Effective from:
Cardy is a collector platform for searching, tracking, buying, selling and trading trading card game (TCG) cards. This policy explains what personal data we process, why, how long we keep it, and what rights you can exercise. It applies to every user, whether you buy or sell.
The data controller is [RAGIONE SOCIALE], VAT number [PARTITA IVA], registered at [INDIRIZZO SEDE LEGALE]. For anything concerning your personal data, including exercising the rights described below, write to [EMAIL PRIVACY].
Account data: email, display name, username, optional bio and profile image, country. Collection data: the cards you add, with the quantity, condition and language you declare. Buying and selling data: listings, offers, orders, amounts, messages exchanged with the other party, reviews. Shipping data: the name, address, city, postal code and country you provide to receive purchases or to trade. Seller tax data: name, address, date of birth, tax identification number and VAT number where applicable, collected when the law requires us to report them (see the dedicated section). Technical data: IP address and the logs needed to run and secure the service. We do not process special categories of data, and we carry out no profiling or automated decision-making.
The scanning feature (/scan) uses your device's camera only while the scanning page is open, and only after you grant permission in your browser. When you press the shutter, the photo you just took is sent to our servers to identify the card. It is processed in memory only: it is never written to disk or to storage, never added to your account or any other record, never used to train any model, and is discarded as soon as the response is sent. Only the resulting catalogue match is kept. No other photo or camera data is transmitted, and the camera is not read except while you are on the scanning page. You can revoke camera permission at any time in your browser settings.
We never see or store your card details or your bank account number. Payments and seller payouts are handled entirely by Stripe, which acts as an independent controller for those operations under its own privacy policy. Only technical transaction identifiers and amounts pass through our database.
We process your data to: (a) provide the service (managing your account, collection, listings, orders and trades) on the basis of performing our contract with you (art. 6(1)(b) GDPR); (b) process payments and payouts, on the same contractual basis; (c) send the price alerts and notifications you configure, on the same contractual basis; (d) meet the tax, accounting and reporting obligations imposed on us, on the basis of legal obligation (art. 6(1)(c) GDPR); (e) prevent fraud and abuse, keep the platform secure, and establish or defend legal claims, on the basis of our legitimate interests (art. 6(1)(f) GDPR). If we ever introduce marketing messages or analytics, we will do so only with your prior consent, which you can withdraw at any time.
Some data is visible to other users, and it is worth knowing which. Your username, profile image and the reviews you receive are public. Your collection is visible to others only if you choose to make it public in your settings. When a purchase completes, your name and shipping address are disclosed to the seller, who needs them to send you the card. In card-for-card trades, each side's address is disclosed to the other at the point they mark their parcel as shipped. These disclosures are necessary to perform the contract between you and the other user, and whoever receives your address may use it only to ship your parcel.
We rely on providers that process data on our behalf as processors, bound by data processing agreements: Neon for the database and authentication, Cloudflare R2 for image storage, Vercel for application hosting, and Stripe for payments and payouts. Some of these providers are based in the United States; those transfers rely on the safeguards required by Chapter V of the GDPR, namely an adequacy decision or standard contractual clauses approved by the European Commission. We do not sell your personal data and we do not share it with third parties for their marketing.
European rules for digital platforms (Directive (EU) 2021/514, implemented in Italy by Legislative Decree 32/2023) require us to collect sellers' identification and tax details and report them annually to the Italian Revenue Agency. The obligation covers sellers who, in a calendar year, complete more than 30 sales or receive more than EUR 2,000 in total. We will send you a copy of the information about you that we report. This processing rests on a legal obligation: you cannot object to it, and if you do not provide the required details we must suspend your payouts after two reminders.
We keep account data for as long as your account exists. If you delete your account, identifying data is erased or anonymised without undue delay. Some data outlives deletion because the law requires it or because it is needed to protect rights: order and transaction records are kept for ten years for accounting and tax purposes; seller tax data subject to DAC7 reporting is kept for ten years; reviews and order history remain visible to the other party in anonymised form, because they are also data concerning that person. Technical logs are kept for a limited period, no longer than twelve months.
You can delete your account from your profile settings. Deletion is not possible while you still have open obligations towards other users (paid orders that have not completed, trades in progress, or payouts you have not yet received), because in those cases someone is waiting for a card or a refund. We will tell you exactly what is blocking deletion so you can settle it and proceed.
At any time you may request access to your data (art. 15), rectification of anything inaccurate (art. 16), erasure (art. 17), restriction of processing (art. 18), and portability in a machine-readable format (art. 20). You may also object to processing based on our legitimate interests (art. 21). For access and portability you do not even need to contact us: your profile settings let you download a file containing all your data. For anything else, write to [EMAIL PRIVACY] and we will respond within one month. Some rights are limited where we must keep data to satisfy a legal obligation, as with tax and accounting records.
If you believe our processing breaches data protection law, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority in the EU country where you live. You may also bring the matter before the courts.
Cardy uses only the technical cookies needed to keep you signed in and to keep the service secure. We use no profiling cookies, no analytics, and no advertising pixels, which is why you see no consent banner. If we ever introduce such tools, we will ask for your consent first and update this policy.
If we change this policy, we will update the effective date shown at the top of the page. Where changes are substantial, we will tell you in the app or by email before they take effect.
For questions about this policy or to exercise your rights, write to [EMAIL PRIVACY]. For general help with the service, write to support@cardy.trade instead.