Privacy Policy

Introduction

Welcome to TCBinder ("we," "our," or "us"). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, disclose, and safeguard your information when you use our trading card collection management platform. Please read this policy carefully.

Information We Collect

We collect information that you provide directly to us and information automatically collected when you use our service:

How We Use Your Information

We use your information for the following purposes:

• Service Delivery: To provide, maintain, and improve our card collection management platform
• Account Management: To create and manage your account, authenticate your identity, and provide customer support
• Features: To enable features like public showcases, profit tracking, and badge systems
• Communications: To send you service-related emails, updates, and notifications (you can opt out of marketing emails)
• Analytics: To understand how users interact with our service and improve user experience
• Security: To detect, prevent, and address fraud, security issues, and technical problems
• Legal Compliance: To comply with legal obligations and enforce our terms of service

Data Storage and Security

We take data security seriously and implement industry-standard measures to protect your information:

• Encryption: All data is encrypted in transit using TLS/SSL and at rest using AES-256 encryption
• Infrastructure: We use Supabase (a secure, enterprise-grade database platform) to store your data
• Access Controls: Strict access controls and authentication mechanisms protect your account
• Regular Backups: Your data is regularly backed up to prevent loss
• Monitoring: We continuously monitor for security threats and vulnerabilities

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Data Sharing and Disclosure

We do not sell your personal data. We may share your information in the following limited circumstances:

• Service Providers: With trusted third-party service providers who help us operate the service, under confidentiality obligations and only with the data each one needs:
  • Supabase — database and authentication hosting; stores your account, profile, inventory, orders, and messages
  • Vercel — application hosting and delivery
  • Stripe — subscription billing and shipping-label payments; receives your name, email, and payment card details. We never see or store your full card number
  • PayPal — marketplace payments between buyers and sellers; receives transaction and identity information needed to process the payment
  • Apple — if you subscribe through the iOS app, your purchase is processed by Apple under their terms, and we receive only the subscription status
  • RevenueCat — manages iOS in-app subscriptions on our behalf; receives an app-generated user identifier and subscription status, never your payment details
  • Resend — sends our transactional emails (support replies, account emails); receives your email address and the message content
  • EasyPost — shipping rates, label purchase, and tracking; receives the buyer's and seller's shipping name, address, and phone number for that order
  • Google Firebase — push notifications; receives your device push token and the notification content
  • Card data providers — card identification and pricing services receive the card images and search terms you submit, but not your identity
• Public Information: Information you choose to make public on your showcase page (username, profile picture, collection, social links) is visible to anyone who visits your page
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In connection with a merger, acquisition, or sale of assets (you will be notified)
• Protection: To protect our rights, property, safety, or that of our users

Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to legal obligations)
• Portability: Request a copy of your data in a machine-readable format
• Objection: Object to processing of your data for certain purposes
• Restriction: Request restriction of processing in certain circumstances
• Withdraw Consent: Withdraw consent for data processing at any time

To exercise these rights, please contact us at privacy@tcbinder.com. We will respond within 30 days.

GDPR Rights (EU/UK Residents)

If you are located in the European Union or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to Access: You have the right to obtain confirmation of whether we process your personal data and to access that data
• Right to Rectification: You have the right to have inaccurate personal data corrected
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your personal data in certain circumstances
• Right to Restriction of Processing: You have the right to request that we restrict processing of your personal data in certain situations
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format
• Right to Object: You have the right to object to processing of your personal data for direct marketing or based on legitimate interests
• Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw that consent at any time
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority

To exercise any of these rights, please contact us at privacy@tcbinder.com. We will respond to your request within one month as required by GDPR.

CCPA/CPRA Rights (California Residents)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collecting, and the categories of third parties with whom we share personal information
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions
• Right to Correct: You have the right to request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: You have the right to opt out of the "sale" or "sharing" of your personal information. Note: We do not sell your personal information for monetary consideration
• Right to Limit Use of Sensitive Personal Information: You have the right to limit our use of sensitive personal information
• Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising your CCPA/CPRA rights

To exercise these rights, please contact us at privacy@tcbinder.com . We will verify your identity before processing your request and respond within 45 days as required by law.

You may also designate an authorized agent to make requests on your behalf. The authorized agent must provide proof of authorization.

Data Retention

We retain your personal data for as long as necessary to provide our services and fulfill the purposes outlined in this policy. When you delete your account, your profile, cards, and content are removed or anonymized within 90 days, except where we are required to retain data for legal, regulatory, or security purposes.

To prevent fraud and honor our obligations to other users you transacted with, we keep a limited internal record after account deletion: your account identifiers (username, email), and records of marketplace transactions (orders, offers, payments, and shipping details), which may include the other party's transaction information. This record is not publicly visible, is accessible only to authorized staff, and is retained for as long as needed for fraud prevention, dispute resolution, and compliance with financial record-keeping requirements.

Children's Privacy

Our service is not intended for children under 13 years of age. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately.

International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this privacy policy and applicable data protection laws.

Cookies and Tracking

We use cookies and similar tracking technologies to provide and improve our service. For detailed information about our use of cookies, please see our Cookie Policy.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the service after changes constitutes acceptance of the updated policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: