Privacy Policy

You do not have to provide all of your data to view the public information about the service. However, certain data is necessary to create an account, make purchases or use specific features. If you do not provide the necessary data, you may not be able to use those features.

• When you register: name or username, email address, phone number, date of birth and time zone.
• Your age declaration: the declared date of birth, the calculated age, the country, the exact text you accepted, the version of the applicable Age Policy, the date and time, the language and basic technical data about the device and the app. This is explained in section 12.4.
• Where applicable, data relating to your mother, father or legal guardian in connection with authorising or managing the account.
• Data you include in your profile and in the communications you send to support.
• Data about purchases, subscriptions, albums, cards, challenges and rewards linked to your use of the App.
• Content and data associated with your messages, reports, blocks and review requests in Collectors Chat, described in section 3.2.

• The content of the messages you send in public channels, groups of up to 50 people and direct conversations between users who follow each other. We also process messages you delete while their deletion is completed in accordance with section 7.
• The data associated with each message: the sending account, recipients, conversation, date and time, and read status where this feature is available.
• Your online status and whether you are typing. If you hide your online status, we do not show it to other users; the technical status required to provide the Chat may continue to be processed while you use the feature.
• Your age and the country associated with your account, in order to apply the Chat's minimum age and geographical restrictions.
• Your verified phone number, which we use to verify the account and help prevent fake accounts and abuse. Other users cannot see your number.
• The reports you make or receive, blocks, moderation measures and the information needed to handle a review.
• The GIFs available in the catalogue and the cards from your collection that you share. Users cannot attach images, videos, files or external links. The Collectibol team may post images in general channels and announcements.
• Your account's country signals (the country you choose, the country code of your verified phone number and the country of your App Store or Google Play account), in order to apply country-based access restrictions.
• The device identifier required for push notifications, as well as delivery data. Chat notifications do not include the text of messages.

You can turn off push notifications in your device settings or in the App, where that option is available.

When you use the App, we may collect technical and usage data needed to provide and protect the service, such as your IP address, device identifier, operating system, App version, date and time of access, error logs and usage events. Amplitude may receive usage data for analytics purposes, in accordance with the App's settings and the available privacy options.

We process your data on one or more of the following bases, depending on the specific purpose:

• The performance of the contract with you or taking steps at your request prior to entering into a contract, where the processing is necessary to create and manage the account, provide the App or the Chat and process purchases or requested features.
• Your consent, where we request it for a specific purpose, such as certain marketing communications or non-essential technologies. You may withdraw it at any time.
• Compliance with a legal obligation to which the Company is subject, where a law requires the processing.
• The legitimate interest of the Company or a third party, for example to protect the security of the service, prevent abuse, handle claims or improve the App, provided that your rights and freedoms do not override those interests.

Where we rely on legitimate interest, we must balance our interests against your rights and freedoms. You may request information about that balancing test and object to the processing in the cases set out in section 10.

We do not use the content of Chat messages or the phone number used to verify your account for personalised advertising. Nor do we disclose them to third parties for that purpose.

In public channels, word lists and patterns may be applied to hold back or filter messages before they are published. Moderation measures may include removing content or imposing sanctions in accordance with the service rules. In direct conversations and groups, no automated analysis of content is carried out using moderation filters. Only technical usage controls are applied: a control that prevents sending links, email addresses and phone numbers, and sending rate limits.

As of the date of this version, the artificial intelligence moderation layer is not included in this Policy because no decision has been taken to activate it. If it is introduced, we will update this information before using it, identify the provider and explain what data it analyses and how to request human review. Decisions that produce legal effects or significantly affect a person will not be taken solely by automated means without the safeguards required by law.

In addition to the Chat, we process data to create and maintain your account; allow you to play and manage your collection, albums, purchases, challenges and rewards; provide you with customer service and support; protect the App against fraud or malfunctions; send you service-related communications; and analyse usage in order to maintain and improve the App. The legal basis will be the performance of the contract, compliance with legal obligations, our legitimate interest or your consent, depending on the purpose and the applicable settings.

Marketing communications and personalised advertising, if offered, are managed separately from messaging. Chat data and the verification phone number are not used to personalise advertising.

We retain personal data for as long as necessary to provide the services, fulfil the purposes described, meet legal obligations and handle any claims. The data is then deleted or anonymised, unless it must be kept blocked for the period necessary to address legal liabilities.

If you delete your account, we will stop allowing you to access it and will delete or de-identify your data in accordance with the periods above. Messages that have already been sent to other people's conversations may be kept until the corresponding retention period expires; where they are kept, they will be separated from your identifiable profile to the extent technically possible. Data needed to meet legal obligations or defend claims may be kept blocked for the applicable periods.

We adopt appropriate technical and organisational measures to protect personal data against loss, alteration and unauthorised access or disclosure. These measures include encryption of communications between the App and our servers, access controls, security updates and systems to detect anomalous behaviour. Chat messages are stored encrypted on our servers. The specific measures are reviewed in line with the risks and the development of the service.

Who can read messages

In public channels, content is visible to the people who can access the channel. In groups and direct conversations, participants can read the messages. Collectibol retains the technical ability to access content; therefore, the Chat should not be regarded as an end-to-end encrypted service.

Technical protection

According to the information provided about the Chat's design, messages are encrypted with AES-256-GCM when stored in the database, and the keys are safeguarded in AWS Secrets Manager. The connection between the App and the servers is encrypted. This protection is not equivalent to end-to-end encryption: Collectibol can technically access messages through its systems. Metadata — for example, who sends a message, to whom, when and in which conversation — is not encrypted in the same way as the content.

When a conversation may be reviewed

Messages in public channels may be reviewed using the filters described in section 4.3 and by the team authorised to moderate those spaces. In private conversations or groups, content is reviewed when a participant reports a message, to the extent necessary to handle the report, when an authority validly requires it, or when necessary to manage a security incident or protect users. They are not routinely subjected to automated content filters; only to the technical control that prevents sending links, email addresses and phone numbers.

Reports, blocks and deletion

When you report a message, the reported content and the necessary associated data are forwarded to Collectibol so that it can review the case. The identity of the person reporting is not disclosed to the reported user, unless there is a legal obligation to do so. If you block someone, they will not be able to start a conversation with you through the Chat feature while the block is active. If you delete a message, it will stop being shown in accordance with the rules and periods in section 7.

Notifications

Push notifications are sent through Expo and Apple or Google services. They alert you to activity in the Chat, but do not include the text of messages. You can turn them off on your device or in the App where that option is available.

The App is intended for people aged 12 or over. In Spain, minors under 14 cannot consent on their own to the processing of their data: creating their account requires the authorisation of the person holding parental authority or guardianship, which we verify through that person's phone number, and any processing based on consent also requires that person's consent. In other countries, the age of consent set by their law applies. The App's minimum age may be subject to additional requirements under local law.

The Chat is available from the age of 16 in the countries where it is enabled. People aged 16 and 17 can only participate in public channels. Direct conversations and groups are reserved for people aged 18 and over. Availability may be limited or disabled in certain countries.

We apply the access and moderation rules described in this Policy. When we receive a report or information about a possible risk to a minor, we may review the strictly necessary information and take measures to protect users' safety. Where there is a legal obligation or a valid request, we may disclose the relevant data to the competent authorities.

Messages you post in a public channel may be seen by the people who access that channel. Do not share your address, phone number, passwords or any other information you do not want to make public in the Chat. If an interaction makes you uncomfortable, you can block the other person and report the message from the App.

When you register, or when we ask you to, you confirm your date of birth and accept the Age Policy for Adults or the Age Policy for Minors, depending on your resulting age. We keep a record of that declaration (section 3.1) in order to apply the restrictions that correspond to your age and to be able to demonstrate that we informed you. Your age is not shown to other users.

If there are reasonable indications that the declared age is incorrect (for example, reports from other users, a different age stated by you in the Chat or the age range provided by Apple or Google), we may provisionally apply the restrictions for minors and ask you for an additional check using the least intrusive means available. If an age verification provider is involved, we only retain the result and the method used, not your documents. The final decision is reviewed by a person.