1. Scope and controller
This Policy applies to Item Legacy, including www.itemlegacy.com, the web application, support and feedback features, and related account, billing, and Cloud Backup experiences. Vellstead LLC is the controller of the personal information described in this Policy, except where a service provider processes information under its own privacy notice, such as Stripe for payment processing or Google for an optional Google sign-in.
2. Information we collect
We collect information you provide, information created through use of the Service, and limited technical information needed to deliver and secure the Service.
| Category | Examples | Source / purpose |
|---|---|---|
| Account and profile | Email address, display name, authentication provider, default currency, onboarding preferences, account identifiers. | Provided during account setup or returned by the sign-in provider; used for access and personalization. |
| Collection and item content | Collections, item records, names, descriptions, values, locations, dates, identifiers, tags, custom fields, Sets, templates, and reports. | Entered, imported, or generated through your use; used to provide the vault. |
| Media and documents | Photos, PDFs, macro-free DOCX files, captions, filenames, and related metadata. | Uploaded by you; used to store and display supporting evidence. |
| Billing and entitlement | Plan, subscription status, Stripe customer/subscription identifiers, price identifiers, billing period, and Cloud Backup entitlement. | Received from Stripe and stored to manage access. Card numbers are handled by Stripe, not Item Legacy. |
| Feedback and support | Feedback category, subject, details, optional reproduction steps, page URL, and browser information. | Submitted by you; used to investigate and respond. |
| Security and operational data | Activity/audit entries, sign-in/session information, security events, request and error information, deletion workflow state. | Created automatically to protect accounts, operate the Service, and troubleshoot. |
| Backup data, if enabled | Snapshot metadata, object counts, sizes, checksums, and protected backup payloads containing eligible vault data and media. | Created by the Cloud Backup service for an eligible account. |
3. How we use information
We use personal information to:
- create and administer accounts; authenticate users; and provide requested Service functionality;
- store, display, organize, import, export, report on, and back up your collections and media;
- personalize settings, apply plan limits, and provide billing, subscription, and Cloud Backup access;
- communicate transactional, security, billing, legal, and support information;
- respond to feedback, diagnose errors, protect against misuse, and improve reliability;
- comply with law, enforce our Terms, protect rights and safety, and maintain business records.
No public inventory or targeted advertising
Item Legacy does not provide a public inventory-sharing feature in the current product. We do not sell personal information and do not use your Item Legacy content for targeted advertising. We do not use your item records, uploaded media, or collection content to train public AI models.
4. How and when we disclose information
We disclose information only as needed for the purposes described in this Policy, including:
| Recipient category | Why disclosure may occur |
|---|---|
| Service providers | Hosting, database, authentication, storage, email, monitoring, and support providers that process information for us to run and secure the Service. |
| Payment provider | Stripe processes checkout, recurring subscription, customer-portal, and payment activity under Stripe’s own terms and privacy policy. |
| Sign-in provider | If you choose Google sign-in, Google processes authentication information under Google’s privacy practices. |
| Professional advisers and authorities | Where reasonably necessary for legal compliance, enforcement, fraud/security response, audit, or protection of rights and safety. |
| Business transfer | In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to applicable law. |
We do not disclose your collection records or private media to other Item Legacy users by default. We do not rent or sell personal information for money or other valuable consideration as those concepts may be defined by applicable law.
5. Payments and subscriptions
Paid plans and Cloud Backup add-ons are purchased through Stripe Checkout and managed through Stripe’s customer billing portal. Stripe receives the payment information needed to process a transaction. Item Legacy receives and stores limited billing and entitlement information, such as plan key, status, Stripe customer/subscription IDs, price ID, period dates, and cancellation state, so it can provide paid features and respond to billing events. See Stripe’s privacy policy for its handling of payment information.
6. Cloud Backup
Cloud Backup is available only to eligible accounts. Protected backup payloads are stored in a private, service-role-only backup location. Users can view snapshot metadata and may submit a restore request from the Service; restore requests are reviewed and verified. A backup is not a substitute for keeping your own copies of important records.
Retention for Cloud Backup
While Cloud Backup access is active, snapshots are retained subject to applicable allowance, capacity, and operational rules. After paid Cloud Backup access ends, snapshot retention is generally up to 30 days to allow renewal or export, after which snapshots may be removed. Account deletion requests are handled through a staged process designed to cancel applicable billing, remove private storage objects, remove database records, and delete authentication access, subject to operational, legal, and security requirements.
7. Cookies and similar technologies
The Service uses authentication and session mechanisms necessary to sign you in, keep you signed in, protect sensitive actions, remember limited interface state, and maintain the Service. These technologies are not used for cross-site behavioral advertising. You can control cookies through your browser, but disabling necessary cookies may prevent authentication or other core functionality.
8. Data retention and deletion
We retain personal information for as long as reasonably necessary to provide the Service, maintain security and records, resolve disputes, enforce agreements, and comply with law. Retention varies by data type and account state. You can delete individual records through the Service and may request permanent account deletion in Settings. Before account deletion, export content you wish to retain. Deletion can require identity verification and may be delayed or limited where needed for lawful obligations, security, fraud prevention, billing resolution, or backup/operational integrity.
9. Security
We use technical and organizational safeguards designed to protect information, including authentication controls, row-level ownership policies, private object storage, temporary signed URLs for media delivery, validated upload types and sizes, protected server-side actions, and security-focused account deletion and backup processes. No system can guarantee absolute security. Protect your account password and linked email or Google account, and do not store passwords, keys, safe combinations, access tokens, or unnecessary sensitive information in the Service.
10. Your choices and privacy rights
Depending on where you live, you may have rights to access, correct, delete, receive a portable copy of, restrict, object to, or withdraw consent for certain processing of your personal information. You may also have the right to appeal a privacy-rights decision or complain to a regulator. Item Legacy provides access to account settings, item/collection management, CSV export, and account deletion tools. To make a privacy request, email hello@vellstead.com with the subject “Privacy Request.” We may verify your identity and may ask for information needed to process the request. We will not discriminate against you for exercising rights available under applicable law.
11. Children
Item Legacy is a general-audience collection-management service and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us without appropriate authorization, contact hello@vellstead.com so we can investigate and take appropriate action.
12. International processing
Vellstead is based in the United States. Information may be processed in the United States and in other locations where our service providers operate. Where required by applicable law, we will use appropriate safeguards for cross-border transfers.
13. Changes to this Policy
We may update this Policy to reflect changes in the Service, law, security, or our practices. We will post the updated effective date and, for material changes, provide additional notice through the Service or by email when reasonably practicable. Continued use of the Service after an updated Policy takes effect is subject to the updated Policy to the extent permitted by law.
14. Contact us
For questions, requests, or concerns about this Privacy Policy or our information practices, contact Vellstead LLC at hello@vellstead.com with the subject line “Privacy.” You may also visit https://vellstead.com. Please do not include passwords, payment-card numbers, safe combinations, access tokens, or other sensitive credentials in email.