Privacy policy

Last updated: 1 August 2026

Who is responsible for your data

GAZIA CONSULTING LTD, Efesou 9, 5280 Paralimni, Famagusta, Cyprus, is the data controller. For anything in this policy, write to hi@gazia.ai.

What we collect and why

Your account. Email address, username, and password (stored hashed — we never see it). If you sign in with Google, we receive your email address and name. We need this to give you an account and keep your shelf attached to you. Legal basis: performance of a contract.

Your profile. Display name, home city, country, bio and avatar. All optional. Legal basis: consent, withdrawn by clearing the fields.

Your collection. Which pieces you mark as owned, wanted or spare, along with condition and notes. This is the service itself. Aggregated and anonymised, it also produces the rarity figures shown across the site — those show how many collectors hold a piece, never who. Legal basis: performance of a contract.

Photos you upload. Stored with a reference to your account so we can credit you. Legal basis: performance of a contract. Photo licensing is covered in the Terms of use.

Trade messages. Messages exchanged within a trade proposal, retained so both sides have a record. Legal basis: performance of a contract.

Technical logs. IP address, browser type and timestamps, kept briefly to keep the service running and to detect abuse. Legal basis: legitimate interest.

We do not collect phone numbers. We do not use tracking or advertising cookies. We do not sell data, and we do not share it with advertisers.

Who processes it

Supabase provides our database, authentication and file storage, acting as our processor under a data processing agreement, with data hosted in the European Union. Our hosting provider serves the site and handles the technical logs described above. Nobody else receives your data unless the law requires it.

How long we keep it

Your account data stays for as long as your account exists. Delete your account and we remove your profile, your collection records and your uploaded photos within 30 days. Technical logs are kept for 90 days.

Two exceptions, both narrow. Where one of your photos was chosen as a catalogue photograph, the image is removed but the fact that the item was documented remains, without your name. Records of completed trades are kept in anonymised form so that other users' trade histories stay intact.

Your rights

You can access, correct, delete, export, or restrict the processing of your data, and you can object to processing based on legitimate interest. Most of this is available directly in your account settings; for anything else, email hi@gazia.ai and we will respond within one month.

You can also complain to a supervisory authority. Ours is the Office of the Commissioner for Personal Data Protection of Cyprus. If you live elsewhere in the EU you may instead complain to your own national authority — in Spain, the Agencia Española de Protección de Datos.

Children

CollectMap is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has an account here, write to hi@gazia.ai and we will remove it.

Changes

If we change this policy we will update the date above and, for anything significant, tell you by email before it takes effect.