Privacy Policy

The following privacy notice informs you about the type, scope, and purpose of the collection and use of personal data when using this website, as well as your rights.

I. Data Controller

Contact
Email: hello@collected.tools

Further details can be found in our legal notice.

II. Personal Data, Purpose of Processing, and Legal Basis

Personal data refers to any information relating to an identified or identifiable natural person (hereinafter: "data subject"). A natural person is considered identifiable if they can be identified directly or indirectly, particularly by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

We only process personal data on our website when this is necessary for the following purposes:

• Based on your request and consent (Art. 6(1)(a) GDPR)
• To enable use of the website (Art. 6(1)(b) GDPR)
• To improve user experience and maintain website security (Art. 6(1)(f) GDPR)
• To comply with legal obligations (Art. 6(1)(c) GDPR)

Further details regarding data processing can be found under the respective headings below.

1. Access Data / Server Log Files

When visiting our website, the servers of our hosting provider automatically store information your browser transmits, known as server log files. This includes:

• Referrer (previously visited page)
• Requested URL or file
• Browser type and version
• Operating system used
• Device type used
• Preferred browser language
• Time of access
• IP address and the approximate location derived from it (country, region, city and approximate coordinates)

Temporary processing of this data is necessary to deliver the website to your device. In particular, the IP address must be processed for this purpose. This data is not merged with other sources and is used exclusively to ensure the technical operation and security of the server and hosting infrastructure, to detect errors and to prevent abuse.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure, error-free operation of the website)

2. Contact via Email

If you contact us via email, the personal data you provide (e.g., name, email address, message) will be processed to handle your inquiry and any follow-up questions.

Legal basis: Art. 6(1)(b) GDPR (for responding to inquiries) and, if consent is given, Art. 6(1)(a) GDPR

3. Submitting a Tool

Using the "Submit a tool" form, you can suggest a tool for the directory without creating an account. We process the details of the tool (name, website, description, category, pricing model), your optional note, the language of the page and, if you provide it, your email address for follow-up questions. The suggestion is stored in our database at Supabase within the EU (see Section III) and reviewed by us before it is published. Only the details of the tool are published, never your email address or your note.

To prevent abuse, we limit the number of submissions per sender. For this, your IP address is processed, but stored only as a non-reversible hash value and deleted after two days at the latest. In addition, the form contains a field that is invisible to people and that automated programs often fill in, as well as the self-hosted spam protection ALTCHA (see Section II.5).

Legal basis: Art. 6(1)(a) and (b) GDPR (your suggestion and your voluntary details) and Art. 6(1)(f) GDPR for the prevention of abuse

4. User Account / Login

If you have an account, you log in with your email address and a password. We process your email address, a securely stored password, your profile and the content linked to your account, such as submitted tools and saved favourites. After logging in, cookies hold your session (see Section II.5). This data is used exclusively to provide the account. We do not use it for advertising or profiling.

Legal basis: Art. 6(1)(b) GDPR (provision of the account) and Art. 6(1)(f) GDPR (security, e.g. session handling and access protection)

The database and the authentication service are operated on our behalf by our processor Supabase (see Section III).

5. Third-Party Services and Content

We integrate or link to third-party content and services as follows:

Spam Protection (ALTCHA)

To protect the "Submit a tool" form against spam and automated abuse, we use ALTCHA, open-source software that we run ourselves as part of this website. Once the form has loaded, your browser loads a computational task from our server and solves it in the background. When you submit, our server checks the solution and the time at which the task was issued.

No cookies are set, nothing is stored on your device and no data is transferred to third parties. Neither your interactions (e.g. mouse movements) nor characteristics of your device are analysed.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing spam and ensuring the security of our systems)

Vercel Analytics

We use Vercel Web Analytics, a privacy-friendly analytics service provided by our hosting provider Vercel Inc. (see Section III), to understand how our website is used and to improve it. Vercel Web Analytics works without cookies and does not store persistent identifiers on your device. It does not track you across websites and does not create user profiles.

For each page view, aggregated and anonymised information is processed, such as the page visited, the referring page, approximate location at country level, as well as device type, browser, and operating system. To count unique visits without cookies, a non-reversible hash value is derived from incoming request data. This hash does not allow us to identify you and is not used for any purpose beyond counting visits.

• Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA
• Privacy Policy

Data may be transferred to the USA. Appropriate safeguards apply (see Section III).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the needs-based design and statistical evaluation of our website)

Cookies and Storage on Your Device

We do not use cookies for advertising or analytics. Only the following technically necessary storage takes place:

• Language preference: if you choose a language, a cookie (lang) stores this choice for up to one year, so that you see the website in your language on your next visit.
• Colour mode: if you switch between light and dark mode, this choice is kept in your browser's local storage. It does not leave your device.
• Login: after logging in, cookies hold your session (see Section II.4).

Legal basis: Art. 6(1)(f) GDPR; the storage is strictly necessary for the function you requested.

Fonts and Preview Images

We use the typeface "Inter" to ensure consistent typography across devices. The font files are hosted locally on our own infrastructure and delivered together with the website. No connection to Google servers or any other third-party font provider is established.

The preview images of the tools are also hosted on our own infrastructure. No images are loaded from the providers' servers when you open a page.

Links to Providers

The directory links to the websites of the tools it features. Only when you click such a link do you leave our website, and the privacy policy of the respective provider applies.

III. Recipients of Personal Data and Transfers to Third Countries

Personal data may be disclosed to the following categories of recipients:

• Our data processors to the extent necessary, in particular our website and hosting provider:

• Any relevant sub-processors of Vercel

For user accounts and for storing submitted tools we additionally use the following processor:

Supabase provides the database and authentication infrastructure. Our database is hosted in a data center within the European Union. As Supabase is a US-based provider, access from or a transfer to the USA cannot be fully excluded; in that case the appropriate safeguards described below apply.

• Any relevant sub-processors of Supabase

To receive and store emails, we use the following email provider:

As a US-based provider, data may be transferred to the USA; the appropriate safeguards described below apply.

• Third-party service providers used on our website (see above under Section II.5)

Beyond these cases, we will not share your personal data with third parties without your explicit consent, unless we are legally obligated to do so.

We may process personal data in a third country (i.e., outside the European Union (EU) or European Economic Area (EEA)) if:

• it is required to provide the functions you use,
• based on your consent,
• due to a legal obligation, or
• based on our legitimate interests.

This also applies to processing by third parties acting on our behalf, as well as disclosures or transfers of personal data to third parties.

Third-party service providers processing personal data on our behalf in third countries are only used if:

• an adequacy decision by the European Commission exists for the country (Article 45 GDPR), or
• appropriate safeguards (Article 46 GDPR) are in place, such as Standard Contractual Clauses (SCCs) (Article 46(2)(c) GDPR) or Binding Corporate Rules (BCRs) (Article 47 GDPR).

You can find general information here:

• Adequacy decisions
• Binding Corporate Rules
• Standard Contractual Clauses

For further information, you may contact us at any time.

IV. Duration of Data Storage

We delete personal data once the purpose for processing has been fulfilled and the legal basis for processing no longer applies, provided there is no statutory retention obligation.

• Server log files and IP addresses are automatically deleted no later than three days after collection.
• Hash values used to limit submissions are deleted automatically after two days at the latest.
• Session cookies are automatically deleted at the end of your session.
• Other cookies with a set expiration date are stored on your device until that date. You can view, restrict, or delete cookies and local storage at any time through your browser settings.

Personal data submitted by email will be processed until your inquiry has been completely handled. After that, the data will be deleted unless a legal retention obligation applies.

Submitted tools are stored until we have reviewed them. Published entries remain part of the directory. We delete your optional email address and your note once they are no longer needed for follow-up questions about your suggestion.

Your user account can be deleted at any time. To do so, write to us at the address given in Section I.

In general, and in relation to all tools and services used as previously described, we review data annually to determine whether it can be deleted. This is the case when the purpose of processing and the legal basis no longer apply and no statutory retention obligation exists.

V. Provision of Personal Data and Rights of Data Subjects

You are not legally required to provide personal data. However, the provision of such data may be necessary to use specific website features, such as an account. Without the provision of required data, certain functionalities may not be available.

There is no automated decision-making on our website; profiling does not take place.

Your rights as a data subject

In accordance with Articles 15 to 23 and Article 77 of the General Data Protection Regulation (GDPR), as supplemented by the Czech Personal Data Processing Act (Act No. 110/2019 Coll.), you have the following rights, provided the legal conditions are met:

• Right of access (Article 15 GDPR)
• Right to rectification (Article 16 GDPR)
• Right to erasure ("right to be forgotten") (Article 17 GDPR)
• Right to restriction of processing (Article 18 GDPR)
• Right to data portability (Article 20 GDPR)

If you have given consent to the processing of personal data, you have the:

• Right to withdraw consent (Article 7(3) GDPR). Withdrawal applies to future processing and does not affect the legality of processing based on consent before the withdrawal.

You also have the:

• Right to object (Article 21 GDPR), more details in Section VI below.

Please send any requests, inquiries, or communications to us. See Section I for contact details.

Right to lodge a complaint

If you believe that the processing of your personal data violates data protection laws, you always have the:

• Right to lodge a complaint (Article 77 GDPR)

This right can be exercised with the competent data protection authority, particularly in the member state of your residence, workplace, or the place of the alleged infringement.

The competent supervisory authority for us is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ):

You may also lodge a complaint with the supervisory authority in your country of residence or workplace.

VI. Information about the Right to Object under Article 21 GDPR

1. Right to object on grounds relating to your particular situation

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is based on Article 6(1)(f) GDPR (data processing based on a balancing of interests).

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

2. Right to object to direct marketing

If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing.

If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes.

The objection can be made without any formal requirements and should preferably be directed to us using the contact details provided above under Section I.