Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

2. General information and your rights

We take the protection of your personal data seriously and process it only in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Below we explain what data we process, for what purpose and on what legal basis.

Under the GDPR you have the following rights at any time:

• Right of access to your stored data (Art. 15 GDPR)
• Right to rectification of inaccurate data (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw a given consent at any time with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, please contact info@bigboxrox.com. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany).

3. Hosting and server log files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit the site, Vercel automatically collects and stores information in server log files that your browser transmits to us. This includes the IP address, date and time of the request, the page accessed, the referrer URL and information about your browser and operating system. This data is required to deliver the website securely and reliably. The legal basis is our legitimate interest in a secure and functional website (Art. 6 (1) (f) GDPR). We have concluded a data processing agreement with Vercel.

4. Cookies and consent

To operate the website we use technically necessary cookies, for example to keep you signed in. These are required for the service to function; the legal basis is the performance of the service you have requested (Art. 6 (1) (b) GDPR), and storing and reading them on your device is permitted without consent pursuant to § 25 (2) no. 2 TDDDG.

Cookies and similar technologies that are not strictly necessary, in particular for web analytics and advertising measurement (see section 10), are only used after you have given your consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG). You can withdraw your consent at any time with effect for the future or make a new choice via “Cookie settings” in the footer.

5. User account and authentication

If you create an account, we process the data required for registration and login, in particular your email address and name. Authentication is handled by Clerk, Inc., 660 King Street, Unit 345, San Francisco, CA 94107, USA. Clerk processes your login data and sets the cookies necessary for an authenticated session. The processing is carried out to provide your user account and is therefore based on the performance of a contract (Art. 6 (1) (b) GDPR). We have concluded a data processing agreement with Clerk. Our service is directed exclusively at persons aged 18 or over (section 3 of the Terms); we do not knowingly process personal data of minors.

Contract confirmation: After a successful paid checkout, we process the email address entered in Stripe Checkout and the specific contract data in order to send the legally required contract confirmation (Art. 6 (1) (b) and (c) GDPR). Delivery is handled by Resend. The Stripe Checkout ID is used as a technical idempotency key so that retries do not send the same confirmation more than once.

Cancellation and withdrawal forms: If you use the forms “Cancel contracts here” or “Declare withdrawal”, which are accessible without signing in, we process the data provided there (email address, your name for a withdrawal, the contract concerned, type of cancellation, any required cancellation reason and your other details) to match and process your declaration and to prove its receipt (Art. 6 (1) (b) GDPR). The confirmation of receipt is sent by email via our delivery provider Resend (Resend, Inc., San Francisco, USA), with whom we have concluded a data processing agreement (for third-country transfers see section 12). The declarations are stored for as long as necessary for processing and proof.

Newsletter: If you voluntarily consent to the newsletter when creating your account or in a later prompt, we process your email address, the consent version and the time of consent in order to send you occasional Big Box Rox news. The legal basis is your consent (Art. 6 (1) (a) GDPR). Delivery is handled by Resend (Resend, Inc., San Francisco, USA), with whom we have concluded a data processing agreement (for third-country transfers see section 12). You can withdraw consent at any time with effect for the future via the unsubscribe link in a newsletter email or by emailing info@bigboxrox.com. Processing carried out before withdrawal remains lawful. We do not send newsletters without consent.

6. Collection data, public visibility and searchability

The data you enter about your collection (such as titles, platform, condition, value, notes and photos) is stored in a PostgreSQL database operated by Supabase Pte. Ltd. as a hosted database service. The database project uses the Frankfurt region; data is stored and primarily processed there. The Supabase Data Processing Addendum applies to this service (see also section 12). This storage is necessary to provide the service you have requested (Art. 6 (1) (b) GDPR).

Big Box Rox digitises and documents personal physical collections. The result includes a personal collection page. It is public by default. In the settings, you can choose at any time to make it visible only to fully created, signed-in and unlocked accounts. In that collection, content

• is publicly visible in public mode as a collector profile with profile details and aggregate statistics, the complete collection list, sections and series, title cards with title names, and the technically optimised user photographs intended for those surfaces to all visitors, including visitors without an account;
• is listed and findable for guests in the collector directory (“Browse”) only in public mode;
• allows the collector profile to be indexed by search engines only in public mode; collection lists, sections, series and login walls are marked “noindex”;
• may show, in public mode, technically optimised variants of your user photographs on title cards, in collection, section and series lists, and on decorative surfaces to visitors who are not signed in as well;
• provides specific title detail pages, additional images and detail galleries only to you as the account owner and to signed-in users; the direct original file is not provided to other users, and White Whales are displayed only with an active Membership;
• locks search, facets and sorting within an individual collection for guests and makes them available after sign-in to every fully created and unlocked account; community-wide search, filters and comparisons are available only to active Members to the same extent. The digitisation package does not affect these permissions.
• allows every fully created and unlocked account to use community reactions, following, the personal recent-additions feed and private messages.

In “signed-in users only” mode, guests receive a login wall instead of this content; the profile is excluded from the guest directory, guest search and sitemap. Fully created, signed-in and unlocked accounts can continue to open the collection views. You determine the visibility, uploaded photographs, main photograph, order, sections, series and special pieces. Big Box Rox does not editorially select collection content. Photographs of your collection items are not used for advertising, the landing page or external campaigns; only Big Box Rox’s own design elements appear there. Processing and display of your collection photos are limited to your personal collection page and its public or signed-in collection views.

Introductory offer, Founding status and Founding Hall. To enforce the introductory-offer limit, we store the offer version, sequential place, package, your Club choice, reservation and confirmation status, the technical Checkout session and the related timestamps. We do not store payment details in our database. Only if you expressly select Members Club with the package purchase do we display your sequential Founding number, Founding status and associated badge as part of the contract. The Founding Hall shows collector name, profile image, collection title, number of digitised titles and a link to the collection view only where your collector page is public. A profile set to “signed-in users only” is not shown in the public Founding Hall. The legal basis is performance of the contract (Article 6(1)(b) GDPR). No additional categories of personal data are collected and no new recipients are engaged for this purpose. A consumed offer place remains recorded as occupied after a reversal to prevent fraud and repeated use.

Profile picture. If you upload a profile picture, we process that image to identify and link your collector profile. On upload, the image is cropped to a square format; the crop is technically aligned to a face detected in the image. The profile picture appears on your collector page and, if you have selected public mode, in linked collector cards on the landing page, in the collector directory, in rankings and in community overviews, including to visitors without an account. The legal basis for this function-related display is the performance of the service you requested (Art. 6 (1) (b) GDPR). Your profile picture is used solely for this display within Big Box Rox and is not passed to third parties for advertising or used for external marketing. You can remove your profile picture at any time in the settings.

Not shown to third parties: the value and purchase price you record for a title, as well as any price indication calculated by Big Box Rox, are never displayed publicly or to other members, and are not used for any public ranking. Your precise location is not displayed either.

Automatically calculated price indication: Where this feature is offered, Big Box Rox processes the product characteristics recognised from your photographs and any corrections you make in order to calculate and regularly update a private, non-binding replacement-value indication for the specific collection item. This may include, in particular, the title, platform, release country and year, edition, packaging format, genre, condition, sealed status and visible information about completeness. We also store the calculated value, valuation date, model or rule version used, and an assessment of data confidence. This processing is necessary to provide the collection feature you use (Art. 6 (1) (b) GDPR). Details and limitations of the price indication are set out in the Terms of Use.

Development and improvement of the valuation model: To develop, test and improve the price indication using consistent standards, we use recognised or user-corrected factual product and release characteristics and the price indications calculated from them. User identifiers and other directly identifying account data are separated from these data as early as possible; for long-term model development we use only anonymised or aggregated records that can no longer be attributed to a user or collection. These model-development records do not contain collection photographs. Purchase prices and personal value estimates entered by users are not used to calibrate the valuation model. To the extent that an account link temporarily exists prior to anonymisation, the processing is based on our legitimate interest in developing a consistent and reliable price indication and improving service quality (Art. 6 (1) (f) GDPR). You may object to this account-related processing under Art. 21 GDPR. We may evaluate publicly available market information for price research; corresponding search queries use product-related information only and contain no user identifier, contact details or collection photographs.

Your control: You can export your data as JSON and Excel at any time (for every account in the account settings, Art. 20 GDPR) and delete your account including your collection at any time (Art. 17 GDPR). Digital documentation and provision of your personal collection page are the core of the service you requested; the legal basis is the performance of that service (Art. 6 (1) (b) GDPR). This visibility model is disclosed during onboarding and in the Terms of Use.

Product feedback and milestone notices: Once a certain number of titles has been saved, we may ask you once for voluntary feedback in the signed-in area. We store your star rating, optionally selected topic areas, your optional free-text comment, your indication of whether we may contact you about the feedback, and the time and title count. Feedback is visible to administrators only and is not published; providing it is voluntary (Art. 6 (1) (f) GDPR, legitimate interest in improving the service). In addition, we may show members contract-related notices in the signed-in area (for example about the annual Members Club payment) and record on the contract whether such a notice has already been shown (Art. 6 (1) (b) GDPR).

7. Messages and community features

Every fully created and unlocked account can exchange private messages and start a new conversation. We store the message content, sender and recipient, timestamps and the read status in our database. This processing is necessary to provide the messaging feature you use (Art. 6 (1) (b) GDPR).

Messages are private: they are only visible to the sender and the recipient. Our administrators do not read messages in normal operation. Only if a participant of a conversation reports a message is the reported message shown to an administrator for moderation purposes (Art. 6 (1) (f) GDPR, legitimate interest in a safe community; the report is initiated by a participant of the conversation).

Your controls: you can disable being contacted in the settings (“Reachable by message”; replies within conversations you started remain possible), block individual members, and report messages. Messages are retained until account deletion: if you delete your account, all messages you sent and received are deleted for both sides.

Content reports (notice form pursuant to Art. 16 DSA): We accept notices of allegedly illegal content through our central notice form at bigboxrox.com/report; it can also be used without signing in. We process the reported location (URL), report category, statement of reasons, and the reporter’s first and last name and email address; for notices submitted by rights holders or their authorised representatives additionally the company or law firm, the right concerned and a registration number. For notices concerning child sexual abuse material, name and email address are optional (Art. 16 (3) DSA). To limit abuse we derive shortened hashes from the IP address and the email address and limit the number of notices per day; the IP address itself is not stored. In addition, we store your confirmation that the information is provided to the best of your knowledge, for rights holders your declaration of authorisation, the time of receipt, the processing status and a processing priority; where the reported location can be assigned to a collector account, we store that assignment in order to handle the notice. The form contains a technical check field, invisible to you, to ward off automated submissions; its content is not stored. We may verify rights holder details against public registers (e.g. DPMA, EUIPO, bar directories) and, where authorisation is in doubt, reply via the contact details recorded there. The legal basis is compliance with our legal obligations under Art. 16 DSA (Art. 6 (1) (c) GDPR) and our legitimate interest in reviewing and defending against infringements and in limiting abuse (Art. 6 (1) (f) GDPR). Report data is visible only to authorised administrators; the reported person does not receive the reporter’s contact details.

Follows, likes and notifications: Every fully created and unlocked account can follow other collectors and mark collections, titles, sections or series with a “like”. For this we store who follows whom and who marked which content, each with a timestamp, and generate notifications for the collector concerned. Only aggregate counters appear publicly; the collector concerned can see in their notifications which member followed or liked. The legal basis is the provision of the community feature you use (Art. 6 (1) (b) GDPR). Follows and likes can be withdrawn at any time and are removed when the account is deleted.

Bookmarking titles from other collections (White Whales): If you bookmark a title from another collection as a wanted piece, we copy only neutral catalogue details (such as title, platform, version) into your own wish list. The other collector’s condition, notes, photos, value or purchase price are not copied (Art. 6 (1) (b) GDPR).

8. Image hosting

Photos you upload (for example pictures of your boxes) are stored and delivered via Cloudinary, operated by Cloudinary Ltd. with infrastructure in the USA. The processing serves to display the images you have uploaded and is based on the performance of the user contract (Art. 6 (1) (b) GDPR). We have concluded a data processing agreement with Cloudinary.

Before uploading, you confirm that you only use photographs you took yourself of physical items from your own collection and that you do not upload scans, downloaded product or database images, or photographs showing people, documents, addresses or private information. We store the user ID, version of the upload rules and confirmation timestamp to document proper provision and defend against infringements (Art. 6 (1) (b) and (f) GDPR).

Visitors who are not signed in may see technically optimised variants of the user’s own photographs on title cards, in collection, section and series lists, and on decorative surfaces. Where those images are delivered via a Big Box Rox endpoint, the Cloudinary origin address is not exposed. Additional images and detail galleries are provided only in signed-in collection views. The direct original file is not provided to other users. The account owner retains access to their own photographs in the management, collection and export areas independently of Membership.

When you use the mobile camera feature, the live preview is processed locally on your device only. Neither a continuous video stream nor audio data is transmitted to BIG BOX ROX. Only individual images that you confirm are uploaded. Temporary uploads from incomplete sessions that have not been assigned to a collection entry are deleted immediately when you leave the page where possible. Any remaining uploads are automatically cleaned up the next time the upload feature is opened after 24 hours have elapsed.

9. AI image recognition

When you use the image recognition feature, the box photos you upload are transmitted to AI service providers in order to automatically recognise details such as title, platform and publisher. The primary provider is Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) using the Gemini model. In addition, Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA, is used to safeguard and cross-check the recognition result. The transmission only takes place for photos you actively submit to this feature and serves to provide the requested functionality (Art. 6 (1) (b) GDPR). We have concluded a data processing agreement with both providers. The transmitted photos are processed to carry out the image recognition. Under the terms applicable to the paid services used, they are not used to improve or train the AI models. A time-limited processing for security purposes and abuse detection may be carried out by the respective provider. For transfers to the USA see section 12.

For cost control, abuse detection and technical optimisation, we store for individual recognition runs the internal user and process identifiers, a link to the subsequently saved collection title, and the provider, model, processing step, token and image counts, duration, fallback status and estimated direct API cost. This cost telemetry does not store photos or image addresses, prompts, AI responses, names or email addresses. It is accessible only to authorised administrators and displays accounts pseudonymously by default. The legal basis is our legitimate interest in operating image recognition economically, securely and reliably (Art. 6 (1) (f) GDPR).

10. Web analytics and advertising measurement (Google Analytics and Meta Pixel)

Subject to your consent, we use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to analyse how you use the website. The information generated (including a shortened IP address) is transmitted to Google and used to evaluate website usage and to compile reports on website activity. IP anonymisation is enabled. The legal basis is your consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG), which you can withdraw at any time with effect for the future. When transmitted to Google, data may also be processed by Google LLC in the USA (see section 12). Further information can be found in Google’s privacy policy at policies.google.com/privacy.

Subject to your consent, we also use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We transmit only the PageView event for a page view. Meta receives, in particular, the URL visited, the referrer URL, technical browser and device information, and the IP address. Meta may also set or read the _fbp and _fbc cookies, which can be retained for up to 90 days. The data is used to measure reach, report on advertising, and create audiences for more relevant advertising. We do not send email addresses, names, or other contact information through advanced matching or similar functions.

Where we jointly determine the collection and transmission of this data with Meta, we act as joint controllers under Art. 26 GDPR. After transmission, Meta otherwise processes the data under its own responsibility. The sole legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. The Meta script is not loaded before your consent. You can withdraw your consent at any time with effect for the future through “Cookie settings”. Further information is available in the Meta Business Tools Terms, the Meta Privacy Policy, and the Meta Cookies Policy.

11. Payment processing

For paid plans, payments are processed by Stripe, operated for European customers by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (and Stripe, Inc. in the USA). When you make a payment, the payment data required for the transaction is processed by Stripe. The processing is necessary for the performance of the contract (Art. 6 (1) (b) GDPR). We have concluded a data processing agreement with Stripe.

12. International data transfers

Some of the service providers named above are located outside the European Economic Area or process data there (in particular Supabase Pte. Ltd. as well as Vercel, Clerk, Cloudinary, Anthropic, Google LLC, Meta Platforms, Inc., Stripe, Inc. and Resend, Inc.). The Supabase database project uses the Frankfurt region; Supabase and its subprocessors may carry out service, support and security processing outside the European Economic Area. Such transfers to Supabase are covered by the EU Standard Contractual Clauses contained in the Data Processing Addendum (Art. 46 (2) (c) GDPR). Other transfers to the USA are based on the following safeguards: for Google LLC, Meta Platforms, Inc. and Stripe, Inc. we rely on their certification under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). For Vercel, Clerk, Cloudinary and Anthropic we rely on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR), which form part of the respective data processing agreements; the same applies to Resend, Inc. (email delivery, section 5); where a provider is additionally certified under the EU-US Data Privacy Framework, we also rely on that certification.

13. Data retention

We store personal data only for as long as is necessary for the purposes described or as required by statutory retention periods. In detail: account, collection and image data, including account-related price indications, are stored until your account is deleted. After a content item or your account is deleted, we remove the original and the display variants derived from it; the only exceptions are statutory retention obligations, time-limited technical backup copies, and data required for evidence preservation or to assert or defend legal claims. Messages are stored until they are deleted by the participants or a participating account is deleted. Records acknowledging legal texts and upload rules are stored until the account is deleted and beyond that only to the extent necessary to assert or defend legal claims. Reports are retained until the review is complete and afterwards only for as long as required to comply with legal obligations or to assert or defend legal claims. Server log files are stored by the hosting provider for a short period and then deleted. Backups are created regularly and deleted after 90 days at the latest; deleted data may persist in backups until then but is not restored into live operation from them. Payment and invoicing data is retained in accordance with commercial and tax law for up to ten years (§ 257 HGB, § 147 AO). The account link in AI cost telemetry is removed immediately when an account is deleted and is automatically anonymised after no more than twelve months; the resulting anonymous cost statistics may be retained for long-term business analysis. Product, release and valuation data that has already been anonymised or aggregated no longer relates to your account or collection and may be retained for the long-term development and testing of the valuation model.

14. Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes to our service or to legal requirements. The current version is always available on this page.