Privacy Policy

Cardmine is a trading-card marketplace and price-data platform. We provide card data, price history, marketplace listings, checkout, order management, seller tools, support and related services.

In this Privacy Policy, Cardmine, we, us or our refers to the operator of the Cardmine platform.

For most processing described in this policy, Cardmine acts as the data controller, meaning we decide why and how personal data is processed. In some limited situations, we may process personal data on behalf of another party, for example where a payment, shipping, hosting, analytics or communication provider processes data under its own or our instructions.

If you have questions about this Privacy Policy or your personal data, you can contact us through the contact page or support channels available on Cardmine.

We collect personal data in different ways depending on how you use Cardmine.

Payments may be processed by third-party payment providers such as Stripe. We do not store full card numbers or full payment credentials on Cardmine servers.

We may use cookies, local storage and similar technologies to support the service.

• Keep you logged in
• Remember settings
• Secure the service
• Measure site performance
• Understand how users use Cardmine
• Improve marketplace and search features
• Support help requests and service conversations
• Support analytics and, where applicable, marketing preferences

Where required, we ask for consent before using non-essential cookies.

We use personal data for the following purposes.

You can unsubscribe from marketing emails at any time.

Where GDPR or similar laws apply, we rely on the following legal bases.

We do not sell your personal data.

We may share personal data with the following categories of recipients.

Cardmine may use service providers located outside your country or outside the European Economic Area.

Where personal data is transferred internationally, we use appropriate safeguards where required, such as adequacy decisions, standard contractual clauses or other legally recognized transfer mechanisms.

We keep personal data only for as long as needed for the purposes described in this policy.

Retention periods may vary depending on the type of data.

• Account data is usually kept while your account is active.
• Order data may be kept for longer to support disputes, tax, accounting, fraud prevention and legal obligations.
• Seller verification and payout data may be kept as required by payment providers, tax law, anti-fraud rules and financial regulations.
• Support and dispute records may be kept to resolve cases, prevent abuse and defend legal claims.
• Technical logs are usually kept for shorter periods unless needed for security, fraud prevention or debugging.
• Marketing data is kept until you unsubscribe or withdraw consent, unless another legal basis applies.

When data is no longer needed, we delete it, anonymize it or securely archive it where legally required.

Depending on where you live, you may have rights over your personal data. Under GDPR, individuals have rights such as access, correction, deletion, restriction, objection, portability and the right to complain to a supervisory authority.

You may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your personal data
• Restrict certain processing
• Object to processing based on legitimate interests
• Withdraw consent where processing is based on consent
• Request data portability
• Object to direct marketing
• Lodge a complaint with a data protection authority

Some rights are not absolute. For example, we may need to keep certain order, payment, tax, fraud-prevention or legal records even after an account deletion request.

To exercise your rights, contact us through the available support or contact channels. We may need to verify your identity before responding.

You may request account deletion through Cardmine support or available account settings.

Deleting your account may remove or anonymize profile information, but we may retain certain data where necessary for:

• Completed or open orders
• Seller payouts
• Refunds and chargebacks
• Buyer Protection cases
• Fraud prevention
• Tax and accounting obligations
• Legal claims
• Safety and platform integrity

Some public or marketplace activity may remain visible in anonymized or limited form if needed to preserve order records, reviews, dispute history or marketplace integrity.

Cardmine may use essential cookies and similar technologies to operate the site, keep users logged in, remember settings and secure the marketplace.

We may also use analytics and similar tools to understand how users interact with Cardmine, respond to support questions and improve the service. We use Umami Cloud, loaded from cloud.umami.is, for privacy-focused aggregate analytics.

We also use Cloudflare Web Analytics to collect aggregate page performance measurements, including Core Web Vitals. Cloudflare Web Analytics does not use cookies or browser storage, does not record URL query strings and discards source IP addresses at Cloudflare's edge.

Cardmine does not send personal account identifiers, email addresses, order details, payment details, collection contents, card-list content, marketplace message content, free-text search queries or non-allowlisted custom event payloads to Umami. Event data sent to Umami is limited to short allowlisted enum-style properties, such as CTA identifiers, page areas and checkout flow labels.

Cardmine strips page titles, URL fragments and non-UTM query strings before analytics data is sent, and card, collection, user and admin routes are reported in a generalized form. UTM campaign parameters may be used for campaign attribution.

Where required by law, non-essential cookies or similar technologies are only used with your consent.

You can manage cookies through your browser settings and, where available, through Cardmine cookie preferences.

Blocking some cookies may affect site functionality.

If you subscribe to updates, newsletters or marketing emails, we may use your email address to send Cardmine news, product updates, marketplace updates, promotions or feature announcements.

You can unsubscribe at any time using the unsubscribe link in the email or by changing your communication preferences where available.

We may still send service-related messages, such as order updates, account security notices, payment notifications or policy changes.

We use technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration or disclosure.

• Encryption in transit
• Access controls
• Authentication protections
• Logging and monitoring
• Secure hosting providers
• Payment-provider tokenization
• Restricted access to sensitive data
• Fraud and abuse detection

No online service can guarantee perfect security. You are responsible for keeping your login details safe and for contacting us if you suspect unauthorized access to your account.

Cardmine is not intended for children under 13.

Users under 18 may only use Cardmine with permission from a parent or legal guardian. We do not knowingly collect personal data from children where parental consent is required. If we learn that we have collected such data without appropriate consent, we will take steps to delete it or obtain proper authorization.

Cardmine may provide messaging or communication tools between buyers and sellers.

We may access, store and review marketplace communications where necessary to:

• Provide order support
• Resolve disputes
• Prevent fraud or abuse
• Enforce our Terms of Service
• Detect off-platform payment requests
• Investigate counterfeit, illegal or unsafe activity
• Comply with legal obligations

Users should not share unnecessary sensitive personal data through marketplace messages.

If Cardmine allows reviews, ratings, seller profiles, public listings or public comments, information you submit may be visible to other users or visitors.

Public or semi-public content may include:

• Username
• Seller profile
• Listing photos and descriptions
• Reviews or ratings
• Marketplace activity shown in a limited or aggregated form

Do not include sensitive personal data in public content.

To protect Cardmine and its users, we may process data for fraud prevention, risk scoring, abuse detection and marketplace safety.

This may include reviewing:

• Account activity
• Login and device signals
• Payment and payout signals
• Listing patterns
• Order history
• Chargeback behavior
• Message content related to orders
• Reports from users
• External fraud, sanctions or compliance signals where permitted

We may restrict accounts, hold payouts, cancel orders, request verification or remove listings where we detect significant risk.

Cardmine may use automated tools, manual review or a combination of both to detect fraud, spam, counterfeit risk, prohibited content, suspicious payments, listing abuse and policy violations.

Automated signals may influence whether a listing is reviewed, an order is flagged, a payout is delayed or an account is restricted. Where required by law, users may request human review or challenge certain decisions through support.

Cardmine may link to third-party websites, payment providers, shipping providers, social media pages, card-data sources or other external services.

This Privacy Policy does not apply to third-party websites or services that we do not control. Their own privacy policies apply.

We may update this Privacy Policy from time to time to reflect changes in Cardmine, legal requirements, marketplace features, payment providers, analytics tools or data practices.

The Last updated date shows when the latest version was published.

For material changes, we will take reasonable steps to notify users, such as by posting a notice on Cardmine, sending an email or showing an in-account notification.

If you have questions about this Privacy Policy, your personal data or your privacy rights, contact Cardmine through the contact page or support channels available on the platform.

When contacting us about privacy rights, please include enough information for us to identify your account and understand your request.