I know everything about LEGO.
Try me.
We hold as little about you as the service needs, we tell you exactly who touches it, and we never sell it. This policy explains what Ashlard collects, why, who processes it on our behalf, and the control you keep over it.
Last updated: 13 June 2026.
Ashlard is operated by Collectiom OÜ, a private limited company registered in Estonia (registry code 17512840), registered address Viru väljak 2, 10111 Tallinn, Estonia. Collectiom OÜ is the data controller for the personal data described here. For any privacy question, or to exercise the rights in §8, contact support@collectiom.com or use our contact page.
Account data — your email address, an optional display name, and an authentication credential (your password is stored only as a salted hash by our authentication provider; we never see it). Preferences — your chosen currency and email settings. Your collection — the sets and minifigures you mark as owned or watched, and any target prices you set. Atlas conversations — the messages you send to the Atlas companion and its replies, stored so your history persists. Billing data — handled by Stripe (see §5); we store only your Stripe customer and subscription identifiers, your plan, and its status — never your card number. Usage analytics — aggregate, cookieless page statistics that do not identify you.
We process your data to provide the service you asked for — your account, collection, Atlas, and subscription (legal basis: performance of a contract); to keep the platform secure and improve it (legitimate interests, balanced against your rights); to send you optional emails such as retirement alerts and the weekly digest, which you control in settings and can turn off at any time (consent); and to meet our legal obligations, such as tax and accounting records (legal obligation). We do not sell your personal data, and we do not use it for third-party advertising.
We rely on a small set of vetted sub-processors, each handling only what their function requires: Supabase (database, authentication, and storage; hosted in the EU); Vercel (application hosting and delivery); Stripe (payment processing and billing); Anthropic (the model behind Atlas — the messages you send to Atlas are processed to generate its replies); and Plausible (privacy-first, cookieless analytics). Each acts under a data-processing agreement and may not use your data for its own purposes.
Subscriptions are processed by Stripe, which collects and stores your payment details directly under its own PCI-compliant systems and privacy policy. Ashlard never receives or stores your full card number. We retain only the identifiers needed to recognise your subscription and open your billing portal. Stripe collects the billing name and address required for payment and tax — that information is held by Stripe as part of your transaction.
Your data is stored in the EU where we can choose, but some sub-processors (notably Stripe and Anthropic) operate in the United States. Where data leaves the EEA, the transfer is covered by appropriate safeguards — typically the European Commission’s Standard Contractual Clauses — so your protection travels with it.
We keep your account data for as long as your account is open. When you delete your account, your profile, collection, watchlist, and Atlas history are removed promptly, except where we must retain limited records to meet a legal obligation (for example, billing records for tax). Aggregate analytics, which do not identify you, may be retained indefinitely.
Under the GDPR you may request access to your data, correct it, delete it, export it in a portable form, restrict or object to certain processing, and withdraw any consent you have given — without affecting processing already carried out. You can delete your account and export your collection yourself from settings, or contact us for anything else. You also have the right to lodge a complaint with a supervisory authority — in our case the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), or the authority in your own country.
Ashlard uses only strictly necessary cookies — the ones that keep you signed in. Our analytics (Plausible) are cookieless and never track you across sites, so we do not set advertising or tracking cookies and do not need a cookie-consent banner. Your theme preference is stored locally in your browser, not on our servers.
Access to your data is scoped to your account by row-level security, credentials are encrypted in transit, and sensitive operations run only on trusted servers. No system is perfectly secure, but we hold the platform to a standard a serious collector should expect, and we will notify you and the relevant authority of a breach where the law requires it.
Ashlard is built for adult collectors and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will remove it.
We may update this policy as the service evolves. When we make a material change we will update the date above and, where appropriate, tell you directly. Continued use after a change means you accept the updated policy.