Privacy Policy & GDPR

This policy describes how we collect, use and protect your personal data, in accordance with the General Data Protection Regulation (GDPR: EU 2016/679).

1. Data controller

The data controller is Kévin Goncalves, sole trader operating the My Comics Collection service, registered with the Bobigny Trade and Companies Register (RCS) under number 984 703 991 (SIRET 984 703 991 00039), 32 avenue des Peupliers, 93370 Montfermeil, France. Contact: hello@mycomicscollection.com.

2. Data collected

When you use the website, the web app and the iPhone, iPad and Android apps, we collect the following data:

• Account data: email address, password (stored in hashed form, never in clear text), interface preferences (language, theme, currency).
• Sign-in with Google or Apple: if you choose this sign-in method, we receive your email address and an account identifier from Google or Apple. We never receive your Google or Apple password.
• Account security: if you enable two-step verification, a one-time code is sent to you by email at each sign-in; we keep the list of your signed-in devices (device type, date, IP address) so that you can sign them out remotely.
• Collection data: your comics (series, issues, condition, grade, purchase price, notes, tags), your wishlist and your target prices.
• Photos: the photos and covers you upload for your copies.
• Loans: if you use loan tracking, the name or nickname of the person you lend a comic to and the date of the loan. This information concerns a third party: enter only what is necessary, and inform the person if needed.
• Sharing link: if you create a public sharing link, the part of your collection that you choose to share becomes visible to anyone who has the link, until you deactivate it.
• Mobile apps: the iPhone, iPad and Android apps use the same account and the same data. Face ID, if enabled on iPhone, stays entirely on your phone: no biometric data is sent to us.
• Browsing data: access logs and IP address, for security purposes.
• Billing data: handled by Paddle, the seller of the subscription (see section 6). No banking data passes through our servers.
• Communications: your email address and your choice of whether or not to receive our marketing communications.
• Analytics data (Google Analytics 4): see section 9 below.
• Internal usage measurement (signed-in account): time spent, screen viewed, sign-in device, origin of sign-up: see section 10 below.

3. Legal basis and purposes

• Performance of the contract (Art. 6(1)(b) GDPR): creation and management of your account, provision of the service, synchronisation between your devices, emails necessary for the service (confirmation, security, billing).
• Legitimate interest (Art. 6(1)(f) GDPR): account security and prevention of abuse, internal usage measurement described in section 10.
• Consent (Art. 6(1)(a) GDPR): marketing communications and Google Analytics 4 audience measurement. You can withdraw your consent at any time.
• Legal obligation (Art. 6(1)(c) GDPR): retention of the records required by law.

4. Data retention

• Account, collection, photos and usage measurements: kept as long as your account exists, including after your subscription ends, so that you can get your collection back. They are deleted when you delete your account from your settings; only a minimal record remains, without any email address, showing that an account was deleted.
• Last ten sign-ins: beyond ten, the oldest is deleted automatically.
• Invoices and payment data: kept by Paddle, the seller of the subscription, according to its own legal obligations.
• Marketing contact at Brevo: kept until you unsubscribe or ask for deletion at hello@mycomicscollection.com.
• Google Analytics 4: 2 months (see section 9).

5. Your rights

Under the GDPR, you have the rights of access, rectification, erasure, portability, restriction and objection, as well as the right to withdraw your consent at any time. You can export your collection in CSV format and delete your account directly from your settings. For any other request: hello@mycomicscollection.com. We reply within one month.

If you believe your rights are not being respected, you may lodge a complaint with the CNIL (the French data protection authority, Commission nationale de l'informatique et des libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

6. Processors and transfers

We do not sell or rent your data. It is processed by the following providers, only for the needs of the service:

• OVH (France): hosting of the website, the app and the database, in France.
• Paddle (Paddle.com Market Limited, United Kingdom): seller of the subscription, payment, invoicing and taxes. The United Kingdom benefits from an adequacy decision of the European Commission.
• Brevo (Sendinblue SAS, France): sending of service-related emails and, if you have consented, marketing communications; your email address and your consent choice are synchronised there.
• Google: sign-in with a Google account, if you choose it, and Google Analytics 4 audience measurement with your consent (see section 9).
• Apple: sign-in with an Apple ID, if you choose it.
• eBay: the value estimate queries eBay's public listings using the title and issue number of the comic; no personal data is sent.

Where data is processed outside the European Union, these transfers are covered by an adequacy decision or by the European Commission's standard contractual clauses.

7. Cookies

See our Cookie Policy for details on the trackers used.

8. Contact

For any question about your data: hello@mycomicscollection.com.

9. Google Analytics 4 (audience measurement)

We use Google Analytics 4 (GA4) to measure the audience of our site and improve the user experience. Measurement ID: G-KLWS3X63GK.

Data collected by GA4:

• Pages visited, session duration, bounce rate
• Traffic source (search engine, social network, direct link)
• Device type, browser, operating system, language
• Country and approximate city (based on the IP address, never the exact address)
• Conversion events: clicks on CTAs, PDF downloads, views of the pricing page, newsletter form submissions
• AI referrers: detection of whether you arrive from ChatGPT, Perplexity, Bing Copilot, Claude, Gemini, You.com or DuckAssist (used to measure the impact of AI search engines, no personal data transmitted)

Custom events we track: cta_click, cta_view, cta_estimation_click, cta_signup_click, trial_signup_intent, pricing_view, pricing_direct_visit, feature_view, pdf_download, popup_view, email_capture, ai_search_referral.

Features of our GA4 configuration:

• IP anonymisation: enabled by default in GA4: your IP address is never stored in full
• No personally identifiable data is sent to Google (no name, email or password)
• Retention period: 2 months (GA4 default setting, the shortest possible)
• Data shared with Google: disabled (no signal sharing, no advertising features)
• Hosting: Google servers (US and EU regions in accordance with the European Standard Contractual Clauses)

Legal basis: your consent (Art. 6(1)(a) GDPR), collected via the cookie banner on your first visit. You can withdraw this consent at any time via the "Manage cookies" link in the footer.

Your specific rights regarding Google Analytics:

• Refuse tracking via our consent banner
• Install the Google Analytics Opt-out browser add-on in your browser

Reference: see Google's privacy policy and the details of the data collected by GA4.

10. Internal usage measurement of the service

Independently of Google Analytics, and only when you are signed in to your account, we measure how the service is used in order to understand where our app is hard to use and to improve it. This data stays on our servers and is not passed on to any third party.

Data measured:

• Time of use: your browser signals its presence every minute while the tab is active, which allows us to calculate a session time. No signal is sent while the tab is in the background.
• Screen viewed: the generic name of the section displayed (for example "collection", "catalogue", "settings"). We never record the content you view there, nor the comics concerned.
• Sign-in device: device type, operating system and browser, inferred from your browser's technical header.
• Last ten sign-ins: date, device and IP address. Beyond ten, the oldest is automatically deleted.
• Origin of your sign-up: the domain of the site you first arrived from (for example "google.com"), the landing page and, where applicable, the campaign name. The full address of the originating page is never kept.
• History of your plan changes: date and nature of the change.

What we do not do: no recording of your sessions, no tracking of your mouse movements or keystrokes, no resale or sharing of this data, and no cross-referencing with external sources.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR): ensuring the proper functioning of the service, detecting usability defects and preventing abusive use. You can object to this measurement or ask for its deletion at any time: hello@mycomicscollection.com.

Retention: these usage measurements are kept for the lifetime of your account and deleted along with it.