal by contacting us. We will respond to appeals within the timeframes required by your state's law.

• SMS data is used only for transactional messages such as MFA codes, account notices, and order updates. Message frequency varies and standard message/data rates may apply.
• Reply STOP to opt out or HELP for assistance at any time, or contact support to revoke consent. SMS consent is not required to complete a purchase, and you will continue to receive email updates even if you opt out of texts.
• We do not share your phone number with third parties for their marketing purposes.

• Encryption of data in transit (TLS 1.2+) plus authenticated private storage paths and signed download links for sensitive files.
• Role-based access controls, multi-factor authentication support, and least-privilege policies for employees and partners.
• Secure application and device hardening practices, environment separation, and operational monitoring.
• Continuous vulnerability monitoring, dependency review, and incident response playbooks.
• Regular security training for all employees with access to personal data.
• Data breach notification procedures in compliance with applicable laws.