Privacy Policy

1. Information We Collect

We collect the following categories of personal information when you use the Service:

A. Information You Provide Directly

1. Account Data: Your full name, email address, and password when you register for an account.
2. Collection Data: Card images, descriptions, inventory records, grades, valuations, and notes that you upload or create within the Service.
3. Support Communications: Information you provide when submitting support requests, bug reports, or feedback through in-app forms.
4. Profile Preferences: Settings such as sharing preferences, display preferences, and subscription plan selections.

B. Information Collected Automatically

5. Usage Data: Pages visited, features used, time spent, click paths, and other interaction metrics.
6. Device Data: IP address, browser type, operating system, screen resolution, and device identifiers.
7. Analytics Data: Aggregate, anonymized visitor statistics used to understand traffic patterns and improve the Service.

2. How We Use Your Information

We use the personal information we collect for the following purposes:

1. To create and manage your account and provide access to the Service;
2. To process card images and generate AI-assisted grading, valuation, and market analysis outputs;
3. To process payments and manage your subscription, including billing and renewal;
4. To communicate with you about your account, security alerts, product updates, and promotional offers (where you have opted in);
5. To provide customer support and respond to your inquiries;
6. To analyze usage patterns and improve the performance, features, and reliability of the Service;
7. To detect, prevent, and address fraud, abuse, and security issues;
8. To comply with applicable legal obligations and protect our legal rights.

3. How We Share Your Information

We Do Not Sell Your Data. CardVault Collection Intelligence does not sell, rent, or share your personal data or collection data to third parties for advertising or marketing purposes — period.

We may share your information in the following limited circumstances:

1. Service Providers: We share data with trusted third-party providers that help us operate the Service — such as payment processors (Wix/Base44 Payments), cloud hosting, email delivery, and AI model providers. These providers are contractually obligated to protect your data and use it only to provide services to us.
2. Public Sharing: If you explicitly enable the public sharing feature, the cards you designate will be visible at your unique share link. You may disable sharing at any time.
3. Legal Compliance: We may disclose information when required by law, court order, or government regulation, or when we believe in good faith that disclosure is necessary to protect our rights, safety, or property, or those of our users or others.
4. Business Transfers: In connection with a merger, acquisition, or sale of assets, information may be transferred subject to the protections of this Privacy Policy.

4. Data Retention

We retain your personal information for as long as your account is active. If you delete your account, we will remove your personal data and collection records within thirty (30) calendar days, subject to any applicable legal hold or statutory retention requirements. Anonymous, de-identified, or aggregated data that cannot be linked back to you may be retained indefinitely for analytics and service improvement.

5. Data Security

CardVault Collection Intelligence employs industry-standard administrative, technical, and physical security measures to protect your personal information. Here are the specifics:

• Encrypted transit: All traffic between your browser and our servers is encrypted with HTTPS/TLS, and HSTS is enforced so your browser always uses the secure connection.
• PCI DSS Level 1 payments: Payments are processed by Wix Payments (branded as Base44 Payments), which holds PCI DSS Level 1 certification (Merchant & Service Provider) — the highest tier of the payment security standard, used by major banks.
• Card numbers never touch our servers: Your credit card number, CVV, and other sensitive payment details are entered directly into the processor's secure checkout page. CardVault never collects, stores, or sees them — we only receive confirmation of the transaction status.
• Salted password hashing: Your password is stored as a salted hash by our authentication provider — never in plain text. Even we cannot see your password.
• Per-account data isolation: Your collection, photos, grades, and account details are isolated to your account. Other users cannot access your data unless you explicitly share your collection.

No method of electronic transmission or storage is completely secure, but we apply these measures to protect your information and continually review our practices as the platform grows.

6. Cookies and Tracking Technologies

The Service uses cookies, local storage, and similar technologies to recognize your browser, remember preferences, and improve the Service. Here's what we use:

• First-party analytics: A first-party visitor identifier stored in your browser's local storage counts unique visitors and tracks page views so we can understand traffic patterns and improve the product. This identifier is not linked to your account.
• Google Ads measurement tag: We use a Google Ads measurement tag to measure the performance of our advertising campaigns — for example, which ads lead to sign-ups. This tag may set cookies on your browser. You can control cookies through your browser settings, and Google provides options to opt out of personalized advertising at ads.google.com/settings/ads.
• No data sale: We do not sell your personal data or share it with third parties for advertising or marketing purposes. The tracking we do is limited to measuring our own ad performance and improving the product.

You can control cookies through your browser settings, but disabling them may limit some functionality.

7. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

1. Access: Request a copy of the personal data we hold about you;
2. Rectification: Request correction of inaccurate or incomplete data;
3. Erasure: Request deletion of your personal data and account;
4. Portability: Request export of your data in a structured, machine-readable format;
5. Objection: Object to certain processing of your data;
6. Withdrawal of Consent: Withdraw consent for data processing that relies on consent at any time.

To exercise any of these rights, contact us through the in-app Support form. We will respond to verified requests within the timeframes required by applicable law.

EU/EEA/UK Users: If you are a resident of the European Union, European Economic Area, or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) and UK data protection law. You may lodge a complaint with your local data protection authority if you believe we have not handled your data appropriately.

8. Children's Privacy

The Service is not directed to children under the age of thirteen (13). We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us through the in-app Support form, and we will promptly delete it. Users between 13 and 17 may use the Service only with verifiable parental or guardian consent, as described in our Terms of Service.

9. AI Processing and Your Data

When you upload card images or data for AI-assisted grading, valuation, or market analysis, that content is processed by our AI models and third-party AI providers to generate insights. Your uploaded images and data are transmitted securely and used solely to produce the requested analysis.

We may use your collection data in aggregate, anonymized, and de-identified form to improve the accuracy and performance of our AI models and platform analytics. You may opt out of this aggregated usage by contacting us through the in-app Support form. Your individual card data is never used to train external public AI models.

10. Payment Information

When you purchase a paid subscription, your payment is processed securely by Base44 Payments (powered by Wix), a PCI-DSS compliant platform. CardVault Collection Intelligence does not collect, store, or see your full credit card number, CVV, or other sensitive payment credentials. We only receive confirmation of the transaction status, subscription plan, and billing email from the payment processor.

11. eBay Integration Data

If you connect your eBay seller account, CardVault Collection Intelligence receives and stores an OAuth access token issued by eBay. This token is used solely to publish listings on your behalf. You may revoke this authorization at any time through your account settings or eBay's authorization management. CardVault Collection Intelligence does not store your eBay login credentials — only the OAuth token, which is encrypted and access-controlled.

12. Third-Party Services

The Service integrates with third-party platforms including eBay, payment processors, and AI model providers. These third parties have their own privacy policies governing how they handle your data. CardVault Collection Intelligence is not responsible for the privacy practices of these third-party services. We encourage you to review their privacy policies.

13. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States. By using the Service, you consent to such transfers. We take reasonable measures to ensure your data is protected in accordance with this Privacy Policy and applicable data protection laws, including standard contractual clauses where required.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will provide notice via email to the address associated with your account or via in-app notification. The updated policy will be identified by a revised "Last Updated" date at the top of this document. Your continued use of the Service following the effective date of changes constitutes your acceptance of the updated policy.

15. Contact Information

CardVault Collection Intelligence is operated by Michael Creapeau, Founder. If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us through the in-app Support form, accessible from the main navigation within your account. We will make reasonable efforts to respond to all inquiries in a timely manner.

Users located in the European Union or European Economic Area may use the same Support form to exercise their rights under the GDPR. Please include your full name, email address, and a clear description of your request. We may require verification of your identity before processing certain requests.