Privacy Policy

1. Data Controller

Wayfaring B.V. is the data controller responsible for your personal data. We are registered in the Netherlands and committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Information We Collect

We collect the following types of information:

• Account Information: Email address and display name when you create an account
• Profile Data: Optional information such as bio, country, collector archetype, and social media handles
• Uploaded Photos: Images you submit for analysis and storage in your cabinet
• Usage Data: Information about how you interact with our service, including scan history and cabinet activity
• Device Information: Browser type, device type, and general location data for service optimization

3. How We Use Your Data

We use your information to:

• Provide and maintain our AI-powered appraisal service
• Analyze your uploaded photos to identify and value collectibles
• Store and organize your cabinet of curiosities
• Process payments and manage your subscription
• Send service-related communications and updates
• Improve our AI models and service quality (using anonymized data)
• Detect and prevent fraud or abuse

4. Photo Processing & AI Training

When you upload photos for analysis, our AI processes them to identify items, estimate values, and provide historical context. Your original photos are stored securely in your cabinet. We do not share your photos with third parties or use them for advertising purposes.

Important: We do NOT use your photos to train AI models.

Your images are analyzed using existing AI models but are never used to train, fine-tune, or improve any machine learning systems. Your collection data remains private and is never incorporated into AI training datasets.

5. Data Storage & Security

We implement industry-standard security measures to protect your data, including encryption in transit and at rest. Your data is stored on secure servers within the European Union. We retain your data for as long as your account is active or as needed to provide services.

6. Data Retention

We retain different types of data for different periods:

• Account Data: Retained while your account is active and deleted within 30 days of account deletion
• Cabinet Items: Deleted within 24 hours when you remove them, or within 30 days of account deletion
• Payment Records: Retained for 7 years as required by tax and accounting regulations
• Usage Analytics: Anonymized data may be retained indefinitely for service improvement
• Support Communications: Retained for 2 years after resolution for quality assurance

7. Third-Party Services

We work with trusted third-party providers to deliver our service:

• Payment Processing: Stripe handles all payment transactions securely
• Cloud Infrastructure: Our servers and databases are hosted on secure cloud platforms within the EU
• AI Services: We use AI models to analyze images and generate appraisals (your photos are not used for training)
• Email Services: Transactional emails are sent through secure email providers

These providers are bound by strict data processing agreements and privacy obligations.

8. Automated Decision-Making

Our service uses AI to automatically analyze photos and generate valuations. These automated decisions:

• Are used solely to provide the core scanning and appraisal functionality
• Do not have legal or similarly significant effects on you
• Can be reviewed or contested by contacting our support team
• Are supplemented by our content moderation team for flagged items

9. Your Rights

Under GDPR and applicable laws, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Delete your account and all associated data
• Portability: Receive your data in a machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to certain types of processing
• Withdraw Consent: Withdraw consent at any time where processing is based on consent

You can exercise most of these rights from your Profile settings, or by contacting us directly. We will respond to all requests within 30 days.

10. Cookies

We use essential cookies to maintain your session and preferences. We do not use third-party advertising cookies or tracking pixels. You can manage cookie preferences through your browser settings.

11. Children's Privacy

Curiosa Cabinet is intended for users aged 18 and older. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal data, please contact us immediately and we will delete the data.

12. International Transfers

Your data is primarily processed within the European Union. If data is transferred outside the EU, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email at least 14 days before they take effect. Your continued use of Curiosa after changes take effect constitutes acceptance of the updated policy.