Privacy Policy

This page is maintained by Legacy Estate Collective to explain how personal information is handled on this website. Purchases and payment data are handled by eBay under eBay's own privacy terms, not by us.

1. Who we are

Legacy Estate Collective ("we", "us", "our") is a small, family-run reseller of estate finds, jewelry, and collectibles based in the United States. Our storefront and payment processing live on eBay; this website is primarily informational.

2. Information we collect

• Contact form submissions: the name, email address, and message content you enter on our contact page. Stored so we can respond to your inquiry.
• Account information (admin only): if you sign in to manage this site, we store your email and hashed authentication credentials via our platform provider.
• Basic request metadata: IP address, user-agent, and referring page as recorded automatically by our hosting provider for security and troubleshooting.

We do not knowingly collect information from children under 13 through this website.

3. What we do not collect on this site

• We do not process payment card, bank, or PayPal details on this site.
• We do not run advertising cookies, cross-site trackers, or behavioral advertising pixels.
• We do not sell or rent your personal information to third parties.

4. How we use your information

• To respond to contact-form questions and follow up on requests you initiate.
• To operate, secure, and improve the website (aggregate diagnostics, spam prevention, abuse investigation).
• To meet legal obligations (for example, responding to a lawful subpoena or preserving records related to a dispute).

5. Third-party services we rely on

The following services process limited data on our behalf. Your interactions with them are governed by their own privacy policies:

• eBay — hosts our storefront, processes transactions, handles buyer/seller messaging, and controls checkout data.
• AuctionNudge — pulls live public listing data from our eBay store to display on our homepage and Shop page.
• Lovable Cloud — hosts this site's application, database, and authentication for the admin dashboard.

Interactions with the AuctionNudge widget or with any eBay link on this site are subject to those providers' respective privacy notices.

6. Cookies and local storage

This site uses only strictly necessary cookies and browser storage required for the site to function — for example, keeping an admin session active. We do not use marketing, analytics, or advertising cookies without your explicit consent.

7. Data retention

• Contact-form submissions: retained for up to 24 months after the last correspondence, then deleted or anonymized.
• Admin account records: retained while the account is active and for a reasonable period afterward for security and audit.
• Request logs: retained by our hosting provider for a short operational window (typically no more than 90 days).

8. Data security

The site is served over HTTPS, and access to the admin dashboard requires authentication with role-based permissions. No online system is perfectly secure, so we recommend never sharing sensitive information (payment or government ID data) through the contact form.

9. Your rights

Depending on where you live, you may have the right to:

• Request a copy of the personal information we hold about you.
• Ask us to correct or delete that information.
• Object to or restrict certain processing.
• Withdraw consent for optional processing at any time.

To exercise any of these rights, email us via the contact page from the address associated with your inquiry. We respond within 30 days.

10. International visitors

We operate from the United States. If you access this site from outside the U.S., you understand and consent to your information being processed in the U.S., which may have different data-protection rules than your home country.

11. Changes to this policy

We may update this policy from time to time. Substantive changes will be reflected in the "Last updated" date at the top of this page. Continued use of the site after an update means you accept the revised policy.

12. Contact

Privacy questions or requests? Please use our contact form and include "Privacy" in your message.

13. Legal bases for processing (EEA/UK visitors)

Where the GDPR or UK GDPR applies to your visit, we rely on the following legal bases:

• Consent — for any optional processing you actively opt into (for example, if we later add an email newsletter).
• Legitimate interests — to secure the site, prevent abuse, and respond to inquiries you initiate.
• Contract performance — where processing is necessary to answer a pre-sale question or coordinate an order-related follow-up.
• Legal obligation — where we must retain or disclose information to comply with applicable law.

14. California residents (CCPA/CPRA)

If you are a California resident, you may request to (a) know the categories and specific pieces of personal information we hold about you, (b) delete personal information we collected from you, (c) correct inaccurate personal information, and (d) opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined by the CCPA/CPRA. Submit requests through the contact form; we verify identity by matching the request against contact information already on file.

15. Sub-processors

The following sub-processors may handle limited data on our behalf. Each is bound by its own security and privacy commitments:

• Lovable Cloud (Supabase) — application hosting, database, and authentication (United States / EU regions).
• Cloudflare — edge delivery, DDoS protection, and TLS termination.
• eBay — storefront hosting, checkout, buyer-seller messaging, and order fulfillment.
• AuctionNudge / Free Seller Tools — public listing, feedback, and profile widgets embedded on this site.

We update this list when sub-processors change materially. You can request the current list at any time via the contact form.

16. Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects about you.

17. Do Not Track and Global Privacy Control

Because we do not run advertising or behavioral tracking, "Do Not Track" and Global Privacy Control (GPC) signals do not change our processing. We honor deletion and access requests submitted by any reasonable means.

18. Security incident notification

In the unlikely event of a personal-data breach that is likely to result in risk to your rights, we will notify affected users and applicable regulators within the timeframes required by law (72 hours where the GDPR applies) and describe the nature of the incident, likely consequences, and steps taken to mitigate it.

19. How to complain

If you believe we have handled your personal information improperly, please contact us first — we take every complaint seriously and try to resolve issues promptly. You also have the right to lodge a complaint with your local data-protection authority (for example, the ICO in the UK or your state's attorney general in the U.S.).