Privacy Policy
This policy is written for you, the person with an account — the photographer, the cataloguer, the auctioneer. It explains what Infocrat, LLC, a New York limited liability company which operates Auction Manager (“we”, “us”, “our”), holds about you, why, who else sees it, and what you can make us do about it.
It sits alongside our Terms of Service, which is the agreement with the business you work for.
1. Who is responsible for what
Two different things happen in this service, and the law treats them differently.
Your account is ours to answer for. Your name, your email address, your sign-in records and the log of what you did are held by us, and we decide what happens to them. In GDPR terms we are the controller of that data.
The catalogue belongs to the business. The photographs, the lot descriptions and the auction records are your employer’s or client’s, not ours. They decide what goes in and what comes out; we hold it on their behalf. In GDPR terms they are the controller and we are the processor.
That distinction matters when you ask for something. We can act on a request about your account ourselves. A request about a catalogue — a photograph you took, say — we will pass to the organization that owns it, and tell you we have.
2. What we hold about you
Your account
- your name and email address;
- a one-way scrambled form of your password — we cannot read your password, and neither can anyone else;
- a profile picture and a short description of yourself, if you add them;
- whether you are an administrator;
- when you were invited, when you accepted, and when you accepted the Terms of Service;
- a new email address you have asked to move to, until you confirm it.
Your sign-ins
- the IP address and browser user-agent of each session, with when it started and when it expires.
What you did
- an audit record of catalogue actions: who did what, to which lot or auction, when, and what changed. This is how the service answers “who approved this lot”, which is the question an auction house has to be able to answer.
What you put in
- photographs you upload, and everything written about the lots.
How you use the site
- pages visited, actions taken, approximate location derived from your IP address, and device and browser information, collected through Google Analytics — see sections 5 and 6.
We do not hold payment details, government identifiers, or records about the consignors whose goods you are cataloguing. The service has no consignor entity at all.
3. Why we hold it, and on what basis
| What | Why | GDPR basis |
|---|---|---|
| Name, email, password | To give you an account and let you sign in | Performance of a contract |
| Profile picture, description | So colleagues know who they are working with | Legitimate interests |
| Sign-in records | To keep the account secure and show you where it is signed in | Legitimate interests; legal obligation |
| Audit record | So the business can answer who changed what | Legitimate interests of the business |
| Terms acceptance | To show the agreement was made | Legal obligation; legitimate interests |
| Photographs and lot data | To provide the service to the business | Performance of a contract, as processor |
| Analytics | To see which parts of the service are used, and fix what is not working | Consent in the EEA and UK; legitimate interests elsewhere |
Where we rely on legitimate interests, we have weighed them against your interests. If you disagree with that balance you can object — see section 8.
4. Artificial intelligence, and what it means for photographs
Read this section even if you skip the others.
Photographs go to an AI provider in two cases:
- Drafting a catalogue entry. When somebody in your organization asks the service to draft one, we send the lot’s photographs and its details, and the provider returns a suggested title, description and attribution.
- Removing a background with AI. When somebody asks for a photograph’s background to be removed using AI, we send that photograph, and the provider returns a redrawn copy for a person to accept or discard.
Removing a background without AI happens on our own servers, and nothing is sent to the provider.
Who receives them
Today that provider is Google, through the Gemini API. If we add or change providers — we are considering others — we will update the table in section 5 and the date on this policy before any data goes to them.
What Google may do with them
This is the part to know. We use Google’s paid tier of the Gemini API. Under Google’s Gemini API Additional Terms of Service (effective 23 March 2026, read on 25 September 2026), on the paid tier:
- Google “doesn’t use your prompts (including associated system instructions, cached content, and files such as images, videos, or documents) or responses to improve our products” — so it does not use the photographs or the drafts to improve its products;
- Google keeps a log of what is sent and returned “for a limited period of time, solely for detecting and preventing violations” of its Prohibited Use Policy. Google does not say how long that period is;
- Google’s terms describe human review only for its unpaid tier, and say nothing of people reading what is sent on the paid tier.
In plain terms: photographs sent to Google, for drafting or for background removal, are used to answer our request and are not used by Google to improve its products. Google holds them for a while to catch abuse of its service, and for nothing else.
What we do with them
We do not train AI models on your content, and we do not use one customer’s content to improve the service for another. We send a lot’s photographs to draft that lot’s entry, or a single photograph to remove its background, and what comes back is kept against that lot or that photograph. That is the whole of it.
What the output is worth
AI-drafted entries are a first draft. They can be wrong — a misread hallmark, an invented maker. Nothing is exported until a person approves it, and the service shows how confident the model was. Section 7 of the Terms of Service covers this.
A photograph whose background was removed with AI can be wrong too. The AI redraws the whole picture, not just the background, so it can change the object itself — its lighting, or a fine pattern. That is why a person compares the redrawn copy with the original before it replaces anything, and why removing a background without AI, which cannot alter the object, is the default.
5. Who else receives your data
We do not sell your personal information, and we do not share it for advertising. We use these companies to run the service:
| Who | What they receive | Why | Where |
|---|---|---|---|
| Google (Gemini API) | Lot photographs and details, when AI drafting or AI background removal is used | To generate catalogue drafts and process images | United States |
| Amazon Web Services | Photographs, application data, outgoing email | Storage, and sending email such as invitations | United States |
| Google Analytics | Pages visited, actions taken, device and browser, approximate location from IP | To understand how the service is used | United States |
| Have I Been Pwned | The first five characters of a one-way scrambled form of a new password — never the password, and nothing that identifies you | To warn you if the password you chose has appeared in a public data breach | Australia / Cloudflare’s global network |
We will also disclose data where we are legally required to, and to professional advisers where necessary. If the business is ever sold, data may transfer with it, and you would be told before that happened.
About the password check. When you set a password we check whether it is one that has already leaked, and we do it without sending the password anywhere. The password is scrambled here, and only the first five characters of that scrambled form are sent — a fragment shared by around eight hundred leaked passwords, so it identifies a bucket and not you or your password. The list that comes back is compared on our servers. Your name and email address are not sent, and the service is told nothing about who is asking. If the check finds your password on a breach list we email you to suggest changing it; nothing is refused, and nothing about the result is stored.
About Google Analytics. We use it to count how the service is used, not to profile you. Google Analytics 4 does not store your IP address; it uses it to work out an approximate location and discards it. We do not enable Google’s advertising features, and we do not use analytics data to build advertising audiences.
6. Cookies
Strictly necessary. One signed session identifier, which keeps you signed in. It is not used to track you, it carries no personal data in itself, and it goes when you sign out. The service does not work without it, so it is always set.
Analytics. Google Analytics sets cookies to tell repeat visits apart and to measure how the service is used. These are not necessary for the service to work.
If you are in the EEA or the UK, analytics cookies are set only if you agree, and you can change your mind at any time — the banner that asks you is also how you withdraw. Declining costs you nothing: every part of the service works the same either way.
There are no advertising cookies on the site, and no third party places a cookie here to follow you elsewhere.
7. How long we keep it
| What | How long |
|---|---|
| Account details | While the account exists |
| Sign-in records | A session lasts 24 hours, or 30 days if you asked to be remembered. The record of it stays with your account |
| Audit record | Indefinitely, while the organization exists: it is how the business answers who did what, and deleting it would take away the answer |
| Photographs and lot data | While the organization’s account is open; after termination, 30 days to export, then deleted — see the Terms of Service |
| Terms acceptance | While the account exists, and afterwards where we need it to show the agreement was made |
| Analytics | Google’s default retention, which is 2 months for user-level data, after which Google deletes it |
How deletion works today, stated plainly. Closing an account marks it deleted and removes access to it — the record is no longer reachable through the service. If you want your personal data erased rather than closed, ask us and we will erase it, and tell you what we had to keep and why. We do not keep our own backups; our database provider takes its own, and anything erased is gone from those as they age out on the provider’s cycle.
8. Your rights
Wherever you are, you can ask us to show you what we hold about you, correct it, or delete it. Write to the address in section 12 and we will answer within 30 days.
If you are in the EEA or the UK, you also have the right to: restrict how we use your data; receive it in a portable form; object to processing based on legitimate interests; withdraw consent where we relied on it; and complain to your data protection authority. We will not treat you worse for exercising any of these.
If you are in California, you have the right to know what we collect and why, to have it deleted, to have it corrected, and to opt out of sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioural advertising, and we have not in the preceding twelve months — we use analytics to measure the service, with Google’s advertising features switched off. You may use an authorised agent, and we will not discriminate against you for asking.
Some requests we cannot fully grant. We may need to keep records showing an agreement was made, and an audit record that says who approved a lot belongs to the business as much as to you — we will tell you which parts we have kept and why.
9. Where your data is
We are in the United States, and so are our providers. If you use the service from the EEA or the UK, your data is transferred to the United States, and we rely on the European Commission’s Standard Contractual Clauses, or another approved mechanism, for that transfer.
10. How we protect it
Passwords are stored one-way scrambled and never in readable form. Traffic is encrypted in transit. Photographs live in private storage that is not publicly reachable. Access follows the roles your organization sets, and catalogue actions are recorded against the person who took them.
No service is perfectly secure. If a breach affects your personal data we will tell you and the relevant authority as the law requires.
11. Children
The service is for people working in the auction trade and is not intended for anyone under 16. We do not knowingly collect their data; if we learn we have, we will delete it.
12. Changes
If we change this policy materially — a new provider, a new purpose, a new category of data — we will update the date above and tell account holders by email or in the application before it takes effect.