Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

2. General information and your rights

We take the protection of your personal data seriously and process it only in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Below we explain what data we process, for what purpose and on what legal basis.

Under the GDPR you have the following rights at any time:

• Right of access to your stored data (Art. 15 GDPR)
• Right to rectification of inaccurate data (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw a given consent at any time with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, please contact info@bigboxrox.com. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany).

3. Hosting and server log files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit the site, Vercel automatically collects and stores information in server log files that your browser transmits to us. This includes the IP address, date and time of the request, the page accessed, the referrer URL and information about your browser and operating system. This data is required to deliver the website securely and reliably. The legal basis is our legitimate interest in a secure and functional website (Art. 6 (1) (f) GDPR). We have concluded a data processing agreement with Vercel.

4. Cookies and consent

To operate the website we use technically necessary cookies, for example to keep you signed in. These are required for the service to function and are set on the basis of our legitimate interest (Art. 6 (1) (f) GDPR); they do not require consent.

Cookies and similar technologies that are not strictly necessary, in particular for web analytics (see section 9), are only used after you have given your consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG). You can withdraw your consent at any time with effect for the future.

5. User account and authentication

If you create an account, we process the data required for registration and login, in particular your email address and name. Authentication is handled by Clerk, Inc., 660 King Street, Unit 345, San Francisco, CA 94107, USA. Clerk processes your login data and sets the cookies necessary for an authenticated session. The processing is carried out to provide your user account and is therefore based on the performance of a contract (Art. 6 (1) (b) GDPR). We have concluded a data processing agreement with Clerk.

6. Collection data, public visibility and searchability

The data you enter about your collection (such as titles, platform, condition, value, notes and photos) is stored in a database operated by Turso (a hosted libSQL service). This storage is necessary to provide the service you have requested (Art. 6 (1) (b) GDPR).

If your collection page is set to public (the default), the content you have chosen to display:

• is visible to all visitors of your public collection page;
• is listed and findable in the public collector directory (“Browse”);
• is searchable, including through a cross-collection search available to signed-in members (from the Collector plan upward), so that other members can see which titles you own and reach your collection page;
• may be indexed by search engines.

Your control:You can set your collection to private at any time in the settings; it is then neither visible nor searchable and returns a “not found” page to visitors. Paid plans additionally let you restrict your collection to signed-in members only (Collector plan and above) or hide your profile from the community search (Curator plan). You can export and delete your data at any time. The legal basis for the public provision is the performance of the service you selected (Art. 6 (1) (b) GDPR).

7. Image hosting

Photos you upload (for example pictures of your boxes) are stored and delivered via Cloudinary, operated by Cloudinary Ltd. with infrastructure in the USA. The processing serves to display the images you have uploaded and is based on the performance of a contract and our legitimate interest in efficient image delivery (Art. 6 (1) (b) and (f) GDPR).

8. AI image recognition

When you use the image recognition feature, the box photos you upload are transmitted to Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA, in order to automatically recognise details such as title, platform and publisher. The transmission only takes place for photos you actively submit to this feature and serves to provide the requested functionality (Art. 6 (1) (b) and (f) GDPR).

9. Web analytics (Google Analytics)

Subject to your consent, we use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to analyse how you use the website. The information generated (including a shortened IP address) is transmitted to Google and used to evaluate website usage and to compile reports on website activity. IP anonymisation is enabled. The legal basis is your consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG), which you can withdraw at any time with effect for the future. Our measurement ID is [G-XXXXXXXXXX]. Further information can be found in Google’s privacy policy at policies.google.com/privacy.

10. Payment processing

For paid plans, payments are processed by Stripe, operated for European customers by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (and Stripe, Inc. in the USA). When you make a payment, the payment data required for the transaction is processed by Stripe. The processing is necessary for the performance of the contract (Art. 6 (1) (b) GDPR). We have concluded a data processing agreement with Stripe. Please note: paid plans are not yet active; this section applies as soon as payments are enabled.

11. Game metadata and cover images

To enrich entries with cover art, screenshots and metadata we use external game databases, in particular IGDB (operated by Twitch Interactive, Inc., an Amazon company) and MobyGames. When such images are loaded, your IP address may be transmitted to the respective provider. This is based on our legitimate interest in presenting collections with accurate game data (Art. 6 (1) (f) GDPR).

12. International data transfers

Some of the service providers named above are located in the USA or process data there. Where personal data is transferred to a third country, we ensure an adequate level of protection through appropriate safeguards, in particular the EU Standard Contractual Clauses and, where applicable, certification under the EU-US Data Privacy Framework.

13. Data retention

We store personal data only for as long as is necessary for the purposes described or as required by statutory retention periods. If you delete your account, the associated personal data will be deleted, unless we are legally obliged to retain it (for example commercial and tax retention obligations).

14. Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes to our service or to legal requirements. The current version is always available on this page.