1. Scope
This Privacy Policy applies to Cardberry’s websites, applications, and related services that link to it (collectively, the “Services”). Cardberry is the controller of the personal information described here unless we say otherwise.
This policy does not govern third-party services you choose to use directly, such as Shopify or Cardberry’s Discord community. Their privacy policies apply when you use their services or follow a link to them. When Cardberry uses a third-party provider to operate the Services, the disclosure terms below apply.
Notice at collection. Cardberry collects the categories of information described below for the business and commercial purposes in Section 4. We do not sell personal information or share it for cross-context behavioral advertising.
2. Information we collect
Information you provide
- Account and profile information, such as your name, email address, password, organization, and team membership. We store a protected password hash, not your readable password.
- Inventory and listing information, such as grading-company certification numbers, card details, images, notes, prices, and publishing preferences.
- Integration information, such as a Shopify store domain and the permissions you grant when connecting a store.
- Communications, including support messages, feedback, and content you share in Cardberry-operated community spaces.
- Billing and transaction information, if you purchase a paid feature, such as subscription, invoice, tax, payment-status, and limited payment-method details. A payment processor may collect full card or bank information directly; Cardberry does not need to receive or store the full payment credential when the processor handles it.
Information collected automatically
When you use the Services, we may receive your IP address, browser and device type, operating system, referring pages, timestamps, pages or features used, request and error logs, session identifiers, and security-event information. The public marketing site does not use analytics or advertising trackers as of the effective date of this policy, though its hosting provider may process ordinary request and security logs.
Information from connected services and other sources
At your direction, we may receive store identity, product, inventory, location, and related commerce data from Shopify. We may also obtain card and certification information from grading companies, data providers, and public or commercially available sources to match and enrich inventory records.
Please do not submit sensitive personal information that the Services do not request, such as government identification numbers, health information, or full financial-account credentials.
3. Sources of information
We collect personal information:
- directly from you and other members of your organization;
- automatically when you access or use the Services;
- from services you choose to connect, such as Shopify;
- from grading companies, card-data providers, and public or commercial sources used to enrich records; and
- from security, hosting, and support providers that help us operate the Services.
4. How we use information
We use personal information to:
- provide, maintain, and improve the Services;
- create and secure accounts, authenticate users, and manage organizations and permissions;
- import, match, organize, price, and publish graded-card inventory as you direct;
- operate and troubleshoot connected services;
- process purchases, maintain billing records, prevent payment fraud, and administer subscriptions;
- respond to questions, send service notices, and provide support;
- monitor reliability, prevent fraud or abuse, and protect the rights and safety of users and the Services;
- comply with law and enforce our agreements; and
- analyze aggregated or de-identified information that does not reasonably identify you.
5. How we disclose information
We may disclose personal information to:
- Service providers that provide hosting, storage, security, email, support, internal operational notifications (including Discord), and similar services under appropriate restrictions. Operational notifications may include your account email, public storefront URL, and slab details such as card name, certification number, grader, and grade.
- Connected services such as Shopify when you ask us to retrieve data or publish and update listings.
- Payment providers that process transactions, prevent fraud, and support billing when paid features are available.
- Your organization, including its owners, administrators, and authorized members, according to their permissions.
- Authorities or other parties when reasonably necessary to comply with law, protect rights and safety, investigate misuse, or establish and defend legal claims.
- A successor or transaction participant in connection with a merger, financing, reorganization, bankruptcy, or sale of all or part of Cardberry, subject to appropriate confidentiality protections.
- Other recipients when you direct us or give consent.
Cardberry does not sell personal information or share it for cross-context behavioral advertising. We also do not use sensitive personal information to infer characteristics about you.
7. Data retention
We keep personal information only as long as reasonably needed for the purposes described in this policy, including while your account is active and as needed to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, and maintain security and backup records. The specific period depends on the type of information, why it was collected, and applicable law.
We may retain transaction and consent records for the periods required by tax, accounting, payment, subscription-renewal, and consumer-protection laws. Backup copies may remain for a limited period after deletion until overwritten through normal backup cycles, unless a longer legal or security hold applies.
When you disconnect a Shopify store, Cardberry removes the stored connection credentials. We may retain limited non-secret integration records and logs where needed for security, auditing, dispute resolution, or legal compliance.
8. Security
We use administrative, technical, and organizational measures designed to protect personal information, including access controls and protection of stored credentials. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for using a strong, unique password and protecting access to your account.
9. Your privacy rights
Depending on where you live, you may have the right to request access to, correction of, deletion of, or a portable copy of personal information; to object to or restrict certain processing; to withdraw consent; and to appeal a decision on a privacy request. You may also have the right not to receive discriminatory treatment for exercising a privacy right.
To submit a request, email privacy@cardberry.ai. We may need to verify your identity and authority before acting. An authorized agent may submit a request where local law permits. We will respond as required by applicable law. If we deny a request, you may appeal by replying to our decision or emailing the same address with “Privacy appeal” in the subject line.
10. Regional disclosures
California and other U.S. states
The categories of personal information described above may include identifiers and account information; internet or other electronic network activity; commercial and business information; approximate location derived from IP address; user-provided content; and account credentials or connected service tokens that may be considered sensitive personal information. We collect and disclose these categories for the business purposes described in Sections 4 and 5.
During the 12 months before this policy’s effective date, Cardberry did not sell personal information or share it for cross-context behavioral advertising. Cardberry does not have actual knowledge that it sells or shares the personal information of anyone under 16.
We may create aggregated or de-identified information and use or disclose it for lawful purposes. Where applicable law treats that information as de-identified data, we will maintain it in de-identified form and will not attempt to re-identify it except to test whether our de-identification measures work.
European Economic Area, United Kingdom, and Switzerland
Where applicable, we process personal information to perform a contract with you; based on our legitimate interests in operating, improving, and securing the Services; with your consent; or to comply with legal obligations. Information may be processed in countries whose laws differ from those where you live. Where required, we use an approved transfer mechanism and appropriate safeguards.
You may lodge a complaint with your local data protection authority. Please contact us first if you have a concern so we can try to resolve it.
11. Children
The Services are intended for businesses and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can take appropriate action.
12. Changes and contact
We may update this policy as our Services or legal obligations change. We will post the updated policy here, revise the effective date, and provide additional notice when required.
Questions or privacy requests can be sent to Cardberry at privacy@cardberry.ai. If you need this policy in an accessible alternative format, contact us at the same address.