Privacy policy

1. Who we are

Stable ("Stable", "we", "us") operates stablecollector.com and the Stable apps (the "Service"). The business responsible for your personal information is Stable Platform Inc., 54 Pit Lane, Pontiac, Michigan 48341. You can reach us about privacy at privacy@stablecollector.com or through stablecollector.com/contact.

This policy explains what we collect, why, who helps us run the Service, how long we keep information, and the choices and rights you have. It applies to members, people invited to clubs, people who send an inquiry about a listed car, and visitors to our website.

2. What we collect

Information you give us:

• Account: your name, email address, password (stored only as a secure hash by our authentication provider) or sign-in through Apple or Google, and the plan you choose.
• Profile: handle, photograph, city and region, bio, interests and links, and your choices about who can see them.
• Your cars and records: vehicles and their details (including VIN, chassis and engine numbers, registration, colors, options, mileage and purchase details), photographs, documents in your Vault (titles, invoices, service records, window stickers, history reports), maintenance, expenses, insurance and storage details, and anything you write in notes.
• Community: clubs you join, cars you share with them, introductions, connections, event RSVPs and the car you're bringing, and your event preferences (your ZIP code, distance and themes).
• Concierge: the messages you send to Concierge and its replies, with the web pages it cited.
• Listings and inquiries: what you publish about a car for sale, and the name, email and message of anyone who enquires about it.
• Payments: your plan and billing history. Card details are collected and stored by Stripe, never by Stable.
• Support: what you tell us when you contact us.

Information collected automatically:

• Usage: pages and features used, and events such as adding a car or starting a Studio set, through PostHog and, where enabled, Google Analytics. Both run without analytics cookies unless you agree to them.
• Technical: IP address, browser and device type, and error details, in our hosting provider's logs and our own error log (which keeps only the error message and the page, never what you typed).
• Security: counters used to limit repeated sign-in attempts and form submissions. These hold a one-way hash of your email address or network address, not the address itself, and expire within two days.

Information from others: market and sale records for collector cars from public sources, VIN decodes from the US National Highway Traffic Safety Administration (NHTSA), and information a club admin enters when inviting you (your name and email or mobile number).

3. How we use it

• To provide the Service: keep your collection and records, estimate values, generate Studio imagery you request, run Concierge, show your garage to clubs you share with, send the emails you've asked for, and process payments.
• To keep it safe: authenticate you, prevent fraud and abuse, limit repeated attempts, investigate errors and secure our systems.
• To improve it: understand which features are used and where things go wrong. We do not use your documents, photographs or Concierge conversations to train anyone's AI models, and our AI providers may not either (see section 5).
• To improve Stable Value: our valuation model is in early access and still learning. We use the details of vehicles added to Stable (such as year, make, model, variant, mileage, options, condition and recorded sale prices) to test and improve our valuations and market figures. We use them without your name or contact details, never publish them in a way that identifies you or your car, and never sell them.
• To communicate: account and security messages, receipts, reminders you turn on, community messages (club invitations and events) and product news you opt into. You can change optional email in Settings; every optional email has an unsubscribe link.
• To meet legal obligations and enforce our Terms.

Where the law asks for a legal basis (for example in the UK and EU): we rely on performing our contract with you, our legitimate interests in running a secure and useful service, your consent (for optional analytics cookies and marketing), and legal obligations.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

4. What other people can see

Your collection is private by default. You decide, car by car and for your profile, whether something is visible only to you, to your connections, to members, or publicly.

• Clubs see only the cars you choose to share with that club, and never values, VINs, purchase prices or where a car is kept.
• Public Passports and Listing Microsites show what you choose to publish.
• Event attendance is shown by name to people who share a club with you or are connected to you; everyone else sees only counts by marque.
• Your event ZIP code is used only to measure distance and is never shown to anyone. We store only the center point of the ZIP, rounded to about a kilometer.
• When you transfer a car to a new owner, the records you choose to hand over go with it.

5. Service providers

We use these companies to run the Service. Each processes personal information only on our instructions, for the purpose listed, under contract:

• Vercel (United States): hosting and delivery of the website and app, and server logs.
• Supabase (United States, on Amazon Web Services): database, account authentication and private file storage for photographs and documents.
• Stripe (United States): payments and subscription billing. Stripe receives your card details directly.
• Resend (United States, on Amazon Simple Email Service): sending email.
• Anthropic (United States): the Claude models behind Concierge (including its web searches) and the reading of documents, window stickers, VINs and history reports you upload. Under Anthropic's commercial terms, content sent through its API is not used to train its models.
• OpenAI (United States): generating Stable Studio images from your photographs, and a fallback for Concierge. Under OpenAI's API terms, content sent through its API is not used to train its models by default.
• PostHog (United States): product analytics, without cookies unless you consent.
• Google (United States): Google Analytics, in consent mode (no analytics cookies without consent), and Sign in with Google if you choose it.
• Apple (United States): Sign in with Apple, if you choose it.
• NHTSA (United States government): decoding VINs. Only the VIN is sent.

Concierge's web searches are for businesses and public information; it is instructed never to include your VIN, address, values or other private details in a search.

We may also share information with professional advisers, to comply with law or legal process, to protect rights and safety, or as part of a merger, acquisition or sale of assets (with notice to you).

6. How long we keep it

• Account and collection data: while your account is open. When you delete your account, we delete your data within 30 days, except what we must keep by law (for example billing records, kept for 7 years).
• Photographs and documents: until you delete them or your account.
• Concierge conversations: while your account is open; you can start a new conversation at any time. They are deleted with your account.
• Sign-in and form rate-limit counters: up to 2 days. Server error records: 90 days.
• Backups: deleted data may remain in encrypted backups for up to 30 days before it is overwritten.

7. Your choices and rights

You can see and edit most of your information in the app, export your data from Settings, change who sees each car and your profile, turn optional email off, and delete your account from Settings.

Depending on where you live, you may also have the right to access, correct, delete or port your personal information, to object to or restrict certain processing, to withdraw consent, and to not be discriminated against for exercising these rights. California residents have these rights under the CCPA/CPRA; we do not sell or share personal information as those laws define it. To make a request, contact us at privacy@stablecollector.com. We will verify it's you before acting, and respond within the time the law requires.

If you are in the UK or EU and we cannot resolve a concern, you may complain to your data protection authority.

8. Security

We protect information with encryption in transit, private storage for photographs and documents served only through short-lived signed links, database access rules that keep each member's data to themselves, limits on repeated sign-in attempts, and restricted staff access. No system is perfectly secure; if a breach affects your personal information, we will tell you and the authorities as the law requires.

9. Where information is processed

Stable is operated from the United States and our providers process information in the United States. If you use the Service from elsewhere, your information is transferred to the United States, where privacy law may differ from your own. Where the law requires, we rely on appropriate safeguards such as standard contractual clauses.

10. Children

The Service is for adults. We do not knowingly collect information from anyone under 18; if you believe we have, contact us and we will delete it.

11. Changes to this policy

We will post changes here with a new effective date, and tell you by email or in the app before a material change takes effect.

12. Contact

Stable Platform Inc., 54 Pit Lane, Pontiac, Michigan 48341. Privacy: privacy@stablecollector.com. General: stablecollector.com/contact.