Privacy Policy

1. About this notice

This Policy explains what personal data we collect as a controller when you visit our site, create an account, or use OAC Colophon, and your rights over it. When we process personal data on behalf of a business customer (for example, data an atelier uploads or its own end-user data), we act as a processor under the customer's instructions and our Data Processing Addendum, and the customer's own privacy notice governs that data.

2. The data we collect

• Account data: name, email, organization, role, credentials.
• Billing data: plan, transaction records, and billing contact. Card details are handled by our payment processor (Stripe); we do not store full card numbers.
• Content you submit: texts, records, or objects you upload to analyze. (Where you upload on behalf of your organization, this is typically processed under our Data Processing Addendum.)
• Usage and technical data: log data, device and browser, IP address, pages and features used, approximate location derived from IP.
• Support and communications: messages you send us, and marketing preferences.
• Cookies and similar technologies: see section 8.

3. How we use it, and our legal bases

Purpose	Legal basis
Provide, operate, and secure the Service; authenticate you	Performance of a contract
Billing, invoicing, and tax records	Contract; legal obligation
Support and service communications	Contract; legitimate interests
Improve and develop the Service, prevent abuse	Legitimate interests
Marketing emails and product updates	Consent (opt-in) or legitimate interests; you may opt out anytime
Comply with law and enforce our terms	Legal obligation; legitimate interests

We do not sell your personal data.

4. Sharing and sub-processors

We share personal data only with service providers who process it on our behalf under contract, including our hosting provider, Stripe (payments), our email and authentication provider, and our error and analytics provider. We may also disclose data where required by law, to protect rights and safety, or in a corporate transaction, subject to this Policy.

We use these processors: Stripe (payments), Resend (transactional email), Cloudflare (DNS, edge delivery and the unsubscribe endpoint), and Google Workspace (business email). Application data is held in our own Postgres and Redis instances, not with a third-party database vendor.

5. International transfers

If personal data is transferred outside the EEA or UK, we rely on an adequacy decision or on appropriate safeguards such as the Standard Contractual Clauses (and the UK Addendum where relevant).

Personal data is hosted in the United States.

6. Retention

We keep personal data only as long as needed for the purposes above: account data for the life of the account and a reasonable period after closure; billing records for the period required by tax and accounting law; uploaded content per your settings or the applicable customer agreement; and logs for a limited period.

We keep account data for the life of the account and for 30 days after it is closed. Server logs are kept for 90 days. One exception, deliberately: where an address has asked not to be contacted, we keep a one-way hash of it indefinitely, because deleting that record would let the address be contacted again.

7. Your rights

Depending on your location (including under the GDPR and UK GDPR), you may have the right to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. You may also lodge a complaint with your local supervisory authority. To exercise a right, contact us at the postal address above. Where we process data as a processor for a business customer, please direct your request to that customer. Indiana residents have additional rights and an appeal mechanism; see section 14. Our data-breach notification commitment is described in section 15.

8. Cookies and similar technologies

We use strictly necessary cookies to operate the site and, with your consent where required, analytics or preference cookies. You can manage non-essential cookies via your browser or the site's cookie settings where offered.

We set no advertising or analytics cookies. Our analytics are cookieless and record no personal identifier. A session cookie is set only when you sign in, and only to keep you signed in.

9. Security

We use technical and organizational measures appropriate to the risk, including encryption in transit and at rest, access controls, and logging. No system is perfectly secure.

10. Children

The Service is not directed to children and is intended for business and professional users. We do not knowingly collect personal data from children.

The Service is not offered to anyone under 16.

11. EU / UK representative

12. Changes to this Policy

We may update this Policy; material changes will be notified by email or by posting a notice on the Service. The effective date above shows the latest version.

13. Contact

Questions or requests: write to us at Objects of Affection Collection LLC, 469 Fashion Avenue, 12th Floor, New York, NY 10018, US.

Privacy questions and requests: [email protected].

14. Indiana residents: your rights under the Indiana Consumer Data Protection Act

If you are an Indiana resident acting in an individual or household context, the Indiana Consumer Data Protection Act gives you rights over the personal data we control about you. Subject to the Act's conditions and exceptions, you may confirm whether we process your personal data and access it, correct inaccuracies, delete personal data you provided or that we obtained, obtain a portable copy of personal data you previously provided, and opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not sell personal data. To exercise a right, use the rights-request channel we publish.

Appeal mechanism. If we decline to act on your request, we will tell you why. You may appeal that decision using the appeals channel we publish. We will respond to the appeal and explain our reasons within the period the Act requires. If the appeal is denied, you may submit a complaint to the Indiana Attorney General.

We respond to a rights request within 45 days, and will tell you if we need longer. If we decline a request you may appeal by replying to our response, and we will answer the appeal within 60 days.

15. Data-breach notification

If a breach of security compromises the security, confidentiality, or integrity of personal data we control, we will notify affected individuals, and any regulator or third party the law requires, as required by applicable law, including Indiana's data-breach notification statute. Where we are the controller, we will notify affected individuals without undue delay and no later than 72 hours after becoming aware of the breach. That clock runs from awareness, not from the breach itself, because a commitment we could only meet by detecting instantly is a commitment we would breach by accident. We will make the disclosure without unreasonable delay after discovery, subject to the needs of law enforcement and of the measures necessary to determine the scope of the breach and restore the integrity of the system. Where we process personal data as a processor for a business customer, we will notify that customer without undue delay so it can meet its own obligations.