Privacy Policy

1. Introduction

The Back Catalog (“we”, “us”, or “our”) operates thebackcatalog.com, a luxury resale price-tracking and comparison service. This Privacy Policy explains what personal information we collect, how we use and share it, how long we keep it, and the rights available to you. By using the Service you agree to the practices described here.

If you are located in the European Economic Area (“EEA”), United Kingdom, or Switzerland, we act as the data controller of your personal information and process it in accordance with the General Data Protection Regulation (“GDPR”) and equivalent national laws. If you are a California resident, additional rights under the California Consumer Privacy Act (“CCPA”) apply, as described in Section 10.

2. Information We Collect

We collect information in three ways: information you provide directly, information collected automatically, and information from third-party services.

2.1 Information You Provide

• Account data: email address, display name, and profile photo if you sign up with a social provider. Authentication credentials are managed by Clerk; we do not store raw passwords.
• Saved catalog data: items you add to your personal watchlist or “I Own This” catalog.
• Communications: messages you send us via email or support channels.

2.2 Information Collected Automatically

• Usage data: pages visited, search queries, filters applied, product pages viewed, outbound link clicks, and referring URLs.
• Device and connection data: IP address, browser type and version, operating system, device identifiers, and time zone.
• Cookies and similar technologies: session identifiers, preference tokens, and analytics identifiers. See Section 6 for details.

2.3 Information from Third Parties

If you sign in using Apple, Facebook, or Google, we receive a unique identifier and basic profile information (name, email) from that provider. We use this only to create or match your account.

3. How We Use Your Information

The table below summarises our processing activities and their legal bases under GDPR.

4. Data Sharing

We do not sell, rent, or trade your personal information. We share data only in the following circumstances:

• Service providers: third-party vendors who process data on our behalf under written data-processing agreements — including Clerk (authentication), AWS (infrastructure and storage), and analytics providers. These parties may not use your data for their own purposes.
• Affiliate networks: when you click an outbound link to a resale platform, we may transmit a referral identifier to that platform. This is subject to the third-party platform's own privacy policy.
• Business transfers: if we merge with or are acquired by another company, your information may be transferred as part of that transaction. We will notify you before your data is subject to a materially different privacy policy.
• Legal requirements: we may disclose information to comply with a valid legal process, enforce our Terms of Service, or protect the rights, property, or safety of The Back Catalog or its users.

5. International Data Transfers

We are based in the United States. If you access the Service from the EEA, UK, or Switzerland, your personal information is transferred to and processed in the U.S. We rely on the EU Standard Contractual Clauses (“SCCs”) and the UK International Data Transfer Agreement (“IDTA”) as the transfer mechanism for data flows from those regions to the U.S. Copies of the applicable safeguards are available on request.

6. Cookies and Tracking

We use the following categories of cookies:

• Strictly necessary: session management, authentication state, CSRF protection. These cannot be disabled without breaking core functionality.
• Preferences: remember your filter and sort selections across sessions.
• Analytics: understand how visitors navigate the site so we can improve it. We use first-party analytics and do not share raw event data with third-party ad networks.
• Advertising: we display third-party ads via Google AdSense. Google may set its own cookies to personalise ads in accordance with Google's privacy policy. You can opt out of personalised ads at adssettings.google.com.

You can manage cookies through your browser settings or our cookie consent banner. Disabling non-essential cookies does not affect your ability to browse the catalog.

7. Data Retention

We retain personal information for as long as necessary to provide the Service or comply with legal obligations:

• Account data: retained for the life of your account. Upon deletion your profile and saved catalog are removed within 30 days.
• Usage logs: anonymised after 90 days; raw IP-level logs are deleted after 30 days.
• Consent records: retained for 7 years as required by applicable privacy law.
• Backup data: encrypted backups are purged within 90 days of account deletion.

8. Security

We implement industry-standard technical and organisational measures to protect your information, including encryption in transit (TLS 1.2+) and at rest, access controls limited to personnel with a need to know, regular security reviews, and automated vulnerability scanning. No method of transmission over the internet is completely secure; we cannot guarantee absolute security, but we will notify you of a breach affecting your data as required by applicable law.

9. Your Rights (EEA / UK)

If you are located in the EEA or UK, you have the following rights under GDPR:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure: request deletion of your personal data (“right to be forgotten”).
• Restriction: ask us to restrict processing in certain circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Object: object to processing based on legitimate interests or for direct marketing purposes.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise these rights, email privacy@thebackcatalog.com. We will respond within 30 days (extendable to 90 days for complex requests). You also have the right to lodge a complaint with your local supervisory authority.

You may delete your account at any time from your account settings page, which initiates the data-deletion pipeline described above.

10. California Residents (CCPA)

If you are a California resident, the CCPA grants you additional rights:

• Know: request disclosure of the categories and specific pieces of personal information we collect, use, disclose, and sell.
• Delete: request deletion of personal information we have collected from you (subject to certain exceptions).
• Opt out of sale / sharing: we do not sell or share personal information for cross-context behavioural advertising as those terms are defined under CCPA. No opt-out is required, but you may contact us to confirm.
• Non-discrimination: we will not discriminate against you for exercising your CCPA rights.

To submit a verifiable consumer request, email privacy@thebackcatalog.com with the subject line “CCPA Request”.

11. Children's Privacy

The Service is not directed to individuals under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised policy with an updated “Last updated” date and, for material changes, notify registered users by email or in-app notice at least 14 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.

13. Contact

For questions, requests, or complaints about this Privacy Policy or our data practices, contact us at: