Privacy

Reading the encyclopedia

You can read all twenty-two chapters, the atlas, the stone tables and the A to Z index without giving us anything. Reading needs no account and no login, and there is no newsletter.

The site is served by Cloudflare, which necessarily processes your IP address and request headers to deliver the pages and to protect the site from attack. That processing is what makes the site reachable at all; it cannot be switched off without the site going dark. Cloudflare acts as our processor and is bound by its own data protection terms.

Advertising

Pages carry advertising supplied by Google AdSense. Google uses cookies and similar technology to serve ads, to measure them and, if you allow it, to personalise them using data it holds about you across other sites. Google and the third-party vendors it works with may place and read cookies in your browser, use web beacons and collect your IP address as a result of the ads shown here.

In the European Economic Area, the United Kingdom and Switzerland you are asked before any of this happens, through a consent notice certified by Google. Nothing is stored and no personalised advertising is served unless you consent. You can reopen that notice and change your answer at any time from the link in the footer.

If you refuse, you still see advertising, but it is not personalised and no advertising cookie is stored.

How Google uses information from sites that use its services

Analytics

We use Google Analytics to understand which chapters are read and how people arrive. It is configured with Google Consent Mode: across the EEA, the UK and Switzerland, analytics storage is denied by default and only enabled if you consent through the same notice. Where you have not consented, Google receives an anonymous signal carrying no identifier and no cookie.

Analytics data is retained for fourteen months and is not used to identify you. We do not send names, email addresses or any other personal detail into Analytics, and no page address on this site contains such a detail.

We may also use Cloudflare Web Analytics, which sets no cookie, stores nothing in your browser and does not follow you across sites. Because it collects no personal data, it is not placed behind the consent notice.

If we do business

Buying a stone is a separate matter from reading this site, and it involves more than a web form. Depending on the transaction we may have to ask for identification, proof of address and the source of the funds, because dealers in precious stones are subject to anti money laundering obligations in Switzerland.

Those documents are held only for as long as the law requires and are never used for marketing, never sold and never shared with an advertiser. They are not collected through this website.

Your marketplace account

Your account is your email address, the language you choose for the site, when you joined and when you last signed in. To sign in, you ask for one email that carries a six-digit code and a link; each works once, for fifteen minutes. We keep the code and the link only as SHA-256 hashes, with the address and the language they were sent with, so a copy of our database lets no one sign in. Asking for a code creates no account; using it does.

You can add a passkey, which signs you in with your fingerprint, face or device PIN. Your device keeps the private key. We keep the public key, the name you give the passkey, whether it is synced across your devices, and when it was added and last used.

You can make personal tokens that let an AI agent act for you on our MCP server. Of each token we keep the name you give it, its first sixteen characters, a SHA-256 of it (never the token itself), what you allowed it to do, and when it was made, expires, was last used and was revoked. Of each change an agent makes or tries with a token, such as an offer, an answer to one, a message or a standing bid, we keep which kind of change, what it concerned, whether it was done, and when; what agents read is not recorded. Why: to do what you asked your agent to do and show you what it did (a contract with you, and our legitimate interest in security). How long: the newest two hundred changes per account, and a token ninety days after it is revoked or expires, with what its agents did; all of it when you close the account.

Marketplace pages set three cookies of our own, each for one job: __Host-erebaur_s keeps you signed in for thirty days; __Host-erebaur_f, set on marketplace pages while you are not signed in, lets our forms tell your own submissions from forged ones, for a day; __Host-erebaur_p remembers a sign-in you have started, for fifteen minutes. They work only on this site, hold random values and nothing about you, and the marketplace cannot work without them, so they are not behind the consent notice. Of a session we keep a SHA-256 of the cookie value, how you signed in, and when the session began, was last used and ends.

Why: to give you the account you asked for and keep it safe (a contract with you, and our legitimate interest in security). Who sees it: our staff, and Cloudflare and Resend as described below. How long: the account until you close it, or three years after your last sign-in, when we delete it after telling you by email a month before. Sign-in requests are deleted thirty days after they were made, ended sessions ninety days after they end, and a passkey when you remove it or close the account.

Network addresses

Our database never holds your IP address in the clear. Two things use it.

Limits on how often something can be tried: sign-in emails, code attempts, passkey sign-ins, requests from AI agents and the changes they make, Price Check answers, requests to the open price API, dealer panel prices sent, alert sign-ups, uploads, messages, identity checks started, laboratory reports read and typed searches. Each is counted under a key made from a SHA-256 of the purpose and your address (for some limits your email address or your account instead), for ten minutes to a day. A hash like this is still personal data, because anyone who has your address can compute it again, so the counters are deleted within a day after their window ends. Why: to stop codes being guessed and forms being flooded (our legitimate interest in security).

Contract signatures: when you sign a contract, we keep a hash of your address made with a secret key and the contract, beside the name you typed, the time, your session and the document's hash. It cannot be reversed without the key, and if a signature is ever disputed it shows which session and network it came from. It is kept with the contract (see "Offers, contracts and deals").

Cloudflare, which runs the site, sees your address with every request (see "Where marketplace data is kept").

Trust tiers and verified names

Every account starts at tier T0. Some steps on the marketplace need a higher tier. A tier rises when a check by our verification provider passes, or when our staff decide after checking who you are by hand or reviewing a check; it falls when a check lapses or the provider reports a problem with it. Each change records the old and the new tier, who or what made it, why and when, and is never edited afterwards.

Your legal name: when your T1 check passes at Didit, we record the full name on your identity document as Didit read it; when our staff pass a check or correct a name, they record it with a note saying how. A contract needs it, and so does the check that a payment into escrow comes from you. The other side of a deal never sees it: contracts name both parties by account reference.

When identity checks are available, they are done by Didit Identity Spain, S.L., Calle Nápoles 227, 08013 Barcelona, Spain, as our processor, on its own pages. For T1, Didit receives photos of your identity document, a live selfie and data about your device and network, and screens your name against sanctions, politically exposed persons and adverse media lists. To check that you are the person on the document and that you are really there, Didit processes images of your face and the biometric data taken from them. For T2, it receives your company's name, country and registration number, checks the company in its registry, and gives each owner of 25% or more the same identity check. For T3, it receives a document showing your address, your answers about where your money comes from and a bank statement, which our staff review on Didit's system. Didit processes and stores all this in the European Union, keeps it for the period we set, ten years from the check, unless we delete it sooner, and keeps no separate face template once a check is deleted.

From a check we keep only its result, Didit's reference for it, for T1 the name on your document (above), whether the sanctions screening found a possible match (not what it found), the date your identity document expires, the company name the registry gave and the name you give for the company's bank account, never the account number. A business registered where we ask for a dealer licence uploads it to our private R2 storage, where only you and our staff can open it. A possible match is decided by our staff, never by a machine alone.

Why: to decide who may make or accept an offer or sell as a business, and to guard against fraud, money laundering and breaches of sanctions (our legal obligations and legitimate interest). For the biometric data, your explicit consent, which you give by ticking a box before the check starts: without it there is no T1 check. You can withdraw it by writing to us; we then have Didit delete the images and the data taken from them, unless a law requires us to keep them. How long: tier changes, check results and verified names as long as the account exists, and those used in a deal as long as that deal's records; a dealer licence as long as the business stays verified, or twelve months after its application is refused or lapses.

Didit privacy policy

Selling a stone

When you offer a stone we keep what you enter: the stone in the codes and the words of its laboratory report, the report's laboratory, number and date, your asking price, the city where the stone is and your note. Photographs and the report file are stored in a private Cloudflare R2 bucket and served only after our own access check: to you and our staff while the stone is in review; once it is published, the photographs to anyone and the report file to signed-in visitors. A report can carry the name of whoever had it made; if yours does, cover the name before you upload it. What you write on the listing and the report file are also read by an AI model for our staff (see "Translation, typed search and screening").

Our review is recorded step by step, each step with who did it and when: whether Erebaur has an interest in the stone, the origin screening, and the decision to publish, hold or refuse it with the reason. These records are written once and never changed. A published listing shows the stone, its laboratory reports and the city where it is, never who is selling it.

Every listing that ever carried a report number stays visible to our staff with how it ended, so a report that comes back on another stone is seen with its history.

Why: to review and publish the stone you asked us to list (a contract with you), and to keep fraudulent and sanctioned stones off the market (our legitimate interest and legal obligations). How long: while the listing is on the market; if the stone sells, as long as that deal's records; if it is refused or withdrawn, its photographs and files are deleted twelve months later and the rest of its record five years later. A stone you started to offer and did not submit is deleted, with its files, thirty days after your last change to it. A stone you saved is kept in your list until you remove it, close your account or the listing is deleted.

Reading a laboratory report

On the selling form and in Price Check you can have a laboratory report read for you instead of typing it. When you press the button, the file you chose, a PDF or a photo of the report, is sent with our instructions to Anthropic, PBC, whose AI model Claude reads it and returns the details of the stone and the report. Anthropic does this as our processor; for the European Economic Area, Switzerland and the United Kingdom its contracting party is Anthropic Ireland, Limited. What comes back is a draft: you check every field against the report, and nothing is saved until you send the form.

Reports often carry the name of whoever had them made. The model is told never to return a person's name, and our server drops anything outside the details we ask for and any sentence that looks like it names someone. Cover the name before you upload the file if you can.

What we keep. In Price Check, nothing of the file or of what was read: the file is read in memory, sent to Anthropic and dropped. On the selling form the file is not kept either; the report and its details are kept only when you send the form, as "Selling a stone" describes. For every read we record which model read it, how long it took, how much of the model it used, which fields it filled and which it could not, and, once you send the form, which of them you kept and which you changed. We never record what a field said, nor who asked.

Under its commercial terms, Anthropic may not train its models on what we send it. It deletes the file and the model's answer within 30 days of receiving them, unless it must keep them longer to enforce its usage policy (up to two years for content its safety systems flag) or a law requires it. It stores data in the United States and may run the model in other countries; the transfer is covered by the standard contractual clauses, with their Swiss and UK addenda, in its data processing addendum.

Why: because you ask us to read the report for you (our legitimate interest in offering an easier form, which you choose to use). How often: a few reads a day from each network address in Price Check, and a limited number an hour from each account on the selling form (see "Network addresses").

Anthropic privacy policy

Anthropic commercial terms

Sanctions screening

We screen the origin of each stone against the sanctions rules of the United States, the European Union, the United Kingdom and Switzerland that we apply: when the stone is offered, again when it is published, and again when an offer on it is accepted. We keep each result with the version of the rules it used, and any clearance a staff member recorded, with its reasons.

This screening is of the stone. People are screened against sanctions lists only as part of the identity checks described under "Trust tiers and verified names", by Didit.

Why: to comply with sanctions law and keep sanctioned stones off the market (our legal obligations and legitimate interest). How long: with the listing's records, as above.

Standing bids, requests and notifications

A standing bid keeps the stone you would buy, the most you would pay per carat in the currency you choose, and how long it stands. When a stone that fits is published, we record the match and tell you in the app. A cap in another currency than the stone is compared at the European Central Bank's reference rate, which we fetch once a day; nothing about you is sent to the bank. Sellers see only how many bids sit in each segment and weight band, and only where at least three different buyers placed them; never who placed a bid or its price.

A request keeps the stone you describe, its shape, your budget, the date you need it by and your note. Staff check it before sellers see it, without your name. A seller's answer keeps the message and, if they chose one, one of their stones; staff check it before you see it, without the seller's name. If staff decline either, the note they write is kept and shown to its author.

Notifications about your bids, requests, stones, offers, deals and messages are kept in the app.

Why: to do what you asked (a contract with you). How long: bids and their matches twelve months after the bid expires or is cancelled; requests and answers twenty-four months after the request is closed or declined; notifications twelve months.

Offers, contracts and deals

An offer keeps its amount, who made it and when, how long it stands, and how it was decided. An offer that ends without a deal is kept two years after it closes.

When an offer is accepted, the deal records the agreed price, our commission, each step and when it happened, the carrier and the tracking number, the name on the payment as Escrow.com shows it to us (to compare with your verified name), and a summary of what Escrow.com reports, without your personal details. The contract is generated once and stored with its SHA-256 hash, and never changed. Each signature records the name you typed, the time, your session, the hashed network address described above and the document's hash, and is never changed or deleted. The other side sees you only as an account reference; the name you typed is shown only to you and our staff.

Why: to carry out the sale between buyer and seller and our part in it (a contract with you), to keep the records that commercial, tax and anti money laundering law require (our legal obligations), and to be able to show what was agreed (our legitimate interest). How long: ten years after the deal closes, the period Swiss commercial law sets for business records.

Payment through Escrow.com

Money for a deal never passes through us. The buyer pays into escrow at Escrow.com, an independent payment provider in the United States, which pays the seller after the inspection, less our commission. To set up the escrow we send Escrow.com the buyer's and the seller's email addresses, the stone's description, the price, our commission and the deal reference, and later the carrier and the tracking number of the shipment and of any return. You agree to the transaction on Escrow.com's own pages.

Escrow.com runs its own checks on each party and decides for itself what it collects, how long it keeps it and where. For that it answers under its own privacy notice, not ours. The wire instructions it gives are shown to the buyer inside the account, fetched from Escrow.com each time, and never stored or emailed by us.

Escrow.com privacy notice

Completed sales and the Fair Range

The Fair Range, the price range shown in Price Check only, comes from a price model that learns from sales. It is never shown on or beside a stone for sale here: we earn a commission when one sells, that commission is an interest in the stone, and we never estimate a stone we have an interest in. A deal completed on the marketplace becomes one of those sales once Escrow.com has paid the seller: its agreed price, the day it was agreed, and the stone as its laboratory report describes it. No name, email address or account goes into the model. With a range we may show up to five comparable sales; a sale made here appears among them only as its month, the fact that it was a sale on Erebaur, its weight and its price per carat, rounded to three significant figures.

A sale between people who are not independent of each other says nothing true about a price, so it is left out. To find such sales we check, for each completed deal, whether one account is on both sides, whether a legal name our staff recorded for the buyer matches one recorded for the seller, whether both belong to one business we have on record, whether both sign in with addresses at one organisation's email domain (large public mail services are skipped), and whether either side works for Erebaur. Staff can also leave a deal out, with a written reason that is kept with the deal and not shown to either side. A deal that was rejected, returned or disputed, and one for a stone Erebaur had an interest in other than our commission, are left out as well.

The model is trained by a scheduled job that runs on GitHub's servers in the United States; GitHub complies with the EU-U.S., UK and Swiss-U.S. Data Privacy Frameworks. To make the checks above, the job reads both sides' email addresses and recorded legal names from our database, compares them and writes none of them down. It keeps, for ninety days, the list of deals left out, by deal reference, with the reasons. Why: so that the range rests on real sales between independent parties and cannot be moved by a staged sale (our legitimate interest, and that of everyone who relies on the range). How long: a completed sale counts for as long as its deal's records are kept (see "Offers, contracts and deals").

Dealer panel prices. A dealer we invite to our dealer panel may send us a price they paid or were paid for a stone with a laboratory report: whether they bought or sold it, the day, the price and its currency, whether the stone was set in a jewel, the stone as its report describes it with the report's laboratory, number and date, and an optional note. We keep it with their account, and our staff review it. An accepted price goes into the price ledger as a dealer panel price: the ledger, the indices, Price Check and the open price API never name the dealer, and only our staff can trace it to the account. A declined price is kept with the reason, which the dealer reads. Why: so that the indices and Price Check rest on more real sales (our legitimate interest, and that of everyone who relies on them). How long: a price that never went into the ledger is deleted when the account closes; an accepted price stays in the ledger as a sale, without its note.

Email

We send email through Resend, from notifications@erebaur.com; replies go to info@erebaur.com, where a person reads them. The sign-in code and link, and the code that confirms a Price Check alert, are sent at once, while you wait. Every other email is first written to an outbox in our database, in the same step as the change it is about, and sent from there: emails about your offers and deals, a daily summary of new stones that match your standing bids, an email saying that a new message is waiting for you, and the Price Check alerts you asked for.

An outbox entry holds no email address and no text: only the kind of email, the account or the alert it is for, the deal, offer or listing it is about, its language, the few facts it needs (such as the step a deal has reached, the stones in a summary or the range in an alert), whether it was sent, how many attempts it took and the last error. The address and the words are put together when the email is sent. Entries are deleted ninety days after they are written. Resend receives the address and the email to deliver it, and keeps both, with the delivery record, for thirty days.

Emails are written in your account's language, which you can change at /account/email/. Emails about offers and deals cannot be turned off, because a deal cannot be carried out safely without them; they carry no price, no name and no bank details, which stay in your account. The daily summary is on unless you turn it off at /account/email/, and is sent only on a day when a stone has matched since the last one. The new-message email never contains the message. There is no newsletter and no marketing email. Why: to run the account, the deals and the alerts you asked for (a contract with you; your consent for alerts). How long: your language and your summary setting as long as the account.

Price Check alerts

If you ask to be emailed when the Price Check answer for a stone changes, we keep your email address, your language, the stone as you described it, report number included, and a record of your consent: the version of the words you ticked, their language, a SHA-256 of their exact text and the time. Nothing is sent until you enter the six-digit code we mail you; the code is kept only as a hash and works for fifteen minutes.

To tell when the answer has changed, we keep the last answer you were given (its middle figure and grade, or that there was not enough data), the published price table it was last compared with, and when we last emailed you. Every alert carries an unsubscribe link, and we keep only a hash of each link. Unsubscribing stops the alert for good: a new alert needs a new consent. We never send a range for a stone Erebaur has an interest in.

Why: your consent, which you can withdraw at any time with the link. How long: an alert never confirmed is deleted thirty days after it was asked for. After you unsubscribe, the alert and its consent record are kept three years, to show what you agreed to and when you withdrew it, then deleted.

Messages between buyers and sellers

Once an offer is made on a stone, its buyer and its seller can write to each other on that offer, and on the deal if it becomes one, while the offer is open or the deal is under way; once the deal is completed, refunded or cancelled, they can only read. Before the other side reads a message, every email address, phone number, link, messenger name or handle and bank detail in it is replaced by a note saying that contact details were removed. Each side sees the other only as the buyer or the seller, never by name or email address. A message can be up to 2,000 characters long, and an account can send up to twenty messages in ten minutes.

We keep each message twice: as the other side reads it, and as it was written, which only our staff can see. We also keep the kinds of detail that were removed, so that the author can be told, and when the message was sent. No one can change a message once it is sent. Staff can read any conversation and write in it as Erebaur, and can hide a message that breaks our rules: both sides then see a note in its place, and the message is kept with the reason, who hid it and when, in a log of staff actions that is never changed. Staff read messages only to deal with fraud, a dispute, a report of misuse or a screening flag; an AI model reads them for our staff, and translates them for a reader who asks, as "Translation, typed search and screening" describes. The other side is told in the app, and by email, that a new message is waiting, never what it says.

Why: to let the two sides talk while protecting both from fraud and from deals taken off the marketplace (our legitimate interest, and a contract with you). How long: messages about a deal as long as that deal's records; others two years after the last message in the conversation.

Translation, typed search and screening

Translating messages is off until you turn it on, with the switch shown on each conversation; it then applies to all your conversations until you turn it off. While it is on, the messages you open that you did not write are sent to Anthropic, PBC, whose AI model Claude translates them into the language you read the site in. A message is sent as you read it, with contact details already removed and nothing that says who wrote it, and the original stays under its translation. The model is told never to write contact details, and our server removes any that appear in a translation all the same. Each translation is kept with its message, so a message is sent once for each language, and the translation is deleted with the message. If the other side turns translation on, the messages you write to them are sent to Anthropic in the same way, to be translated for them.

On the market you can describe the stone you are looking for in a sentence, in any language, instead of choosing the filters yourself. The sentence is sent to Anthropic, whose model returns the filters it asks for; you see them and can change them, and the search itself does not use AI. We keep nothing of the sentence, so leave your name and contact details out of it. Turnstile checks the form, and each network address can send a limited number of sentences a day (see "Network addresses").

For our staff, the same model reads every message a buyer or a seller writes, once, as the other side reads it, with up to twenty earlier messages of the conversation for context. In those messages it points out an attempt to move the contact or the payment off Erebaur, or a stone said to be of an origin we refuse. It also reads every stone offered for sale once, after it is offered: what the seller wrote on the listing (the note, the colour, treatment and origin in their own words, the city), the origin country they chose and the laboratory report file they uploaded. There it points out an origin we refuse, stated in the seller's words or on the report, and the name of the person who had the report made, left on the report file. Our own rules also flag, at once, a message from which they removed contact details. A flag is only a pointer: it blocks nothing and decides nothing, our staff read what it points to and decide, and no buyer or seller sees it.

Of a flag we keep its kind, the message or stone it is about, the part that was read (the message, the seller's words or the report file), whether our rules or the model raised it, the few words that show it, copied from the message or the seller's words and never from the report file, and when. When staff review it, we keep who did, when and their note. We also record when each message and each stone was read. Flags and these records are kept as long as the message or the stone they are about, and deleted with it.

For all three, Anthropic is our processor on the same terms as for reading a report (see "Reading a laboratory report"): it may not train its models on what we send it, and deletes it within 30 days unless it must keep it longer. For every call we record what it was for, which model answered, how long it took, how much of the model it used, how it ended and how many items it returned; never what was sent or returned, nor whom it was about. Your translation setting is kept with your account. Why: translation and the typed search because you ask for them (a contract with you, and our legitimate interest in letting the two sides of a deal understand each other); screening to keep deals where the escrow protects both sides, to keep stones of refused origins off the market and to protect both sides from fraud (our legitimate interest).

Where marketplace data is kept

The marketplace runs on Cloudflare, our processor. Its Workers run the site's code and see each request, your IP address included; its D1 database holds everything described above; its R2 storage holds photographs, laboratory reports and dealer licences; Turnstile checks the sign-in, alert and typed search forms; it sets no cookie, and Cloudflare uses your IP address, your browser's user agent and a fingerprint of the connection only to tell a person from a bot. Cloudflare keeps a log of each request to marketplace pages, which can include your IP address, for up to seven days, so that we can find errors and attacks. Cloudflare may process this data in any country where it operates.

Resend delivers our email, Escrow.com handles payment for deals, GitHub runs the Fair Range job, Didit runs identity checks and Anthropic reads laboratory reports and typed searches, translates messages and screens messages and stones, as described above. We do not sell marketplace data and give it to no one else, unless a law or a court requires it.

Once a day we put on Bitcoin, through the public OpenTimestamps calendars, one fingerprint of the marketplace records written that day: each listing's review record, contracts and their signatures, and every step of a deal. Each record is first hashed with a random value of its own, its salt, so the fingerprint reveals nothing and cannot be traced back to anyone; the calendars receive only that 32-byte fingerprint, and what is written on Bitcoin cannot be removed. We keep each record's hash and its salt. The salts go only to our staff and, for a deal's contract and steps, to its two sides. When a record is deleted at the end of its period, its salt is deleted with it, and the hash left behind can no longer be tied to anything. Why: so that anyone can check that our records were not changed after the fact (our legitimate interest, and that of everyone who relies on them).

Offering a stone through the register

The form on the register page where you offer a stone asks for your name, your email address, the stone, a note and up to six photographs. Cloudflare Turnstile checks that a person is sending it, and each network address can send ten submissions an hour.

The photographs are stored in a private Cloudflare R2 bucket, without what the camera wrote into them, such as a position or a device. Your name, email address, stone and note are not stored there: they reach us in one email, sent through Resend to info@erebaur.com, with links that open the photographs.

Why: to assess the stone you offered and to answer you, as you asked. How long: the photographs are deleted twelve months after you sent them, or earlier once we have decided on your stone, and their links stop working with them. We delete the email from our mailbox within the same twelve months. Resend keeps its copy of the email, with the delivery record, for thirty days. If your stone is listed, the listing stays published for as long as it is in the register.

Where your data goes

Google and Cloudflare are American companies and Resend operates on American infrastructure, so some of this data is processed outside Switzerland and the European Economic Area. Each of them relies on the European Commission and Swiss adequacy decisions for the EU-US and Swiss-US Data Privacy Framework, or on standard contractual clauses where that does not apply.

GitHub, which runs the job that keeps the Fair Range up to date, is also an American company and complies with the same Data Privacy Frameworks. Escrow.com, also in the United States, is not our processor but an independent payment provider, and its privacy notice names no transfer framework. For a deal, we pass it what it needs because the payment you asked for cannot be made otherwise. Didit, which runs identity checks for us, is in Spain and keeps what it collects in the European Union. Anthropic, whose AI model reads laboratory reports and typed searches, translates messages and screens messages and stones for our staff, is an American company too; it stores data in the United States, and the transfer is covered by the standard contractual clauses in its data processing terms.

We do not sell your data. We have never sold your data. There is no arrangement under which anyone pays us for it.

Your rights

Under the Swiss Federal Act on Data Protection, and under the GDPR if you are in the EEA or the UK, you can ask what we hold about you, ask for a copy, ask us to correct it, ask us to delete it, object to how we use it and withdraw a consent you gave. Withdrawing consent does not undo what was lawful before you withdrew it.

You can close your marketplace account by writing to us. We then delete what this page says we delete, and keep only what a law or an open deal requires, for the periods given above, and use it for nothing else.

Write to info@erebaur.com and we will answer within thirty days. We do not charge for this and we will not ask you to justify the request.

If you are unhappy with our answer you can complain to the Swiss Federal Data Protection and Information Commissioner, or to the supervisory authority where you live if that is in the EEA or the UK.

Children

This site is not directed at children and we do not knowingly collect anything from them. The encyclopedia is open to anyone who wants to read it, but the marketplace is for adults.

Law and forum

This policy is governed by Swiss law, and in particular the Federal Act on Data Protection. The place of jurisdiction is Fribourg, Switzerland. If you are in the EEA or the UK, this does not take away the protection of the mandatory rules of the country you live in, nor your right to complain to your own supervisory authority.

Changes

This policy was last revised on 4 November 2026. When it changes materially we will say so here and change the date. We do not quietly rewrite it.