Privacy Policy — Legacy Estate Collective

This page explains how personal information is handled on this website. Purchases and payment data are handled by eBay under eBay's own privacy terms, not by us.

1. Who we are

Legacy Estate Collective ("we", "us", "our") is a small, family-run reseller of estate finds, jewelry, and collectibles based in Pennsylvania. Our storefront and payment processing live on eBay; this website is informational and hosts a few optional tools described below.

2. Information we collect

Contact form submissions: the name, email address, and message content you enter on our contact page, stored so we can respond.
Offers and questions: if you submit an offer or a question about an item, we store your name, email, message, and (for offers) the amount, along with a tracking code that lets you check the status of your submission without an account. We email you a confirmation and use the tracking code to look up status when you enter it on the Track page.
Sell / consign submissions: if you ask us to buy or consign items, we store your name, email, optional phone and location, the item details you enter, and the photos you upload. Photos are kept in private storage that only our team can view through short-lived links. We use this to review your items and reply to you; we may email you about your submission from our sending domain.
Newsletter subscription: if you subscribe, we store your email address, the source of the signup, and a record of your consent (the consent text and the date you agreed) so we can send occasional emails about new arrivals. You can unsubscribe at any time; doing so is recorded so we stop sending to that address.
Item alerts: if you set up an alert for a keyword or category, we store your email, the keyword/category, and a unique unsubscribe token used for one-click opt-out. We email you when a matching listing appears in our live catalogue.
Saved-item email watches and cross-device links: your wishlist is saved only in your browser's local storage by default (see Section 6). If you choose to add your email to "watch" your saved items, we store your email together with the saved listings under a private token. That token powers two things: (a) an email when a watched item's price drops or it leaves the store, and (b) a private restore link that reopens the same saved list on another device. Anyone who has that link can view and resync the list it points to, so treat it like you would any personal link, and use the one-click stop link in the email if you want to end the watch.
AI item finder queries: when you use the item finder to describe what you're looking for, your query and the current catalogue are sent to Lovable AI Gateway (our AI provider) to generate matching suggestions. We do not separately store your finder queries in our own database; the AI provider processes the request under its own terms to return a response to your browser.
Account information (admin only): if you sign in to manage this site, we store your email and hashed authentication credentials via our platform provider.
Basic request metadata: IP address, user-agent, and referring page, used for security, spam prevention (including our bot-verification challenge), and troubleshooting.
Email delivery records: we keep a log of which template was sent, to which address, and whether it was delivered, suppressed, or failed, so we can diagnose delivery problems and honor suppression requests.

We do not knowingly collect information from children under 13 through this website.

3. What we do not collect on this site

We do not process payment card, bank, or PayPal details on this site.
We do not run advertising cookies, cross-site trackers, or behavioral advertising pixels.
We do not sell or rent your personal information to third parties.

4. How we use your information

To respond to contact-form questions, offers, and item questions you initiate.
To send the newsletter, item-alert emails, and saved-item price-drop/restore emails you sign up for.
To generate item-finder suggestions in response to a query you submit.
To operate, secure, and improve the website (spam prevention, abuse investigation, diagnosing failed or suppressed emails).
To meet legal obligations (for example, responding to a lawful subpoena or preserving records related to a dispute).

5. Third-party services we rely on

The following services process limited data on our behalf. Your interactions with them are governed by their own privacy policies:

eBay — hosts our storefront, processes transactions, handles buyer/seller messaging, and controls checkout data.
Lovable Cloud (Supabase) — hosts this site's application, database, and authentication.
Lovable AI Gateway — processes item-finder queries and returns catalogue matches.
Lovable Emails — our transactional email provider, which sends confirmation, alert, newsletter, and reply emails from our notify.legacyestatecollective.com sending domain, and enforces suppression, retries, and rate limits on our behalf.
Cloudflare — provides the Turnstile bot-verification challenge used on our public forms and edge delivery/TLS for the site.

6. Local storage vs. remote storage

Your wishlist and recently-viewed items are stored only in your own browser's local storage by default — they never reach our servers and we cannot see them. That list stays local unless you actively opt in to the saved-item email watch described in Section 2, at which point the items you save at that moment are copied to our database under your email and a private token so we can email you and offer a cross-device restore link. Removing the local storage entry does not delete a watch you've already started; use the unsubscribe link in a watch email, or contact us, to stop it.

7. Data retention

We do not run an automatic deletion schedule for most records. In practice:

Contact messages, offers, and questions: kept until you ask us to delete them or we no longer need them to resolve your inquiry.
Sell / consign submissions and photos: kept until you ask us to delete them or we no longer need them to handle your submission.
Newsletter subscriptions: kept until you unsubscribe; an unsubscribed record is retained so we don't re-add the address, unless you separately ask us to delete it entirely.
Item alerts: kept until you use the one-click unsubscribe link or ask us to remove the alert.
Saved-item email watches: kept until you use the stop link in a watch email or ask us to delete the record behind your token.
Email delivery logs: kept for deliverability troubleshooting until deleted on request.
Admin account records: retained while the account is active and for a reasonable period afterward for security and audit.

In short: absent an automatic deletion process, we keep records until you unsubscribe, use a stop link, or ask us to delete them.

8. Data security

The site is served over HTTPS, and access to the admin dashboard requires authentication with role-based permissions. No online system is perfectly secure, so we recommend never sharing sensitive information (payment or government ID data) through the contact form.

9. Your rights and how to unsubscribe or request deletion

Depending on where you live, you may have the right to request a copy of the personal information we hold about you, ask us to correct or delete it, object to or restrict certain processing, or withdraw consent for optional processing at any time. In practice:

Newsletter: use the unsubscribe link in any newsletter email, or contact us.
Item alerts: use the one-click unsubscribe link in any alert email.
Saved-item email watch: use the stop link in any watch email.
Anything else (deletion of contact/offer records, account data, or a watch you can't locate a link for): email us via the contact page from the address associated with your submission, write to Legacy Estate Collective, 112 N Flowers Mill Rd, Unit #475, Langhorne, PA 19047, or call (484) 238-0039.

We respond to requests as soon as we can, and no later than 30 days.

10. International visitors

We operate from Pennsylvania, in the United States. If you access this site from outside the U.S., you understand and consent to your information being processed in the U.S., which may have different data-protection rules than your home country.

11. Changes to this policy

We may update this policy from time to time. Substantive changes will be reflected in the "Last updated" date at the top of this page. Continued use of the site after an update means you accept the revised policy.

12. Contact

Privacy questions or requests? Please use our contact form and include "Privacy" in your message.

13. Legal bases for processing (EEA/UK visitors)

Where the GDPR or UK GDPR applies to your visit, we rely on the following legal bases:

Consent — for the newsletter, item alerts, and saved-item email watch, all of which are opt-in.
Legitimate interests — to secure the site, prevent abuse, and respond to inquiries you initiate.
Contract performance — where processing is necessary to answer a pre-sale question or coordinate an order-related follow-up.
Legal obligation — where we must retain or disclose information to comply with applicable law.

14. California residents (CCPA/CPRA)

If you are a California resident, you may request to (a) know the categories and specific pieces of personal information we hold about you, (b) delete personal information we collected from you, (c) correct inaccurate personal information, and (d) opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined by the CCPA/CPRA. Submit requests through the contact form; we verify identity by matching the request against contact information already on file.

15. Sub-processors

The following sub-processors may handle limited data on our behalf. Each is bound by its own security and privacy commitments:

Lovable Cloud (Supabase) — application hosting, database, and authentication.
Lovable AI Gateway — processes AI item-finder queries.
Lovable Emails — sends transactional and marketing emails from our notify.legacyestatecollective.com domain.
Cloudflare — edge delivery, bot verification (Turnstile), and TLS termination.
eBay — storefront hosting, checkout, buyer-seller messaging, and order fulfillment.

We update this list when sub-processors change materially. You can request the current list at any time via the contact form.

16. Automated decision-making

The AI item finder suggests listings based on your query; it does not make any decision about you, and no automated decision-making or profiling that produces legal or similarly significant effects about you is used on this site.

17. Do Not Track and Global Privacy Control

Because we do not run advertising or behavioral tracking, "Do Not Track" and Global Privacy Control (GPC) signals do not change our processing. We honor deletion and unsubscribe requests submitted by any reasonable means.

18. Security incident notification

In the unlikely event of a personal-data breach that is likely to result in risk to your rights, we will notify affected users and applicable regulators within the timeframes required by law (72 hours where the GDPR applies) and describe the nature of the incident, likely consequences, and steps taken to mitigate it.

19. How to complain

If you believe we have handled your personal information improperly, please contact us first — we take every complaint seriously and try to resolve issues promptly. You also have the right to lodge a complaint with your local data-protection authority (for example, the ICO in the UK or your state's attorney general in the U.S.).