Privacy Policy
Last updated 13 September 2026
This Privacy Policy explains what personal data CoinPrep collects, how it is used, who else handles it, how long it is kept, and what rights you have over it.
The Service handles two things that matter: your email address, and photographs of your inventory. This policy states plainly what happens to both.
Who we are
CoinPrep is operated by Signal Grove Digital, 6039 Cypress Gardens Blvd #563, Winter Haven, FL 33884, which is the data controller for the purposes described in section 6. For any question about this policy, or to exercise a right under it, write to hello@thecoinhq.com.
What we collect
- Your email address, so that you can sign in and so that we can contact you about your account. If you sign in with Google, we receive your email address and name from Google and nothing further.
- The photographs you upload, and the processed images produced from them.
- What you record about your items: file names, listing text, prices, measurements, shipping selections, and whether an item has been approved.
- Identification and research output produced for your items, and the web pages cited in it.
- Usage records: which credits were spent on what, so that your plan allowance can be applied correctly.
- Payment records: your Stripe customer reference and what you purchased. Card numbers are handled by Stripe and never reach us.
- Technical logs kept by our hosting provider, including IP address and browser, used for security and fault diagnosis.
We do not use advertising or tracking cookies. The only cookie we set is the one that keeps you signed in.
How we use it
We use your data to operate the Service: to sign you in, to process your photographs, to identify and research an item when you request it, to build your export, to meter your usage against your plan, and to contact you about your account.
We do not use your photographs or listing text to train any model.We do not sell your data, and we do not share it for advertising. Background removal runs a fixed, pre-trained model; nothing you upload is fed back into it. Identification sends the processed photographs of a single item to Anthropic's Claude API only when you press the button, and Anthropic does not train its models on data submitted through its API.
Where your photographs are processed
Image processing runs on hardware Signal Grove Digital operates in Florida, not on a rented server. Cutting out an image is computationally heavy. Your photograph is downloaded to a machine we control, processed there, and the result uploaded back to storage. The file is not retained on that machine after the job completes.
We state this plainly because it is unusual, and because a business customer assessing us is entitled to know where their files are handled.
Service providers
The following providers process data on our behalf. Each is bound by a data processing agreement.
| Provider | Purpose | Location | Transfer basis (EU and UK) |
|---|---|---|---|
| Supabase | Accounts, database and file storage | United States (AWS us-west-2) | Standard Contractual Clauses |
| Vercel | Website hosting and delivery | United States | EU-US Data Privacy Framework |
| Anthropic | Identification and research. When you press Identify, Attribute or Deep Research, the cut-out photographs of that item and its working name are sent to Anthropic’s Claude API and the draft comes back. Anthropic does not use API inputs to train its models. | United States | EU-US Data Privacy Framework |
| Stripe | Payments. Card details go to Stripe and never reach us; we keep your Stripe customer reference and what you bought. | United States | EU-US Data Privacy Framework |
| Resend | Email: sign-in links, receipts and account notices | United States | EU-US Data Privacy Framework |
| Sign-in, and only if you choose to sign in with Google | United States | EU-US Data Privacy Framework | |
| Signal Grove Digital (own hardware) | Image processing. Your photographs are downloaded to a machine we control, cut out, and the result uploaded back | United States (Florida) | Our own processing; covered by our data processing agreement |
We will give you notice before adding a provider that handles your photographs or your listing text.
If you are in the EU, the UK or Switzerland
CoinPrepis operated from the United States and your data is stored there. That transfer is lawful under the GDPR and the UK GDPR because it is covered: our hosting, email, payment and identification providers are certified under the EU-US Data Privacy Framework and its UK extension, and our database provider operates under the European Commission's Standard Contractual Clauses. The table in section 5 states which basis applies to each provider.
- Roles. In respect of your photographs, your listing text and the drafts produced from them, you are the controller and we are your processor: we process them only as the Service requires. In respect of your account details and billing, we are the controller.
- Legal bases. Performance of the contract between us; our legitimate interest in securing the Service and in recording what was purchased; and, for anything else, your consent, which you may withdraw at any time.
- Data processing agreement. If you require a signed agreement under Article 28 with the Standard Contractual Clauses annexed, email hello@thecoinhq.com and we will provide one for countersignature.
- Complaints. You may lodge a complaint with the supervisory authority in your country. We ask that you raise it with us first; we respond within 30 days.
- No profiling and no automated decision-making about you. The only automation in the Service operates on your items, not on you.
How long we keep it
Your photographs, both originals and processed versions, are retained until you delete them or until your account is closed. There is no automatic expiry: material you upload and do not touch again remains until you remove it.
- Deleting a batch deletes its photographs with it.
- On closure of your account we delete your photographs, batches and items within 30 days.
- Usage records are retained for up to 7 years, as billing records.
- Server logs are retained for up to 30 days.
To have everything removed sooner, email hello@thecoinhq.com. We will act within 30 days.
Your rights
Subject to the law that applies to you, you may:
- request a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to our use of it, and receive it in a portable, machine-readable form; and
- export your images and listing text at any time, without asking us, using the export function in the Service.
If you are in California, the CCPA affords you these rights expressly. We do not sell or share personal information as those terms are defined under the CCPA. If you are in the UK, the EU or Switzerland, section 6 sets out the basis on which your data is transferred. Wherever you are, write to hello@thecoinhq.com. We will act within 30 days and will not require you to justify the request.
Security
Your files are held in private storage that is not readable by URL, and every account is isolated at the database level so that one customer cannot read another's records or files. Images are served through short-lived signed links.
No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you promptly and, where required, the relevant supervisory authority.
Children
The Service is intended for business use and is not directed to anyone under 18. We do not knowingly collect personal data from children.
Changes to this policy
Where we change this policy in a way that materially affects you, we will email you before it takes effect. The date at the top of this page shows when it was last revised. See also our Terms of Service.
Contact
Signal Grove Digital
6039 Cypress Gardens Blvd #563
Winter Haven, FL 33884
hello@thecoinhq.com