Privacy Policy

This policy explains what information is collected from visitors to auctions.autokulturecollective.com, why, and what rights you have over it.

Who is responsible for your data

The data controller for this site is AutoKultureCollective (“AKC”, “we”, “us”), operated by Praveen Nandakumar Nallusamy. You can reach us at praveen@autokulturecollective.com with any question or request about your data.

What we collect, and why

You can read the site without an account. If you create one, we collect what you give us when you sign up; a few things also happen automatically in the background for every visitor.

Your account. When you sign up we store your first and last name, your email address, your password (stored only as a one-way encrypted hash — we can never see it), your membership level (Free or Plus) and the date you joined. We use this to let you sign in, show your profile, provide the features of your membership, and send the emails the account needs: confirming your address and resetting your password. We don’t send newsletters or marketing email. Our legal basis is that this processing is necessary to provide the account you asked for (Art. 6(1)(b) GDPR).

Server logs. Every request to this site — like a request to any website — is logged by our hosting and content providers as a normal part of operating a web server. These logs include your IP address, browser type, and request timestamps. We process them under our and our providers’ legitimate interest in keeping the site secure, diagnosing faults, and preventing abuse (Art. 6(1)(f) GDPR). We don’t use them to build a profile of individual visitors.

Analytics. We use Vercel Analytics to understand aggregate traffic — which pages are read, how many visits we receive, and roughly where visitors arrive from. This service is cookieless: it sets no tracking cookie, assigns no persistent identifier tied to you, and doesn’t track you across other sites. Our legal basis is the same legitimate interest in understanding and maintaining the site.

Cookies

We only use cookies that are strictly necessary for the site to do what you ask of it. If you sign in, our authentication provider, Supabase, stores a session cookie in your browser (named sb-…-auth-token) so that you stay signed in as you move between pages and come back later. It holds your login session and nothing else, is only ever sent to this site, and is removed when you sign out. If you never sign in, no cookie is set.

Because this cookie is essential to a service you’ve explicitly requested, it doesn’t require consent under §25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and the EU ePrivacy rules, which is why there is no cookie banner. We use no advertising, tracking, or analytics cookies. You can delete cookies in your browser at any time; doing so will sign you out. If we ever add cookies that aren’t strictly necessary, we’ll update this policy and ask for your consent first.

Who processes it

We use the following processors:

• Supabase Inc. — account sign-in and the database holding your account details. Our project is hosted in the EU (Frankfurt, Germany).
• Resend Inc. — delivers account emails (confirmation and password reset) from our domain, sent from its EU region (Ireland).
• Vercel Inc. — hosting, request logs, and analytics.
• Sanity.io — our content management platform, which serves the article text and imagery on this site.

All four are US-headquartered companies, so some data may be processed outside the European Economic Area even where it is stored in the EU. Each publishes data processing terms addressing these transfers (typically via Standard Contractual Clauses) — see Supabase, Resend, Vercel and Sanity for their current terms.

How long we keep it

We keep your account details for as long as your account exists. If you ask us to delete your account, we delete your account record and profile; email delivery logs held by Resend age out under its own retention window. We don’t independently store server logs — retention follows our providers’ standard windows (typically on the order of weeks). Aggregated analytics data is not tied to an individual visitor at all.

Third-party images

Vehicle photography featured in our auction reports is used under editorial permission from the relevant auction house and credited accordingly. This doesn’t involve collecting any personal data about site visitors.

Your rights

If you’re in the EU/EEA or UK, you have the right to ask us for access to, correction of, or erasure of your personal data, to restrict or object to our processing of it, and to receive a copy of it in a portable format. You can see the account details we hold on your account page; to correct them, delete your account, or make any other request, email us at the address above and we’ll respond within one month. You can also lodge a complaint with your local data protection authority — in Baden-Württemberg, the Landesbeauftragte für den Datenschutz und die Informationsfreiheit.

Changes to this policy

We may update this policy as the site evolves — for example, before paid Plus memberships launch we’ll add the payment provider here. The date at the top of this page reflects the last revision.