Privacy & GDPR

Who is responsible

The data controller for your data is the provider of 12Collect:

Cornelis Essaadi
De Duinsloot 31
2211 DP Noordwijkerhout
Chamber of Commerce number: volgt binnenkort
Contact: support@12collect.com

Do you have a question about your privacy or would you like to exercise one of your rights? Email support@12collect.com and we will help you.

What data we process

When you sign up for the waiting list

• your email address;
• your language preference (nl/en), so we email you in the right language;
• the time of sign-up and confirmation.

When you create an account

• your email address (your login name);
• your password, never stored in readable form but encrypted;
• your preferences, such as language, theme and last opened collection;
• usage moments: when your account was created, your last login and last activity, and the moment you agreed to this statement;
• your subscription type (free, plus or pro) and, where applicable, payment details.

You log in with an email address and password, or with your Google account. If you log in with Google, we receive your name and email address from Google to link your account; the privacy policy of Google also applies to that.

The contents of your collection

Everything you enter yourself to record your collection: titles, descriptions, material, dating, dimensions, condition, value and purchase price, tags, references and the photos you upload. This data is yours; we only use it to provide the service to you.

Find-site and location data

For collection types about finds (such as archaeology or metal detecting) you can record a find site, a place name and/or coordinates on the map. You decide whether and how precisely you fill this in.

Technical data

To keep the service secure we temporarily process your IP address (for example against form abuse and login attempts). We only use functional cookies, no third-party tracking, advertising or analytics. See our cookie policy.

Why we process it and on what legal basis

• To provide your account and the service (storing and displaying your collection): on the basis of performing our agreement with you.
• To email you once when you can create an account (waiting list): on the basis of your consent, which you give via the confirmation email and can withdraw at any time.
• To provide AI suggestions when you request them (see below): on the basis of performing the agreement, at your request.
• To secure the service and prevent abuse: on the basis of our legitimate interest in a secure service.

AI features (photo analysis, market value and identification)

12Collect can help you describe an item, identify it or give an indication of its market value. This happens only when you request it yourself by clicking the relevant button, never automatically.

When you request an AI suggestion, we send the relevant photo and the data you have already entered to our AI processor Anthropic, which returns a suggestion based on it. Anthropic processes this data on our behalf to create the suggestion and does not use it to train its own models. Because Anthropic processes outside the EU (United States), this is done with appropriate safeguards (a data processing agreement with EU standard contractual clauses).

AI suggestions are indicative, estimates, not guarantees. You always decide yourself what to accept and save. To manage cost and speed, results may be cached temporarily.

Where your photos are stored

Photos you upload are stored with our storage provider Tigris and downscaled for display. We have configured the storage so that your photos stay within the EU (data centres in Frankfurt and/or Amsterdam). You can delete a photo or an entire item at any time; if you delete your account, we also erase your photos from storage.

Who we share data with

We never sell your data. To run the service we use a number of carefully chosen processors, who process your data only on our behalf and according to our instructions:

• Fly.io, hosting of the application and database (Amsterdam region, EU);
• Tigris, storage of your photos (stored within the EU: Frankfurt and/or Amsterdam);
• Resend, sending emails, such as confirmation and recovery emails (EU);
• Anthropic, the AI suggestions, only when you request them (United States);
• Stadia Maps, the map tiles when you use the map view (processed on EU servers in Frankfurt and Paris);
• Google, only if you choose to log in with your Google account (United States).

Transfers outside the EU

Our application, database, email, photo storage and map tiles run within the EU. Some of our processors are based in the United States; insofar as they process data outside the EEA, this is covered by the EU standard contractual clauses and a data processing agreement. Only the AI feature actually processes data in the United States (at Anthropic), and only when you use that feature yourself.

How long we keep it

• Account data and your collection: as long as your account exists. If you delete your account, we erase your data and photos.
• Waiting-list sign-up: until shortly after launch or until you unsubscribe, whichever comes first.
• Security and error logs: limited, and only for as long as needed for the security and operation of the service.

How we protect your data

Connections are encrypted (https), we store your password only in hashed form, and access to the systems is restricted. The application and database run within the EU.

Your rights

You have the right to access, rectification and erasure of your data, to restriction of and objection to the processing, to portability of your data, and you can withdraw consent you have given at any time. Two of these you can do yourself directly in the app:

• Export: from your account you can download your collection (including as JSON, CSV and ZIP), this covers your right to access and portability.
• Deletion: from your account settings you can permanently delete your account and all associated data.

If you would prefer us to arrange something for you, email support@12collect.com. If you disagree with something, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Cookies

12Collect uses only strictly necessary, functional cookies (for security, your login session and your preferences). Read more in our cookie policy.

Changes to this statement

We may update this privacy statement from time to time, for example when the service changes. The date at the top shows when we last did so. We will let you know of any important changes.