Privacy and KVKK Notice

Your amount and delivery choices are not shown to other buyers. There is no rival price, leaderboard or automatic winner.

The private amount, structured answers, single revision before first opening, seller invitation or counteroffer, and post-acceptance conversation are limited to authorized parties. Support access requires separate authorization and audit; there is no visible price or ranking feed for other buyers.

The data controller for Collectorium is Muhammet Emre Aydın, based in Türkiye. Questions and rights requests may be sent through the secure account route or to contact@collectorium.co. A payment provider or app store may act as a separate controller for the transaction data it independently collects.

This Notice applies to Collectorium's public website, accounts, seller tools, listings, messages, Offer Rooms (earlier model), support and Collectorium digital services. A payment, identity or infrastructure provider may also act under its own notice for the service it independently provides.

We process account and profile details such as name, email, country, language and optional seller/contact information; listing facts, images, location and delivery preferences; messages, offers, private maximums, reports, appeals and support content; and the privacy or communication choices you make.

Do not place passwords, complete payment-card information, unnecessary identity documents, private home addresses or another person's information in listings, messages or support. Payment-card entry, when offered, belongs to the authorised payment provider.

We create records needed to run accounts, entitlements, listings, favourites, enquiries, conversations, notifications, Offer Rooms (earlier model), moderation and security. Technical information may include timestamps, session and browser context, request and network metadata, security results and limited first-party measurement used to keep counts and paid delivery accurate.

We may infer an approximate country from a request to present suitable language, market or pricing context. A visitor's discovery choice does not change the account's server-controlled home-market entitlement.

We use personal data to create and secure accounts; publish and discover listings; provide messages, Offer Rooms (earlier model) and digital entitlements; process support and payment evidence; prevent abuse; investigate reports and appeals; comply with accounting and legal duties; and maintain service reliability.

Under KVKK, processing relies on the applicable conditions in Article 5 and, for sensitive data if ever required, Article 6. Where GDPR applies, the corresponding bases may include performance of a contract, legal obligation, legitimate interests, protection of rights and consent. Notice and explicit consent are separate: consent is requested only for a genuine optional choice and can be withdrawn without affecting earlier lawful processing.

Published listings, storefront names and seller information deliberately made public can be seen by visitors. Private offer amounts, structured answers, revisions, invitations, counteroffers and accepted conversations are limited to authorised participants and operational roles. Earlier Offer Room (earlier model) records retain the privacy and access rules applicable to those records. Email, private phone settings, internal identifiers, direct messages, support records and staff notes are private by default.

Access to private records is granted by server-side role and purpose. Collectorium does not treat hidden browser content as protected merely because it is visually concealed.

Collectorium uses service providers for authentication, database, file storage and realtime delivery (Supabase); edge delivery, network security and anti-abuse checks (Cloudflare); authorised email and support operations (Resend and Google Workspace); social sign-in when you select it (Google or Apple); applicable app-store billing; and user-requested AI listing assistance (OpenAI). No web-payment provider is currently active. An application or technical integration is not merchant approval; the provider and its actual data-processing role will be disclosed before payment becomes available. Provider records required for earlier digital-service rights and payment history remain governed by their original transaction context.

We may also disclose limited data to professional advisers, auditors, insurers, a prospective successor to the business or public authorities when lawfully required. We do not sell personal data or give advertisers access to private account, message or Offer Room (earlier model) information.

For Collectorium digital services, we keep the checkout intent, product, market, price-book reference and entitlement or refund evidence needed to provide access and prevent duplicate fulfilment. The authorised payment provider processes payment instruments, billing details, taxes and its transaction record under its own terms.

Collectorium does not process the listed object's sale price. Payments arranged directly between buyer and seller are outside Collectorium checkout.

When you choose AI assistance, the text and/or limited image derivatives needed for that request may be sent to the configured model provider. Images are prepared to reduce unnecessary metadata; the output remains an editable suggestion and is not published without your action.

AI assistance is not an appraisal, authenticity decision, provenance proof or legal advice. Do not submit secrets or unrelated personal data. Operational audit records are limited to service, safety and usage evidence rather than the full generated draft wherever possible.

Because Collectorium uses international infrastructure, identity, email, payment and AI providers, personal data may be processed outside your country. Transfers are limited to the relevant service purpose and use the safeguards required by applicable law, including contractual and technical measures where appropriate.

Provider locations and roles can change as services evolve. We evaluate material provider changes and update this Notice when they affect the information users need to understand the transfer.

We retain information only as long as needed for the account or service, security and fraud prevention, an unresolved report or dispute, accounting, legal duties or another person's rights. Public content normally remains until it is unpublished or deleted; transaction and security evidence may remain longer when required.

Retention is determined by data category and purpose rather than one universal deadline. Deletion from active systems may be followed by controlled backup expiry. A legal hold or active dispute may pause deletion only for the records concerned.

Collectorium uses encrypted transport, server-side authorisation, row-level database controls, private storage, isolated secrets, anti-abuse checks, audit records and role-limited staff access. Access is reviewed and sensitive actions may require stronger authentication. No online service can eliminate all risk.

Protect your credentials and report suspected compromise promptly. Collectorium will not ask for your password, authentication code or complete card number in support or privacy correspondence.

Subject to applicable law, you may ask whether your data is processed, obtain information or a copy, correct inaccurate data, request deletion or restriction, object to certain uses, withdraw consent, request portability, complain to a competent authority and seek review where a solely automated decision has significant effect.

In Türkiye, the rights in KVKK Article 11 apply. We may verify identity proportionately, protect another person's information and retain data where a legal exception or duty applies. Use the Privacy Requests page or contact@collectorium.co; we will respond within the period required by the law applicable to the request.

Collectorium is not directed to children. A person without the capacity to create an account or enter a transaction under applicable law may use the service only through a lawful representative. If we learn that personal data was provided without the required authority, we may restrict the account and delete or otherwise handle the data as law requires.

We may update this Notice when services, providers or law change. Material changes are presented clearly and, where required, notified before they take effect. A privacy complaint may be sent to contact@collectorium.co and may also be brought to the competent data-protection authority.