Privacy Policy

1. Controller And Contact

The controller for this service is COLLÆCT. For privacy questions or rights requests, contact support@collaect.com.

2. Data We Process

Depending on how you use the app, we may process:

• account details, such as email address, name, credentials, and verification status;
• authentication and security data needed to keep accounts protected and prevent misuse;
• subscription and billing status received from payment providers;
• watchlist, portfolio, and product interaction data that you create or save in the app;
• technical data, such as request logs, device/browser information, error diagnostics, and consent preferences;
• analytics data after consent, such as landing pages, pages visited, estimated active time, referral hosts and campaign labels, external link destinations, approximate region, language, timezone, and device category;
• support messages and any information you choose to include when contacting us.
• a recommendation score and optional reason, if you voluntarily send private app feedback.

Google And Apple Sign-in

If you choose to sign in or connect an account with Google or Apple, we receive the provider's account identifier, email address, email verification status and, where supplied, your name. Apple may provide a private relay email address. We use a verified email address and supplied name to create a new account, and retain the provider's account identifier to recognize you when you sign in again or connect the provider in Security. An email match alone does not connect an existing account.

We process the provider's identity token to verify the sign-in response, but do not retain provider identity, access or refresh tokens. We do not receive your Google or Apple password or request access to your Gmail inbox. We redirect you to the provider only when you choose its sign-in or connection button. The account and provider details are covered by the sharing and retention sections below.

Voluntary App Feedback

Signed-in users can choose to send a recommendation score and an optional comment from Portfolio. This is private feedback for improving the service, rather than a public review or testimonial. It is associated with your account so you can update your response; a new response replaces the previous one. Avoid including sensitive personal information in the optional comment.

Sending feedback does not enable browsing analytics and does not require accepting optional analytics cookies. We do not attach browsing histories or location information to the response. Administrators can view scores, comments, submission times and plan categories; internal accounts are excluded from the feedback report.

Optional Analytics Choices

Optional analytics start only after you accept them. Random browser, visit and tab identifiers help us measure aggregate usage. A visit ends after 30 minutes without qualifying activity. Active time is estimated while the page is visible and recently used; the last observed page and activity time are estimates of where a visit ended.

We do not record session replays, pointer positions, typed keys, form contents, raw search text, private list names or holding values in these analytics. Referrer and external-link information is limited to host names, and sensitive URL parameters are removed. Reports do not show identified users' browsing histories.

You can withdraw optional analytics consent on the cookie preferences page. This stops future collection and clears optional identifiers and unsent events from your browser. Requests already sent cannot be recalled; contact us for questions about previously stored records.

3. Purposes And Legal Bases

We use personal data to:

• create and secure accounts, verify email addresses, and reset passwords;
• provide watchlists, portfolio tracking, saved views, subscriptions, and Pro access;
• process billing, taxes, fraud checks, and account administration;
• protect the app against abuse, unauthorized access, harmful automation, and attacks;
• measure adoption, acquisition channels, page interest, broad region/language/device trends, performance, and reliability when analytics consent is accepted;
• respond to support requests and meet legal obligations.
• review feedback that you choose to submit and improve the service.

The legal bases may include contract performance, legitimate interests in operating and securing the service, consent for optional analytics or similar technologies, and legal obligations where applicable.

4. Sharing And Processors

We share personal data only as needed to run the service. Processor categories may include hosting, infrastructure, security, email, analytics, payment, and customer-support providers, plus professional advisers where necessary. We do not sell personal data.

5. International Transfers

Some providers may process data outside your country or region. Where required, transfers should rely on adequacy decisions, standard contractual clauses, or another appropriate transfer mechanism offered by the provider.

6. Retention

Account data is kept while your account is active. Temporary account and security records expire on short retention periods. Billing and security records may be kept longer where needed for tax, accounting, fraud prevention, dispute handling, or legal compliance.

Completed account deletion removes the profile name, original account email, password, connected Google or Apple identifiers, verification and reset tokens, portfolio, watchlists, feedback and account-linked browsing analytics from the live app. A limited record retains billing references, trial history, account dates and first-week save outcome flags for billing, security and aggregate reporting. This record cannot be used to sign in or restore the deleted portfolio.

Your current voluntary feedback response is retained while your account is active. You can replace it from Portfolio or contact us to request its removal. The response is removed when your account is deleted.

Detailed first-party analytics are kept for 13 calendar months. Before older records expire, monthly statistics can be retained for longer-term comparisons. These summaries use broad page categories and traffic channels, omit account, browser and visit identifiers, round measurements and exclude small groups.

Daily maintenance removes expired detailed analytics, analytics linked to soft-deleted accounts, and expired signup attempts more than 30 days old. Processing is batched, so a large backlog may require additional runs. Aggregate comparisons of deleted and non-deleted accounts use account dates and first-week outcome flags captured before personal save records are removed. These comparisons do not retain the deleted portfolio or individual browsing histories. These analytics are not a permanent billing or account history.

7. Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict, or export your personal data, object to certain processing, withdraw consent, and complain to a data protection authority. You can send requests to support@collaect.com.

8. Security

We use technical and organizational safeguards to protect accounts, limit misuse, and restrict access to personal data. No internet service can be guaranteed completely secure, so please use a strong, unique password.

9. Children

COLLÆCT is not intended for children below the age required to consent to online services in their country. If you believe a child has provided personal data without appropriate permission, contact us.