Last updated: 13th September 2026 · Operator: Collauth Pty Ltd (ABN 36701344470) · Contact: support@collauth.ai
What we collect
Account. Your email address and, if you sign in that way, your linked social or wallet identity. Authentication is handled by Privy, which creates and holds the keys for the wallet in your account.
Profile. Your display name and avatar, and the ratings and comments other members leave about you.
Items. The photographs you upload for authentication, and everything derived from them — identification, condition and grade, estimated value, and the authenticity assessment.
Transactions. What you bought and sold, when, and for how much. Card details are entered directly with our payment processor and are never held by Collauth; we keep only the processor's reference and the last-four digits it returns.
Delivery. Postal addresses you save or enter at checkout, and the tracking information carriers return.
Technical. Log and error data, including IP address and device information, and — if you enable notifications on a mobile device — a push token.
Usage analytics (only if you agree). If you accept the analytics prompt, we record which pages you visit and which features you use, linked to your account identifier, so we can see what to improve. Nothing is collected before you agree, and you can turn it off at any time in Settings.
How we use it
To run your account, authenticate and value items, process payments and payouts, arrange delivery, prevent fraud and abuse, meet our legal obligations, and notify you about your own activity. We do not sell your personal information, and we do not use it for advertising.
Who it is shared with
Collauth relies on the following providers, several of which are located overseas. Sharing is limited to what each needs to perform its function.
| Provider | Purpose | Location |
|---|---|---|
| Privy | Sign-in and wallet key management | United States |
| Supabase | Database and file storage | Singapore (AWS ap-southeast-1) |
| Stripe | Card payments, seller payouts, identity checks for payouts | United States / Australia |
| Anthropic | AI authentication and valuation of item photographs | United States |
| ShipStation / carriers | Postage rates, labels and tracking | United States / Australia |
| Mapbox | Address search | United States |
| Resend | Notification email | United States |
| Sentry | Error monitoring | United States |
| Amplitude | Usage analytics (only with your consent) | United States |
| Pinata (IPFS) | Certificate metadata and images | Distributed |
We also disclose information where the law requires it, or to establish or defend a legal claim.
What cannot be deleted
Two parts of Collauth are permanent by design, and you should understand this before minting a certificate.
The blockchain record. Certificates are issued on the Solana blockchain. Certificate issuance, ownership and transfers are recorded publicly and permanently. That record includes your wallet address and can be read by anyone. It cannot be edited or erased by us or by anyone else.
Certificate files. A certificate's images and metadata are stored on IPFS, a distributed storage network. Once published they may be copied by other nodes and cannot be reliably withdrawn.
Neither contains your name, email or address — but a wallet address is a durable identifier, and anyone who learns it can see everything that wallet has done.
Your choices
You can view and correct your profile and saved addresses in Settings, and turn off notification emails there. Usage analytics is opt-in: it only runs if you accepted the prompt, and the Privacy section in Settings switches it off again.
You can close your account yourself, from Settings. We do not delete it immediately: the request starts a 30-day period during which you can still sign in and read your orders but cannot buy, sell or trade. You can cancel the request at any point in that period from the same page in Settings. Your storefront stops being public as soon as you ask.
Some obligations have to be settled before you can close your account, and Settings lists whichever apply to you: a certificate still in your wallet, a listing still on sale, an order or a trade still in progress, an open dispute, a balance, money we owe you or you owe us, or an item we are physically holding for you. This is the same principle the Terms state — closing your account does not release you from obligations already owed on open transactions.
After 30 days we remove your name, email address, wallet address, payment account reference, contact details, storefront and saved addresses, and delete your saved searches, watchlists, follows and notifications. Some records stay, because they are not only about you: your order history, the ratings you wrote about other sellers, the messages in conversations you were part of, and reports made about your account. These appear to other people as coming from a deleted member. We must also retain transaction records for the period required by tax and anti-money-laundering law, and we cannot remove the blockchain and IPFS records described above. Your storefront handle is retained as an unreadable one-way hash so that nobody else can claim it and inherit links pointing at your former shop.
You can also ask us to provide a copy of the personal information we hold about you, or correct it, by contacting support@collauth.ai. We will respond within 30 days.
Security
Access to production data is restricted and audited. Payment card data never reaches our systems. No system is perfectly secure; if a data breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Privacy Act requires.
Complaints
Contact us first at support@collauth.ai. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Changes
We will post any change to this policy here and update the date above. Where a change materially affects how we use your information, we will tell you directly.