Privacy policy

This policy describes how personal information is handled on the DISME website. It covers this website only.

It does not cover Whatnot. When you watch a show, follow the channel, bid or buy, that activity happens on Whatnot's platform and is handled under Whatnot's own privacy policy. DISME is independent from Whatnot.

It also does not cover independent grading services or other third parties whose websites you may reach from a link here.

This website is intentionally light. There is no account signup for visitors, no checkout, no newsletter subscription currently accepting addresses, no contact form, no comment system, no analytics product, no advertising or attribution pixel, and no social media embed or tracking script.

The information processed today falls into these categories:

• Technical and server log data. Like any hosted website, requests to this site are logged by the hosting infrastructure. That typically includes IP address, user agent, requested URL, referrer, timestamp and response status. It is used to serve pages, protect against abuse and diagnose faults.
• Operator account data. A small number of DISME staff sign in to a private control room to publish show status and featured pulls. That involves an email address, a hashed password credential and session information for those staff only. No visitor accounts exist.
• Content you choose to make public elsewhere. Where a pull record or clip credits a collector handle, it is published only where that material is already public or the person has authorised it.

So the picture is unambiguous, the following are not happening on this site at the time of the revision date above:

• No sale, sharing or renting of personal information, and no sharing for cross-context behavioural advertising.
• No email or SMS marketing sending. The show-alerts field on the site is visibly disabled and accepts nothing, because no email provider is connected yet.
• No analytics, heatmap, session-recording or A/B testing vendor.
• No advertising, retargeting or conversion pixel.
• No profiling or automated decision-making that has legal or similarly significant effects.
• No purchase, payment, card or shipping data — those are processed by Whatnot, not here.

Technical data comes directly from your browser when it requests a page. Operator credentials come from the DISME staff member who creates them. Publicly published show and pull records are entered by DISME staff.

Information is used only to:

• deliver and display the website;
• keep the site secure and available, and investigate abuse, errors or attempted intrusion;
• authenticate DISME operators and record who published a show update, and — inside the internal operations console — who created, edited, allocated, packed, sealed, reopened or corrected an inventory item or RIPZ package, when, and why;
• meet legal, accounting or record-keeping obligations where they apply.

This site is aimed at visitors in the United States, but if you access it from the United Kingdom or the European Economic Area, the bases relied on are: legitimate interests, for delivering the site, keeping it secure and diagnosing faults; contract, for providing the private control room to DISME operators; legal obligation, where a law requires retention or disclosure; and consent, which would be requested in advance if any non-essential tracking were ever introduced.

This policy explains a genuine current position. It is not a claim of certification, accreditation or absolute compliance with any privacy framework.

This site sets no advertising or analytics cookies. The only browser storage in use is strictly necessary: the signed-in session for DISME operators using the private control room, held in the browser of that staff member. An ordinary visitor browsing the public pages is not given a tracking cookie or a tracking identifier.

Fonts are served from Google's font service, so your browser makes a request to that service when a page loads, which reveals your IP address and user agent to it. That request is for typography delivery, not tracking. Video and live content are not embedded here — the Whatnot links open the platform in a new tab, where Whatnot's own cookies and policies apply.

If non-essential measurement is added in the future, it will be introduced behind a consent mechanism with equally usable accept and reject options, defaulting to rejected where the law requires it, and this section will be updated before anything fires.

DISME uses a small number of infrastructure providers that process data on its behalf: a website hosting and content delivery provider, and a managed database and authentication provider used for show records and operator sign-in. They may only process the data to provide those services.

Information may also be disclosed where required by law, to respond to a lawful request, to protect DISME's rights or the safety of others, or in connection with a business reorganisation, in which case this policy or its successor will continue to apply to the information.

Links to Whatnot, grading services and other third parties are provided for reference. Once you follow one, that organisation's privacy practices apply and DISME has no control over what they collect.

Internal operations records are append-only: a staff action history cannot be edited or deleted, and corrections are stored as additional entries. That history is visible only to authorised DISME operators and is never published. Server and security logs are held only as long as the hosting provider's operational retention window allows, then discarded or aggregated. Operator accounts and their publishing history are kept while the person is authorised, and removed or disabled when they are not. Published show and pull records are kept as an archival collector record, and can be corrected or withdrawn.

The site is served over HTTPS. The database enforces row-level access rules so that public pages can read only published show and pull records, and only authenticated operators with the correct role can write them. Administrative writes are authorised on the server, not in the browser.

No system can be guaranteed completely secure, and no representation of absolute security is made here.

This site is not directed to children and no account or signup is available to visitors. DISME does not knowingly collect personal information from children. Account eligibility for watching or buying on Whatnot is set by Whatnot's current requirements.

If you believe a child's information has reached DISME, please get in touch and it will be deleted.

Several US states give residents rights over their personal information, including the right to know or access what is held, to request correction or deletion, to obtain a portable copy, to opt out of sale or sharing and of targeted advertising, and not to be discriminated against for exercising a right.

DISME does not sell or share personal information and does not run targeted advertising, so there is nothing to opt out of today. The other rights are honoured for residents of any state that grants them, and the process below applies. If a request is denied, you may appeal by replying to the response.

If UK or EU data protection law applies to you, you have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to data portability, and to withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with your national supervisory authority, or with the Information Commissioner's Office in the United Kingdom.

Because this site is hosted and operated from the United States, information processed here is handled in the United States. If a transfer mechanism becomes relevant for a specific service, it will be described in this section rather than asserted in general terms.

A dedicated DISME contact address for legal and privacy requests is being confirmed. Until it is published here, questions about an order placed during a live show are handled through the Whatnot channel where the purchase was made. A dedicated privacy request address will be published in this section once confirmed, and requests will be answered within the period required by applicable law. Verification may be requested before information is disclosed or deleted.

An authorised agent may submit a request on your behalf where the law allows, with proof of authorisation.

This policy will be updated as the website changes — in particular if email alerts, analytics or any new integration are added. The revision date at the top of the page shows the current version. Material changes will be described here rather than made quietly.