• What information we collect, and why we use it.
• Which companies receive it.
• How long we keep it.
• What you can do to see, correct, or delete it.

Who we are

Luis Alejandro Medina Chávez runs Legendsverse and decides how your information is used. To ask a question about your data, write to amedina@mylegendscollection.com or use our contact page.

Information we collect

• Account information. Your name, username, email address, and password. We store the password only as a hash. If you sign in with Google or Facebook, we receive your name and email address from that company.
• Collection information. The figures that you own, want, or have on order. Also the notes, the prices you paid, and the photos that you add to them.
• Content that you post. Your profile, displays, reviews, posts, comments, likes, and messages to other members or to us.
• Payment information. Your plan, your payment dates and amounts, and the transaction references. Stripe or PayPal processes your card or account. We never receive or store your full card number.
• Usage information. The pages that you open and the buttons that you press, your IP address, your browser, your device type, and your approximate location. The sections on advertising and product analytics below give the details.
• AI assistant information. The requests that a connected AI assistant sends for your account. The section on AI assistants below gives the details.

How we use your information

• To run your account, and to show your collection, its value, and your progress on each toy line.
• To take payments and to manage your plan.
• To send you account email, for example a password reset or a receipt.
• To send you news about new figures and features. Each of these emails has an unsubscribe link.
• To measure which adverts bring collectors to the site.
• To find errors, and to decide what to build and what to fix.
• To stop spam, fraud, and abuse.
• To obey the law, for example tax law.

We do not sell or rent your information to anyone. We do not use your information to train AI models.

Advertising and measurement

We advertise Legendsverse on Facebook and Instagram. To know which adverts bring collectors to the site, we send a small set of data to Meta Platforms, Inc. This is on by default when you use the site.

We send data for four things only: a page view, a completed registration, the start of a checkout, and a completed purchase. We do not send what you collect, what you add to a wishlist, or anything else you do inside the app.

The data we send is:

• Your email address, hashed. We never send the address itself.
• Meta's own cookie and click identifiers, if your browser carries them.
• Your IP address and your browser user agent.
• The page path you were on. We remove the query string.
• Your account identifier on this site.
• For a purchase, the amount, the currency, and the transaction reference from the payment provider.

If you have an account, you can turn this off. Open Settings, then Privacy, and turn off "Advertising measurement (Meta)". The Meta pixel then does not load for you, and we do not send your events to Meta. The switch applies to your account on every device where you sign in.

If you are not signed in, the site still loads the Meta pixel. For that case you have two options. You can use the advert and tracking controls in your browser and on your device, and the advert preferences on your own Meta account. You can also write to us at amedina@mylegendscollection.com or through our contact page, and ask us to stop sending your data.

Two limits apply. Stopping future collection does not delete data that Meta already received. A send that is already in progress can finish.

Product analytics and session recording

We use PostHog to understand how people use Legendsverse. It runs on every page, for every visitor, whether or not you have an account. We use it to see which pages people reach, where they give up, and which parts of the product they never find.

PostHog records what you do on the site: the pages you open, the buttons you press, and how long a page takes to answer. It also records your approximate location, your browser, and your device type. If you do not have an account, we do not build a profile of you. We keep those events, but we do not join them to a person until you register.

PostHog also records your session as a replay, so we can watch how a page behaved when something went wrong. We mask every field you type into. Your password, your email address, and the prices you enter for the figures you own are all hidden before the recording leaves your browser. We see where you clicked and what the page looked like. We do not see what you typed.

We also use Plausible to count page views. Plausible does not use cookies.

We do not sell this data and we do not send it to advertisers. We use it to decide what to build and what to fix.

If you have an account, you can turn this off too. Open Settings, then Privacy, and turn off "Product analytics (PostHog)". PostHog then does not load for you, and we do not send your events to PostHog.

If you are not signed in, PostHog still runs. You can use the tracking controls in your browser and on your device. You can also write to us at amedina@mylegendscollection.com or through our contact page, and ask us to stop.

AI assistants (ChatGPT, Claude, and others)

You can connect an AI assistant, such as ChatGPT or Claude, to your Legendsverse account. The assistant gets access only after you sign in and select "Allow access". The assistant can then use the Legendsverse tools for you.

What the assistant sends to us. When you ask the assistant a question, it picks a tool and sends us only the values for that tool:

• Search words, for example "Black Series Ahsoka", a character name, or a UPC.
• A toy line name, a release year, and a page number.
• The Legendsverse id of a figure to show, add, or remove, and whether to add or remove more than one copy.

We do not receive the rest of your conversation with the assistant.

What we send back to the assistant.

• Catalog information that is public on our site: figure names, lines, waves, release years, UPCs, retail prices, market values, images, and page links.
• From your account: your name, your plan, the number of figures you own and want, the estimated value of your collection, the figures in your collection and in your wishlist, the figures of a toy line that you do not own yet, and your free-plan limits.

We do not send your email address, your password, your payment details, your messages, your notes, or the prices you paid.

What the assistant can change. It can add figures to your collection and to your wishlist, and remove figures from your collection. We save these changes in your account in the same way as changes that you make on the website.

What we record.

• The connection: the name of the assistant, the date that you connected it, and an access token. We use this record to let the assistant in and to show the connection in your settings.
• For each use of a tool that reads or changes your account, an analytics event in PostHog with the tool name and the assistant name, linked to your account. We use it to count how many members use each tool. If you turn off "Product analytics (PostHog)", we do not send these events.
• If a tool fails, an error report in Rollbar. The report can include the request that failed.

Apart from error reports, we do not store your search words or the answers that we send.

Who else receives it. The questions you ask and the answers that Legendsverse sends go through the company that runs the assistant, for example OpenAI or Anthropic. The privacy policy of that company applies to that data.

How to stop it. Open Settings, then Privacy, and disconnect the assistant under "AI assistants". We then cancel its access token at once, and the assistant cannot read or change your account again. If you delete your account, every connection stops too.

Companies that receive your information

We share your information only with the companies below, and only for the purpose that we give.

• Stripe and PayPal: to take payments. They receive your name, your email address, and your payment details.
• Amazon Web Services: to store the photos that you upload and to send email. It receives your photos, your email address, and the emails that we send you.
• BYOMailer: to send our news emails. It receives your name, your email address, and your plan.
• Cloudflare: to deliver the site and to protect it from attacks. All traffic to the site goes through Cloudflare, with your IP address and your browser.
• PostHog and Plausible: for product analytics, as described above.
• Meta: for advertising measurement, as described above.
• Rollbar: to find errors. An error report can include your account id, your IP address, and the request that failed.
• Google and Facebook: only if you sign in with them. They tell us your name and your email address.
• OpenAI, Anthropic, and other AI assistant companies: only if you connect their assistant, as described above.
• Other members: your username, your profile, and the content that you make public, for example displays, reviews, and posts.

We also give information to a court or to the police when the law requires it.

How long we keep your information

• Your account, collection, wishlist, and displays: while your account is open. When you delete your account, we delete them at once.
• Reviews, posts, comments, and messages: while your account is open. If you delete your account and want these deleted too, write to us.
• AI assistant connections: until you disconnect the assistant or delete your account.
• Analytics events in PostHog, including AI assistant tool events: 12 months.
• Session replays in PostHog: 30 days.
• Error reports in Rollbar: 90 days.
• Server logs: 14 days.
• Notifications: 30 days after you read them, or 90 days if you do not read them.
• Records of your activity on the site: 6 months. Records of your sign-ins: 13 months.
• Database backups: 30 days. Data that you delete stays in a backup until that backup expires.
• Payment records: for the time that tax law requires, and not more than 10 years.

Data that Meta, OpenAI, Anthropic, or another company already received stays under the retention rules of that company.

Your choices

• See and correct your data: your profile, collection, and wishlist are in your account. You can change them at any time.
• Turn off tracking: use the switches in Settings, then Privacy.
• Disconnect an AI assistant: use "AI assistants" in the same Privacy settings.
• Stop news emails: use the unsubscribe link in any of these emails.
• Delete your account: use the delete option in your account settings. You cannot undo it.
• Get a copy of your data, or ask any other question: write to us at amedina@mylegendscollection.com.

Security

We send all data over HTTPS. We store passwords only as hashes. Stripe and PayPal process card details, so card numbers never reach our servers. Only the people who run Legendsverse can open personal information, and only to do their work, for example to answer a support request.

Links

This site contains links to other sites, for example stores that sell figures. Those sites have their own privacy policies, and this policy does not apply to them.

Changes to this policy

When we change this policy, we post the new version on this page and change the date at the top.

If you think that we do not obey this policy, write to us at amedina@mylegendscollection.com.