Legal information
Privacy policy
The data Numismatista processes, why, with which providers, for how long — and how to exercise your rights.
Last updated: 12 October 2026
In short
- We collect what is needed to run your cabinet: your email address, your collection and its photos, your analyses, your payments.
- Nothing is sold, nothing is used for advertising. No advertising or audience-tracking tool is used.
- Your photos are sent to our artificial intelligence provider only to produce the analysis you request.
- You can export your data and delete your account at any time, from the app.
Data controller
[Company name, or the sole trader's full name]
[Legal form: sole trader, SAS, Sàrl…] [with a share capital of €…]
[Full postal address]
[Trade and companies register (RCS) / SIREN no. — or, in Switzerland, UID no. CHE-…]
[EU VAT number — or “VAT not applicable, art. 293 B of the French General Tax Code”]
Contact: contact form · [contact email address]
Data we process
| Data | Why | Legal basis |
|---|---|---|
| Email address, password (encrypted, never readable by us), language, currency | Create and secure your account, write to you about the service | Performance of the contract |
| Collection: photos, measurements, attributions, grade, notes, purchase prices, estimates, provenance | Keep your cabinet, produce records and inventories | Performance of the contract |
| Analyses: photos sent, results, corrections you make | Identify, read, grade; measure and improve the reliability of the service | Performance of the contract; legitimate interest (service quality) |
| Credits, subscriptions, invoices | Billing, accounting | Performance of the contract; legal obligation |
| Share links: recipient if any, number of views | Run and secure sharing | Performance of the contract |
| Contact form messages: name, email, message | Reply to you | Legitimate interest; your request |
| Technical logs (IP address, date, errors) | Security, abuse prevention, troubleshooting | Legitimate interest |
We collect no card details: payment is entered directly with Stripe. We only receive the payment status, its amount and the customer identifier assigned by Stripe.
Your photos and artificial intelligence
When you run an analysis, the photos and measurements of the coin concerned are sent to Anthropic (United States), which provides the artificial intelligence model. They are used only to produce the requested result. Under Anthropic's commercial terms applicable to our account, this content is not used to train its models.
Do not include information unrelated to the coin in your photos (documents, faces, addresses).
Recipients and providers
Your data is accessible only to the publisher and to the technical providers below, each for its own task only:
- OVH SAS (France) — hosting of the website and the app.
- Supabase, Inc. — database, accounts and photo storage, on servers located in [Supabase project region].
- Anthropic PBC (United States) — artificial intelligence analyses.
- Stripe Payments Europe Ltd (Ireland) — payments and billing.
- [Email delivery provider, if separate: name, country.]
A collection is visible to a third party only if you create a share link yourself, with the information you chose to show. Every link can be revoked at any time.
Transfers outside the European Union
Some providers (Anthropic, and where applicable Stripe or Supabase) may process data in the United States. These transfers are covered by the safeguards provided for by the GDPR: an adequacy decision (EU-U.S. Data Privacy Framework) where the provider is certified, or the European Commission's standard contractual clauses.
Retention periods
- Account, collection, photos, analyses: for as long as your account exists. Deleting the account permanently erases everything [, and an account inactive for three years is deleted after a warning email].
- Invoices and accounting records: ten years, as required by law, even after the account is deleted.
- Contact form messages: for as long as it takes to handle your request, then three years at most.
- Technical logs: twelve months at most.
- Backups: deleted data disappears from backups at the end of their rotation cycle [duration, e.g. 30 days].
Your rights
You have the right to access, rectify, erase, restrict, object to the processing of and port your data, and to give instructions on what happens to it after your death.
- In the app: edit your details, export your records and inventory as PDF, delete your account (Profile page).
- For any other request: the contact form, topic “Personal data”, from your account's email address. We reply within one month at most.
If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority of your country of residence [or, in Switzerland, the Federal Data Protection and Information Commissioner, edoeb.admin.ch].
Security
Encrypted connections (HTTPS), passwords stored in encrypted form, access to each account's data restricted to its holder by rules enforced in the database itself, share links that cannot be guessed and can be revoked, payments handled exclusively by Stripe.
Changes
This policy may change as the service evolves. In case of a significant change, you will be notified by email or in the app before it takes effect.
Language
This page is a translation of the French version, provided for convenience. In case of discrepancy, the French version prevails.