Privacy Policy

Last updated 2026-04-03

This policy explains how CollectorIQ handles personal data for professional subscribers, registered collectors, waitlist contacts, and people whose profiles may be created from public art-market sources.

CollectorIQ is operated by Colliq SAS. For any privacy matter, you can contact us at colliq@nanocorp.app or use the “Your data” page.

1. Controller and scope

Colliq SAS acts as data controller for the operation of the CollectorIQ website, account management, data-rights handling, prospect management, and the publication of collector intelligence profiles relevant to the professional art market.

2. Data we process

Professional subscribers and prospects: identity, business email, company details, billing and payment status, usage logs, and support exchanges.
Registered collectors: identity, email, location, collecting preferences, budget ranges, profile visibility settings, messaging history, and account-security data.
Publicly profiled collectors: identity and professional-relevance information sourced from publicly accessible art-market materials, such as auction results, exhibition records, institutional publications, or other public sources documented internally.
Website visitors: technical logs, language preference cookie, and analytics data only after consent.

3. Purposes and legal bases

To provide the service, create accounts, and manage subscriptions: contract performance and pre-contractual steps.
To secure the platform, prevent abuse, handle support, and document legal requests: legitimate interests.
To measure audience via non-essential analytics: consent.
To compile and maintain publicly sourced collector profiles for professional art-market intelligence: legitimate interests, subject to the right to object.

4. Data sources

We collect data directly from forms, account registration, messaging activity, and checkout or payment workflows. For public collector profiles, we may rely on publicly accessible auction catalogs, fair and museum websites, professional press, gallery announcements, or similar art-market sources.

5. Recipients and processors

Authorized members of the Colliq team and service providers involved in hosting, database infrastructure, payment processing, email delivery, analytics, or security.
Main processors currently used by the service include Vercel (hosting), Neon (database), Stripe (payments), NanoCorp (operational tooling and analytics), and email tooling used from the NanoCorp environment.
Some providers may process data outside the European Economic Area. When relevant, we rely on contractual and organizational safeguards made available by those providers.

6. Retention periods

Subscriber and contractual data: for the duration of the relationship, then for the period needed to meet accounting, evidentiary, and legal obligations.
Collector account data: while the account is active, then deleted or anonymized within a reasonable period after closure unless retention is required by law or for dispute handling.
Waitlist and inbound contact data: up to 3 years after the last meaningful contact, unless deleted earlier on request.
Public collector profiles: reviewed periodically for relevance and removed or corrected when no longer justified or upon a valid rights request.
Cookie consent preference: 6 months.

7. Your rights

Depending on your situation, you may request access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where consent is the legal basis. You can also object to profiling based on legitimate interests. To exercise a right, use the “Your data” page or contact us at colliq@nanocorp.app.

You may also lodge a complaint with the competent supervisory authority, including the CNIL if French law applies.

8. Cookies and analytics

Essential cookies are used for language preference and authenticated collector sessions.
Analytics cookies or similar technologies are activated only after you consent through the banner.
You can change your preferences at any time from the footer link.

9. Security and updates

We use access controls, authentication mechanisms, and infrastructure safeguards proportionate to the current service. This policy may evolve as the product, providers, or legal documentation mature.