Privacy Policy
Last updated: July 2026
1. Who We Are
Primephila ("we," "us") operates this website and the Primephila expert bot. For any privacy question or request, contact us at contact@primephila.com.
2. What Data We Collect and Why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address and password (if you register an account) | To create and secure your account, let you log in, list items for sale, build your collection, and purchase items | Contract (providing the service you signed up for) |
| Email address (if you join the waitlist instead) | To notify you when Primephila launches | Consent |
| Stamp photo you upload to the Bot | Sent to Google's Gemini AI to generate an identification/estimate; also processed on our server to resize the image | Consent / legitimate interest in providing the service you requested |
| Payment and billing information (if you buy or sell on the Marketplace) | To process payments, hold funds in escrow until delivery is confirmed, and pay out sellers | Contract (completing your purchase or sale) |
| IP address | Daily rate limiting, to prevent abuse of the free Bot | Legitimate interest (fraud/abuse prevention) |
| Currency preference | Stored locally in your browser to remember your choice (EUR/USD) | Legitimate interest / functionality |
You do not need an account to try the Bot. An account is required to list items, purchase items, or manage a personal collection. We never see or store your full card details — these are collected and processed directly by our payment processor, Stripe.
3. Third-Party Processors
To provide the service, some of your data is processed by trusted third parties acting on our behalf:
- Google Firebase (hosting, authentication, database, cloud functions) — stores your account data, waitlist email, listings, and rate-limiting records.
- Google Gemini API — receives the stamp photo (resized, without any identifying metadata we can avoid) to generate the identification result. Google's own privacy terms apply to this processing.
- Stripe — processes payment and payout information for Marketplace purchases and sales. Stripe's own privacy policy applies to the payment data it collects directly from you.
We do not sell your personal data to anyone, and we do not use it for advertising.
4. How Long We Keep Your Data
Waitlist emails are kept until you ask us to remove them or until the marketplace launches and you either continue as a registered user or unsubscribe. Rate-limiting records (IP + date) are automatically deleted after they are no longer needed for abuse prevention (typically within a few days).
5. Your Rights (GDPR)
If you are in the EU/EEA or Italy, you have the right to:
- Access the personal data we hold about you
- Ask us to correct or delete it ("right to be forgotten")
- Withdraw your consent at any time (e.g., leave the waitlist)
- Request a copy of your data in a portable format
- Lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) if you believe your rights have been violated
To exercise any of these rights, email contact@primephila.com — we will respond within a reasonable time and in any case within the timeframes required by law.
6. Cookies and Local Storage
We do not use advertising cookies. We use two categories of storage on your browser:
- Strictly necessary: local storage used to keep you signed in, remember your selected currency (EUR/USD), and remember your cookie choice. These cannot be switched off, as the Site could not function without them.
- Analytics (optional): Google/Firebase Analytics cookies, which help us understand how visitors use the Site (pages viewed, general usage patterns). These are only activated if you click "Accept all" on the cookie banner shown on your first visit. You can withdraw consent at any time by clearing your browser's local storage for this Site, which will show the banner again.
We do not share analytics data with third parties for advertising purposes.
6b. Google User Data ("Sign in with Google")
If you choose to create an account or log in using "Sign in with Google," Google shares a limited set of profile information with us through Firebase Authentication:
- Data accessed: your Google account's email address, display name, and profile picture URL. We do not request access to your Gmail, Google Drive, Google Contacts, Calendar, or any other Google product or scope beyond basic sign-in profile information.
- Data usage: we use this information solely to create and identify your Primephila account, pre-fill your display name, show your profile picture in the Site's interface, and let you log in without a separate password. We do not use it for advertising, profiling, or any purpose unrelated to operating your account.
- Data sharing: we do not sell or share your Google account data with any third party. It is stored only within our own Firebase project (operated by Google Cloud on our behalf as a data processor) and is never passed to advertisers or unrelated services.
- Data storage & protection: this data is stored in our Firebase Authentication and Firestore database (Google Cloud infrastructure), protected by access controls, encrypted connections (HTTPS/TLS), and Firebase's built-in security rules restricting access to your own account data.
- Data retention & deletion: we retain this data for as long as your account remains active. You can request full deletion of your account and all associated Google profile data at any time by emailing contact@primephila.com; we will process deletion requests within a reasonable time and in any case within the timeframes required by law.
Primephila's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
7. Security
We apply reasonable technical measures (access control, encrypted connections, cloud-provider security) to protect your data, but no system can be guaranteed 100% secure. Please avoid uploading photos that reveal sensitive personal information in the background.
8. Changes to This Policy
We may update this Privacy Policy as the Site and marketplace evolve. Material changes will be reflected by an updated "Last updated" date above.