Effective date: May 17, 2026
How AllCorals collects, uses, and protects your personal data.
This Privacy Policy describes how AllCorals, LLC, a Delaware limited liability company ("AllCorals," "we," "us," or the "Platform"), collects, uses, stores, and protects personal data when you access allcorals.com and any related services (the "Service"). It is intended to satisfy our obligations under the U.S. state privacy laws that apply to us (including the Delaware Personal Data Privacy Act and, where applicable, the California Consumer Privacy Act / CPRA), and to extend equivalent rights to users worldwide, including those covered by the EU/UK General Data Protection Regulation (GDPR).
AllCorals acts as the "controller" (or, under U.S. law, the "business" or "controller") of the personal data described below. To contact us about privacy, email [email protected].
This Policy applies to allcorals.com and its subdomains. It does not apply to LINE, Google, Cloudflare, or any other third-party site or messaging service to which the Service may link, including off-platform messaging via LINE or WhatsApp. When you communicate with another User off-platform, those communications are governed by the relevant third party's privacy policy, not ours.
We collect only the personal data needed to operate the Service:
We do not collect payment card data, bank account details, precise geolocation, biometric data, or government-issued identification numbers. AllCorals does not process payments — all payments occur off-platform between Buyer and Seller. We do not knowingly collect "sensitive personal information" as defined under U.S. state privacy laws or "special categories" of data under GDPR.
We process personal data only where we have a legitimate basis to do so. The principal purposes and corresponding bases are:
We do not sell personal data, and we do not "share" personal data for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.
AllCorals uses only two cookies, both strictly necessary or preference-related:
We do not use advertising cookies, cross-site tracking cookies, third-party marketing pixels, or analytics cookies that profile individuals. Because we use only strictly-necessary and preference cookies, no separate cookie-consent banner is presented; this Policy and our cookie notice serve as your notice.
We share personal data only as described below. We do not sell, rent, or trade personal data, and we do not share it with third parties for advertising purposes.
AllCorals is established in the United States, and our primary servers and cloud infrastructure are located in the United States. If you access the Service from outside the United States, you understand that your personal data will be transferred to, processed, and stored in the United States, which may have data-protection laws different from those of your country of residence.
Where required by GDPR or another applicable law, we rely on appropriate safeguards for international transfers, including the European Commission's Standard Contractual Clauses (SCCs) and your informed consent where applicable.
Where we are required by law to retain data for a longer period, we will do so for the minimum period required.
Depending on where you live, you may have some or all of the following rights with respect to your personal data:
To exercise any of these rights, email [email protected]. We will verify your identity (typically by confirming control of the email address linked to your account) and respond within 45 days, with one possible 45-day extension where reasonably necessary. You may use an authorized agent to submit requests where state law allows; we may ask for written proof of the agent's authority. We may decline or limit a request where required or permitted by law (for example, where retention is required to defend legal claims or where verification fails).
If you are a resident of a U.S. state with a comprehensive consumer-privacy law (currently including California, Colorado, Connecticut, Delaware, Iowa, Montana, Oregon, Tennessee, Texas, Utah, Virginia, and others as they take effect), the rights in Section 9 apply to you. The categories of personal data we collect, the purposes of processing, and the categories of recipients are described in Sections 3, 4, and 6. We do not sell personal data or share it for cross-context behavioral advertising. We do not engage in profiling that produces legal or similarly significant effects.
California residents have an additional right to request the categories and specific pieces of personal data we collected about them in the prior 12 months, the categories of sources, business purposes, and categories of third parties to whom we disclosed personal data (a "right to know"). These categories are disclosed throughout this Policy; you may also request a personalized response at the email above.
The Service is not intended for, and not directed to, individuals under the age of 18. We do not knowingly collect personal data from minors. If we learn that we have collected personal data from a person under 18, we will delete that data and the associated account. If you believe a minor has provided us with personal data, please contact [email protected]. AllCorals complies with the U.S. Children's Online Privacy Protection Act (COPPA) by not knowingly collecting data from children under 13.
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include HTTPS encryption in transit, password-less authentication via LINE and Google OAuth (so no password database exists to breach), hashed OAuth tokens at rest, restricted administrator access, and routine security review.
No system is perfectly secure. In the event of a personal data breach that affects you, we will notify you and the appropriate regulator(s) within the timeframes required by applicable law (for example, "without undue delay and, where feasible, no later than 72 hours" under GDPR; and the timelines required under U.S. state breach-notification statutes).
AllCorals uses machine-learning models (including a BioCLIP-based coral species classifier) to generate species suggestions, group similar Listings, and recommend trade-name labels. Publicly available Listing photos may be used to fine-tune and evaluate these models. We do not use AI to make solely automated decisions that produce legal or similarly significant effects on Users.
You may opt your future uploads out of model-improvement processing through your account settings. Opting out does not require us to delete photos already incorporated into trained models; it excludes future use only.
Messages exchanged through on-platform chat are stored to support the conversation, enable dispute resolution, and protect against fraud or abuse. We do not read or scan messages other than where required for a specific investigation, a lawful government request, or where a message is reported by a User. Off-platform conversations on LINE, WhatsApp, or other services are governed by those services' privacy policies, not this one.
We may update this Privacy Policy from time to time. Material changes will take effect no earlier than 30 days after notice is provided by email and on-platform banner. The "Effective date" at the top of this page reflects the current version. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.
If you have questions about this Privacy Policy, wish to exercise your data rights, or need to file a complaint, please contact us at [email protected].
