Privacy Policy
D&B Collectibles, LLC
This explains what we collect, why, and what you can do about it. It is written to be read rather than to be survived.
This is a draft. It has not been reviewed by an attorney. Do not rely on it as legal advice, and do not launch on it. State privacy laws — California, Colorado, Connecticut, Virginia and others — impose specific obligations that a lawyer needs to confirm apply and are met.
What we collect
Because you gave it to us
- Your name and email. Required to have an account at all.
- A password, stored only as a scrypt hash. We cannot read it, and neither can anyone who steals the database.
- A phone number, if you add one. Optional today, used for text alerts once those exist.
- A shipping address, needed to send you a card you have won.
- A public handle, if you set one. Shown next to your bids and in live chat. Leave it blank and you appear as an initial.
Because you used the site
- Bids, including the maximum you set. Your maximum is never shown to anyone else.
- Watched lots, so we can tell you when something you follow opens or is about to close.
- Consignment submissions — what you sent, what you asked for it, what we decided.
- Orders, and what happened to each one.
Automatically
- IP address and browser user-agent, recorded on sign-in, on every bid, and when you sign an agreement. This is how a disputed bid gets resolved and how shill bidding gets caught. It is not used to build an advertising profile.
- View counts on lots. Aggregate, not tied to you.
What we never hold
- Card numbers. Payment details go directly to Stripe on their own servers and never touch ours. We store the brand, the last four digits, and the expiry — enough to show you which card is on file.
- Bank account details. Payouts run through Stripe Connect.
Why we collect it
| What | Why |
| Name, email, password | To have an account and sign in |
| Shipping address | To post you a card you won |
| Bids and maximums | To run the auction |
| IP and user-agent | To resolve disputes and detect shill bidding |
| Payment method reference | To charge the winner without a checkout step |
| Consignment records | To manage your cards while we hold them |
| Email preferences | To send only what you asked for |
We do not sell your data. We do not share it with advertisers. We have no advertising business.
Who we share it with
Only the services required to run the platform:
- Stripe — payments and payouts. They receive your name, email, and card details you enter on their page.
- Shippo and USPS — shipping. They receive your name and address on the label.
- Resend — email delivery. They receive your email address and the message.
- Supabase — database hosting. Your data lives there, encrypted at rest.
- Vercel — application hosting.
Each is bound by its own terms and processes data on our instructions. We share nothing beyond what the task requires.
We will also disclose information where the law requires it — a subpoena, a court order, or a legitimate law-enforcement request. We will tell you if that happens unless we are legally prohibited from doing so.
How long we keep it
- Account information — while your account exists, and for seven years afterwards where a record relates to a completed sale. Tax and financial records have retention requirements we do not get to opt out of.
- Bid records — seven years. They are the evidence behind a completed sale.
- Agreement signatures — indefinitely. They are the record of what you agreed to.
- Watchlists and preferences — deleted with your account.
- Email logs — 30 days.
What you can do
- See it. Ask and we will send you everything we hold about you.
- Fix it. Most of it is editable in your account settings.
- Delete it. Ask and we will close your account and delete what we are not legally required to keep. Completed-sale records stay for the retention period above; everything else goes.
- Stop the email. Every message has an unsubscribe link, and preferences are granular in your account settings.
Email support@dbcollectiblesllc.com for any of these. We will respond within 30 days.
Depending on where you live, you may have additional rights — to opt out of sale or sharing, to appeal a refusal, to be free from discrimination for exercising a right. We do not sell or share personal information as those terms are defined in state privacy law.
Security
- Passwords are hashed with scrypt. Plaintext is never stored.
- Sessions are stored server-side, and only a hash of the session token is kept in the database — a leak of our data yields nothing that can be used to sign in as you.
- All traffic is HTTPS.
- Card data never reaches our servers.
No system is perfect. If we discover a breach affecting your personal information, we will notify you and the relevant authorities as required by law.
Children
This site is for adults. You must be 18 or older to bid or consign. We do not knowingly collect information from anyone under 13, and will delete it promptly if we learn we have.
Cookies
One cookie, for your session. It is required to stay signed in and cannot be turned off while using an account. No advertising cookies, no third-party trackers, no cross-site profiling.
Changes
If we change this materially, we will email you before it takes effect. The version date is at the top of this page.
Contact
D&B Collectibles, LLC support@dbcollectiblesllc.com