Privacy Policy
Last updated: 13 September 2026
This policy explains what personal data CollectionPlnr collects, why, who we share it with, where it lives and what you can do about it. It is written to be read, not to be survived.
1. Who is responsible for your data
The data controller is KK London (Designs & Fashion) Limited, a company registered in England and Wales. Company number 12968488. VAT registration GB371399079. Registered address: 1 Davies Meadow, East Hanney, Wantage, OX12 0GG. CollectionPlnr is a trading name of that company.
For anything about your data, email [email protected] or call 020 7046 1295.
2. What we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Email address, name, username, password (stored only as a salted hash) | To create and secure your account and to contact you about it | Contract |
| Google account identifier, if you sign in with Google | To let you sign in without a separate password | Contract |
| Your collection: items, quantities, conditions, purchase prices, notes | This is the service. We store it, show it back to you and process it into counts, gaps and value estimates | Contract |
| Subscription status and Stripe customer and subscription identifiers | To run billing and give you the plan you paid for. Card details go to Stripe and never reach us | Contract |
| IP address at registration and at each login, and login timestamps | Security: detecting account takeover, abuse and automated signups | Legitimate interests |
| How you found us: referrer, landing page, and any campaign tags on the link you arrived through | To understand which channels bring people who stay, so we spend effort where it works | Legitimate interests |
| Email engagement: whether an email we sent was delivered, opened or clicked | To tell whether our emails are useful and reaching people, and to stop sending to addresses that bounce | Legitimate interests |
| Your email preferences and any unsubscribe or suppression flag | To respect what you have asked for and to keep a record that you asked | Consent, and legal obligation for the record |
| Analytics about pages visited and features used | To see what is used and what is broken | Consent - see section 5 |
We do not collect special category data, we do not ask for your date of birth, and we do not buy personal data from anyone.
3. Who we share it with
We do not sell your personal data. We share it only with the providers that make the service run, each processing it on our instructions:
- Stripe - payments and subscription management. Stripe receives your email and payment details directly and acts as its own controller for fraud prevention.
- Resend - sending account and service email, and reporting delivery, opens and clicks.
- Cloudflare - serving the site, and the Turnstile check that keeps bots off our forms.
- Google - sign-in with Google, and Google Analytics via Google Tag Manager.
- Pushover - alerting us when something needs a human, for example a new signup or a failed payment.
We may also disclose data where the law requires it, or to establish or defend legal claims. If the business is ever sold or transferred, your data may transfer with it, and we will tell you before that happens.
4. Where your data is stored
The application and its database run on servers in Helsinki, Finland, inside the European Economic Area. Some of the providers above process data outside the UK and EEA, including in the United States. Where that happens, transfers are covered by the safeguards those providers offer, such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.
5. Cookies and analytics
We set a session cookie when you sign in. That one is strictly necessary - without it you cannot stay logged in - and it needs no consent.
We also load Google Tag Manager and Google Analytics, which set their own cookies and record which pages you visit. Cloudflare sets cookies for security and bot detection.
Being straight with you: we do not yet show a cookie banner, so analytics currently load before you have had the chance to say no. That is being fixed, and until it is you can block analytics cookies in your browser settings or with a content blocker, and we will honour a Global Privacy Control signal where your browser sends one. Nothing in analytics is used to identify you personally or joined to your collection.
6. How long we keep it
Your account and collection data are kept for as long as your account is open. If you ask us to delete your account we remove it and your collection within 30 days, except where we have to keep something longer - billing and VAT records are kept for six years because HMRC requires it, and a suppression record of an unsubscribed email address is kept indefinitely so we do not email you again by accident.
Security logs such as login IP addresses are kept for up to 12 months. Analytics data is kept according to the retention setting in Google Analytics.
7. Your rights
Under UK GDPR you have the right to access your data, to have inaccurate data corrected, to have your data deleted, to restrict or object to processing, to withdraw consent at any time, and to receive your data in a portable format.
To exercise any of them, email [email protected]. We will respond within one month. There is no self-serve delete button in the account settings yet - deletion is currently a request we action by hand, and adding the button is on the list. Asking costs you nothing and we will not try to talk you out of it.
8. Public profiles
Some features let you publish part of your collection, for example a public profile page. These are optional and off unless you turn them on. Anything you publish can be seen by anyone, indexed by search engines and cached by third parties, and we cannot pull it back out of those caches once it is there.
9. Security
Traffic is encrypted in transit. Passwords are stored only as salted bcrypt hashes and never in a form we can read. Access to the production database is limited to the people who need it. No system is perfectly secure, and we will tell you and the ICO without undue delay if a breach affects your data.
10. Children
The service is not intended for under-16s and we do not knowingly collect their data. If you believe a child has given us personal data, tell us and we will delete it.
11. Changes to this policy
If we make a material change we will tell you by email or in the service before it takes effect. The date at the top always shows the current version.
12. Complaints
If you are unhappy with how we have handled your data, please tell us first at [email protected] so we can try to fix it. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or to your local supervisory authority if you are in the EEA.
See also our Terms of Service.