Privacy Policy

1. Scope

This Privacy Policy applies to Cardberry’s websites, applications, and related services that link to it (collectively, the “Services”). Cardberry is the controller of the personal information described here unless we say otherwise.

This policy does not govern third-party services such as Shopify or Discord. Their privacy policies apply when you use their services or follow a link to them.

2. Information we collect

Information you provide

• Account and profile information, such as your name, email address, password, organization, and team membership. We store a protected password hash, not your readable password.
• Inventory and listing information, such as grading-company certification numbers, card details, images, notes, prices, and publishing preferences.
• Integration information, such as a Shopify store domain and the permissions you grant when connecting a store.
• Communications, including support messages, feedback, and content you share in Cardberry-operated community spaces.

Information collected automatically

When you use the Services, we may receive your IP address, browser and device type, operating system, referring pages, timestamps, pages or features used, request and error logs, session identifiers, and security-event information. The public marketing site does not use analytics or advertising trackers as of the effective date of this policy, though its hosting provider may process ordinary request and security logs.

Information from connected services and other sources

At your direction, we may receive store identity, product, inventory, location, and related commerce data from Shopify. We may also obtain card and certification information from grading companies, data providers, and public or commercially available sources to match and enrich inventory records.

3. Sources of information

We collect personal information:

• directly from you and other members of your organization;
• automatically when you access or use the Services;
• from services you choose to connect, such as Shopify;
• from grading companies, card-data providers, and public or commercial sources used to enrich records; and
• from security, hosting, and support providers that help us operate the Services.

4. How we use information

We use personal information to:

• provide, maintain, and improve the Services;
• create and secure accounts, authenticate users, and manage organizations and permissions;
• import, match, organize, price, and publish graded-card inventory as you direct;
• operate and troubleshoot connected services;
• respond to questions, send service notices, and provide support;
• monitor reliability, prevent fraud or abuse, and protect the rights and safety of users and the Services;
• comply with law and enforce our agreements; and
• analyze aggregated or de-identified information that does not reasonably identify you.

5. How we disclose information

We may disclose personal information to:

• Service providers that provide hosting, storage, security, email, support, and similar operational services under appropriate restrictions.
• Connected services such as Shopify when you ask us to retrieve data or publish and update listings.
• Your organization, including its owners, administrators, and authorized members, according to their permissions.
• Authorities or other parties when reasonably necessary to comply with law, protect rights and safety, investigate misuse, or establish and defend legal claims.
• A successor or transaction participant in connection with a merger, financing, reorganization, bankruptcy, or sale of all or part of Cardberry, subject to appropriate confidentiality protections.
• Other recipients when you direct us or give consent.

6. Cookies and similar technology

The merchant application uses cookies and similar local storage that are necessary to keep you signed in, remember your theme, complete an integration authorization flow, prevent fraud, and secure the Services. Cloudflare Turnstile may also process device and request information when protecting account forms from abuse.

We do not use advertising cookies on the marketing site as of the effective date. Blocking necessary cookies may prevent account or integration features from working.

7. Data retention

We keep personal information only as long as reasonably needed for the purposes described in this policy, including while your account is active and as needed to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, and maintain security and backup records. The specific period depends on the type of information, why it was collected, and applicable law.

When you disconnect a Shopify store, Cardberry removes the stored connection credentials. We may retain limited non-secret integration records and logs where needed for security, auditing, dispute resolution, or legal compliance.

8. Security

We use administrative, technical, and organizational measures designed to protect personal information, including access controls and protection of stored credentials. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for using a strong, unique password and protecting access to your account.

9. Your privacy rights

Depending on where you live, you may have the right to request access to, correction of, deletion of, or a portable copy of personal information; to object to or restrict certain processing; to withdraw consent; and to appeal a decision on a privacy request. You may also have the right not to receive discriminatory treatment for exercising a privacy right.

To submit a request, email privacy@cardberry.ai. We may need to verify your identity and authority before acting. An authorized agent may submit a request where local law permits. We will respond as required by applicable law.

10. Regional disclosures

California and other U.S. states

The categories of personal information described above may include identifiers and account information; internet or other electronic network activity; commercial and business information; approximate location derived from IP address; user-provided content; and account credentials or connected service tokens that may be considered sensitive personal information. We collect and disclose these categories for the business purposes described in Sections 4 and 5.

During the 12 months before this policy’s effective date, Cardberry did not sell personal information or share it for cross-context behavioral advertising. Cardberry does not have actual knowledge that it sells or shares the personal information of anyone under 16.

European Economic Area, United Kingdom, and Switzerland

Where applicable, we process personal information to perform a contract with you; based on our legitimate interests in operating, improving, and securing the Services; with your consent; or to comply with legal obligations. Information may be processed in countries whose laws differ from those where you live. Where required, we use an approved transfer mechanism and appropriate safeguards.

You may lodge a complaint with your local data protection authority. Please contact us first if you have a concern so we can try to resolve it.

11. Children

The Services are intended for businesses and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can take appropriate action.

12. Changes and contact

We may update this policy as our Services or legal obligations change. We will post the updated policy here, revise the effective date, and provide additional notice when required.

Questions or privacy requests can be sent to Cardberry at privacy@cardberry.ai.