Privacy Policy

1. Information We Collect

Account information. When you sign up, we collect your name, email address, and password (stored in hashed form, never in plain text).

Payment information. Subscription payments are processed by Stripe. CardBasis does not collect or store your full card number — Stripe handles that directly. We retain limited billing metadata (such as subscription status and transaction history) needed to manage your account.

Business data you provide. Inventory records, sales records, pricing, and other business information you enter or import into CardBasis, including data imported from third-party sources like CollX if you choose to connect them.

Usage data. Information about how you use the Service — pages visited, features used, log data, device and browser type, and IP address — collected automatically to help us operate and improve the Service.

Cookies. We use cookies and similar technologies for authentication (keeping you logged in) and basic analytics. Our early-access page also embeds a YouTube video, which involves its own data collection — see "YouTube Embed on Our Early-Access Page" below.

Pricing/valuation data lookups. To show market pricing information for cards within the Service, we send card-identifying details (such as name, set, and condition) to SportsCardsPro/PriceCharting. We do not send your personal account or payment information to this provider.

2. How We Use Information

We use the information we collect to:

• Provide, maintain, and improve the Service;
• Process subscription payments and manage billing;
• Communicate with you about your account, including service updates, billing notices, and support requests;
• Send product or marketing updates, which you can opt out of at any time;
• Monitor for security issues, fraud, and abuse of the Service;
• Comply with legal obligations.

We do not sell your personal information or Your Data to third parties.

3. How We Share Information

We share information only as follows:

• Service providers who help us operate the Service, including Stripe (payment processing), Supabase (database and authentication), Vercel (hosting), SportsCardsPro/PriceCharting (card pricing and valuation data), and our email delivery provider. These providers can only use your information to perform services for us.
• Third-party integrations you connect, such as CollX, if you choose to import data from them — subject to that provider's own privacy terms.
• YouTube, in the limited way described below, only on our early-access page.
• Legal requirements, if required to comply with a subpoena, court order, or similar legal process, or to protect the rights, property, or safety of CardBasis, our users, or others.
• Business transfers, if CardBasis is involved in a merger, acquisition, or sale of assets, in which case information may be transferred as part of that transaction.

4. YouTube Embed on Our Early-Access Page

Our early-access page includes an embedded YouTube video. When that page loads, YouTube (operated by Google) may set cookies and collect data such as your IP address and device information, even if you don't press play, in order to serve and measure the video. This collection is governed by Google's own privacy policy, not by CardBasis.

5. Data Retention

We retain your account information and business data for as long as your account is active. If you cancel your subscription, we retain your data for 90 days in case you reactivate, after which it may be deleted. You can request earlier deletion by contacting support@getcardbasis.com.

6. Data Security

We use industry-standard measures — including encryption in transit, hashed passwords, and access controls — to protect your information. No system is completely secure, and we cannot guarantee absolute security of your data.

7. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, export, or delete your personal information. You can:

• Access and update most account information directly within the Service;
• Export your business data from within the Service;
• Request deletion of your account and associated data by emailing support@getcardbasis.com;
• Opt out of marketing emails using the unsubscribe link in any marketing email (transactional emails, like billing receipts, will still be sent).

If you are a California resident, you have the right to know what personal information we collect, to request its deletion, and to opt out of the sale or sharing of personal information — we do not sell or share your personal information with third parties for their own marketing purposes. You can exercise these rights using the contact information above.

8. Children's Privacy

The Service is not directed at anyone under 18, and we do not knowingly collect personal information from children. If we learn we have collected information from someone under 18, we will delete it.

9. International Users

CardBasis is operated from the United States, and data is stored and processed in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service before the changes take effect.

11. Contact Us

Questions about this Privacy Policy or requests regarding your data can be sent to support@getcardbasis.com.