This Privacy Policy explains how NDI Studio Informatikai Kft. (“NDI Studio”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects personal data when you use Collsta, including the Collsta mobile applications and related services (collectively, the “Service”).
1. DATA CONTROLLER
The data controller responsible for the processing described in this Privacy Policy is:
NDI Studio Informatikai Kft.
H-1121 Budapest, Fülemile út 12-18. 5B
Hungary
Company registration number: 01-09-201326
Email: hello@collsta.com
2. SCOPE
This Privacy Policy applies to personal data processed through Collsta and related account, authentication, support, security, email, and account-deletion functions.
Third-party websites, applications, and services may have their own privacy practices. Their privacy policies apply to data they process independently.
3. PERSONAL DATA WE COLLECT
3.1 Account and profile data
When you create and use a Collsta account, we may collect and process:
- name;
- email address;
- date of birth;
- account and profile identifiers;
- email-verification status;
- authentication and account-security information; and
- account creation, update, and deletion information.
Date of birth is used to determine whether a user meets the minimum age requirement for the Service.
Collsta should not collect gender as a required profile field unless and until a specific present processing purpose and lawful basis have been established and disclosed. Gender is therefore not included in the data collection described by this publication version of the Privacy Policy.
3.2 Email and password authentication
If you register using email and password, Collsta processes your email address and authentication information necessary to create and secure your account. Passwords are not stored in plain text.
3.3 Google and Apple sign-in
If you use Google Sign-In or Sign in with Apple, we may receive authentication information made available by the selected provider, such as:
- a provider-specific account identifier;
- email address;
- name, where provided by the provider; and
- information necessary to validate the authentication request and create or access your Collsta account.
Google and Apple also process information when you use their authentication services under their own privacy policies.
Collsta does not automatically merge a Google or Apple identity with an existing Collsta account solely because the email addresses match.
3.4 Content you save in Collsta
When you use the Service, we process information you choose to save or create, including:
- saved URLs and normalized/canonical URL information;
- board names and board organization;
- tags;
- titles;
- descriptions;
- notes;
- platform or source information;
- publicly available link metadata, including thumbnail URLs; and
- timestamps and other information necessary to organize and manage saved items.
Collsta stores links and metadata. It does not, as part of its current service design, download, host, or provide playback of the underlying third-party media referenced by saved links.
When Collsta retrieves metadata for a saved URL, the Collsta server may contact the linked website to retrieve public page metadata. The operator of that website may therefore receive technical information associated with the request, such as the requesting server’s IP address and the requested URL.
3.5 Server logs and security data
We may automatically collect limited technical information when you use Collsta, such as:
- IP address;
- request date and time;
- request method and endpoint;
- response status;
- request identifiers; and
- device, application, or browser information where available in the relevant request.
We use this information to operate, secure, troubleshoot, and protect the Service, including detecting abuse and security incidents.
3.6 Transactional email data
Collsta may send service-related emails, including account verification and other transactional messages. For this purpose, we process information necessary to send the message, including the recipient email address and message content.
3.7 Communications with us
If you contact us, we process the information contained in your message and any contact details you provide in order to respond to your request and maintain appropriate records of the communication.
4. WHY WE PROCESS PERSONAL DATA AND OUR LEGAL BASES
Where the General Data Protection Regulation (“GDPR”) applies, we process personal data on one or more of the following legal bases:
4.1 Performance of a contract
We process data where necessary to:
- create and maintain your Collsta account;
- authenticate you;
- provide saved-link, board, tag, note, and metadata functions;
- synchronize and operate the Service;
- provide account-related communications;
- process account deletion; and
- enforce eligibility requirements applicable to the Service.
This processing is based on Article 6(1)(b) GDPR where applicable.
4.2 Legitimate interests
We process limited technical, security, and operational information where necessary for our legitimate interests in:
- protecting user accounts and the Service;
- preventing abuse, fraud, and unauthorized access;
- maintaining service availability and reliability;
- troubleshooting technical problems; and
- establishing, exercising, or defending legal claims.
This processing is based on Article 6(1)(f) GDPR where applicable. We consider the necessity and impact of such processing and apply safeguards appropriate to the relevant risk.
4.3 Legal obligations
We may process or retain personal data where necessary to comply with a legal obligation applicable to us. This processing is based on Article 6(1)(c) GDPR where applicable.
4.4 Consent
Where a feature or processing activity legally requires consent, we will request consent before carrying out that processing. Where processing is based on consent, you may withdraw your consent at any time, without affecting processing that was lawful before withdrawal.
5. ADVERTISING, PROFILING, AND TRACKING
Collsta does not currently display advertising and does not currently use personal data for targeted advertising or advertising personalization.
Collsta does not currently operate an advertising profile based on your profile data.
If we introduce advertising, advertising personalization, or another materially different use of personal data in the future, we will update this Privacy Policy before beginning that processing and will obtain consent or provide other legally required controls where applicable.
We do not sell personal data.
6. SERVICE PROVIDERS AND THIRD PARTIES
We disclose personal data only where necessary for the operation of the Service, where required by law, or where another lawful basis permits the disclosure.
Current relevant service providers and third-party services include:
6.1 RackForest
Collsta’s production server infrastructure is hosted on a RackForest VPS in Hungary. Personal data stored in the live Collsta PostgreSQL database is processed on this infrastructure.
6.2 Resend
Collsta uses Resend, operated by Plus Five Five, Inc., to deliver transactional email. Information sent through Resend may include an email address, email metadata, and message content.
Resend stores customer data in the United States. Resend provides a Data Processing Addendum that includes transfer safeguards for transfers of personal data from the European Economic Area, including Standard Contractual Clauses.
6.3 Google
If you choose Google Sign-In, Google processes your interaction with its authentication service and provides Collsta with the authentication information necessary for the sign-in process. Google’s own privacy terms apply to Google’s independent processing.
6.4 Apple
If you choose Sign in with Apple, Apple processes your interaction with its authentication service and provides Collsta with the authentication information necessary for the sign-in process. Apple’s own privacy terms apply to Apple’s independent processing.
6.5 Linked websites
When Collsta retrieves public metadata from a URL you save, the website associated with that URL receives a request from Collsta’s server. That website processes the request according to its own privacy practices.
We do not permit service providers acting on our behalf to use personal data for purposes unrelated to providing the contracted service, except where independently permitted or required by law.
7. INTERNATIONAL DATA TRANSFERS
Collsta’s primary production server and its local backup infrastructure are located in Hungary.
Some service providers may process personal data outside Hungary or outside the European Economic Area. In particular, Resend stores customer data in the United States.
Where GDPR transfer restrictions apply, we use or rely on an appropriate transfer mechanism where required, such as an adequacy framework, Standard Contractual Clauses, or another lawful safeguard.
8. DATA RETENTION
We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, subject to applicable legal requirements.
8.1 Active account data
Account information and user content are generally retained for as long as your Collsta account remains active and as necessary to provide the Service.
8.2 Account deletion
When an account deletion is completed, associated personal data is deleted from Collsta’s normal live operational systems, except where retention is required or permitted for a legitimate legal, security, fraud-prevention, or legal-claims purpose.
Deleted data may remain temporarily in encrypted backups and recovery-only snapshots until the applicable backup retention period expires. Such retained backup copies may remain for up to approximately 13 months.
These backup and snapshot copies are maintained for disaster-recovery and system-restoration purposes and are not used as ordinary live application data.
8.3 Server and application logs
Standard server and application logs are generally retained for up to 30 days and then automatically deleted.
Relevant records may be retained for longer where reasonably necessary to investigate a security incident, prevent abuse, establish or defend legal claims, or comply with applicable law.
8.4 Legal retention
If applicable law requires us to retain specific information for longer, we will retain only the information necessary for the required period and purpose.
9. ACCOUNT AND DATA DELETION
You can initiate deletion of your Collsta account and associated personal data:
- from the account/settings area within the Collsta application; and
- through Collsta’s web-based account deletion resource available through collsta.com and identified in the relevant app-store listing.
The web-based deletion resource is intended to allow a deletion request to be initiated even if you no longer have the Collsta application installed.
We may require reasonable authentication or identity verification to protect accounts against unauthorized deletion requests.
Account deletion means deletion of the account and the personal data associated with it; temporary deactivation or account freezing is not treated as account deletion.
Deletion from backup and recovery systems follows the retention process described in Section 8.
10. YOUR DATA PROTECTION RIGHTS
Depending on applicable law, including the GDPR, you may have the right to:
- obtain information about how your personal data is processed;
- request access to your personal data;
- request correction of inaccurate or incomplete personal data;
- request deletion of your personal data;
- request restriction of processing;
- receive certain personal data in a structured, commonly used, machine-readable format and exercise data portability where applicable;
- object to processing based on legitimate interests;
- object at any time to processing for direct marketing;
- withdraw consent at any time where processing is based on consent; and
- lodge a complaint with a competent supervisory authority.
To exercise your rights, contact us at hello@collsta.com.
We may request information reasonably necessary to verify your identity before acting on a request.
Where the GDPR applies, we will respond without undue delay and generally within one month, subject to extensions or exceptions permitted by applicable law.
11. SUPERVISORY AUTHORITY
If you are in Hungary, you have the right to lodge a complaint with:
Hungarian National Authority for Data Protection and Freedom of Information
(Nemzeti Adatvédelmi és Információszabadság Hatóság – NAIH)
1055 Budapest, Falk Miksa utca 9-11.
Hungary
You may also have the right to complain to another competent data-protection authority based on your place of residence, work, or the location of the alleged infringement.
12. CHILDREN AND AGE REQUIREMENTS
Collsta is intended for users who are at least 13 years old.
We do not knowingly permit persons under 13 to create Collsta accounts.
Where applicable law requires parental authorization for consent-based processing involving a minor, we will obtain the legally required authorization before carrying out that consent-based processing.
If we become aware that personal data has been collected from a person who is not eligible to use the Service, we will take appropriate steps to delete or otherwise lawfully handle that information.
13. DATA SECURITY
We use technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction.
These measures include access controls, secure authentication practices, encrypted communications where applicable, and encrypted backup storage.
No information system can be guaranteed to be completely secure. Users should protect their own account credentials and devices.
14. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy when the Service, our data practices, or applicable legal requirements change.
If a change materially affects how we use personal data, we will provide appropriate notice before the new processing begins where required by law.
The effective date shown at the top of this Privacy Policy identifies the current version.
15. CONTACT
For privacy questions, data-protection requests, or account-deletion questions, contact:
NDI Studio Informatikai Kft.
H-1121 Budapest, Fülemile út 12-18. 5B
Hungary
Email: hello@collsta.com
Company registration number: 01-09-201326