Privacy Policy

Last updated: 07/08/2026

To be completed before final publication. The Data Controller is a private individual (freelance professional, not a company) and is not yet identified with full legal details (full name, address, VAT number), because the business has not yet been formally registered. This page will be updated with that information as soon as it is available — it contains no invented data in the meantime.

Data Controller

[Full name] — [address] — VAT number [to be added] (freelance professional, not a company). Reachable through the "Need help" form available in your account menu (profile icon), the only support channel active today.

What data we collect

Account data: email address and password (managed by Supabase Auth, never stored in plain text).
Photos of the cards you upload (front/back) and, if you save them, the analysis result (identification, estimated grade, notes) in your History.
Profile photo, if you choose to upload one.
Payment data: handled entirely by Stripe — we never see or store your card number. We only keep the outcome of the purchase (credits added, amount, date) for accounting purposes.
Messages you send us through the in-app support/bug report forms.
Minimal technical data automatically collected by the infrastructure (IP address, server logs) by the hosting providers listed below.

Why we collect it

To provide you with the requested service: recognising the cards you upload, estimating a grade, managing your account, credit balance and purchases, and responding to your support requests. The legal basis is performance of the contract with you (GDPR art. 6.1.b); for technical logs, legitimate interest in the security of the service.

Who processes data on our behalf

We do not sell or share your data for advertising purposes. We rely on these providers, each acting as a data processor within the limits of the service they provide:

Anthropic (United States) — receives the photos of the cards you upload to identify them and estimate their grade via the Claude model. Cross-border transfer based on the European Commission's standard contractual clauses.
Stripe — processes payments for credit purchases. Your payment card details never pass through our servers.
Supabase (database, authentication and photo storage infrastructure) — servers in the European Union (Ireland), no transfer outside the EU.
Vercel (United States) — hosts the site and delivers it; logs minimal technical data (IP, requests) for operation and security.
CardTrader — receives only the card's name/set to retrieve its indicative market price, no personal data.

How long we keep the data

Your account data and the scans saved in your History remain for as long as your account is active. If you request account deletion, we delete the associated data within a reasonable time, except for what we are required to retain for tax obligations (e.g. invoice data).

Your rights

You can ask us at any time to access your data, correct it, delete it, restrict its use, or receive a portable copy, by writing to us through the "Need help" form in your account. Note: today account deletion is handled manually by us on your request, it is not yet a self-service button in the app. You can also file a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, garanteprivacy.it).

Minors

The service is not intended for minors under 14, the minimum age to independently give consent to personal data processing in Italy.

Changes to this Privacy Policy

We reserve the right to update this privacy policy. Any changes will be published on this page with the updated date indicated at the top. We recommend that you periodically check this page to stay informed about any changes.

Cookies

The site uses necessary technical cookies for the operation of the service. No profiling or advertising cookies are used. For more information about cookies, please see our Cookie Policy.