CardIntel Privacy Policy
Effective date: [DATE]
Draft — needs review by a California attorney before publishing.
<!-- Sources checked 2026-10-12 for the required headings in this policy: CCPA / CPRA (California Consumer Privacy Act, as amended by the California Privacy Rights Act) - Cal. Civ. Code § 1798.100 et seq., esp. § 1798.100 (notice at collection), § 1798.105 (delete), § 1798.106 (correct), § 1798.110 (know), § 1798.115 (sold/shared), § 1798.120 (opt out of sale/sharing), § 1798.121 (limit sensitive PI), § 1798.125 (no discrimination), § 1798.130(a)(5) (privacy-policy contents, update every 12 months), § 1798.135 (opt-out links): https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5 - CCPA regulations, Cal. Code Regs. tit. 11, § 7011 (privacy policy contents) and § 7012 (notice at collection: categories, purposes, sold/shared, retention period per category): https://cppa.ca.gov/regulations/ (California Privacy Protection Agency; updated regulations effective 2026-01-01 covering risk assessments, cybersecurity audits and automated decision-making technology) - Attorney General CCPA overview: https://oag.ca.gov/privacy/ccpa CalOPPA (California Online Privacy Protection Act) - Cal. Bus. & Prof. Code §§ 22575-22579, esp. § 22575(b)(1)-(7): categories of PII collected, third parties shared with, how users review/change their info, how changes to the policy are announced, effective date, how the site responds to "Do Not Track" signals, whether third parties collect PII across sites: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22575 - Attorney General guidance "Making Your Privacy Practices Public" (2014): https://oag.ca.gov/sites/all/files/agweb/pdfs/cybersecurity/making_your_privacy_practices_public.pdf Note for the attorney: as a small sole proprietorship, CardIntel most likely falls BELOW the CCPA's applicability thresholds (annual revenue above the inflation-adjusted figure, 100,000+ consumers/households, or 50%+ of revenue from selling/sharing PI), so the CCPA sections below are offered voluntarily. CalOPPA applies to any commercial site that collects PII from California residents regardless of size. Confirm both. Placeholders: [BUSINESS LEGAL NAME], [MAILING ADDRESS], [SUPPORT EMAIL], [DOMAIN], [DATE], [ANALYTICS TOOL], [RETENTION PERIOD]. See DECISIONS.md. -->This policy explains what [BUSINESS LEGAL NAME] ("CardIntel", "we", "us"), a small business in Santa Barbara, California, collects when you use the CardIntel web app at [DOMAIN] (currently cardintell.vercel.app) and its AI assistant "Ace", why we collect it, who sees it, and what you can do about it.
The short version: we collect what you type in to run the app for you. We do not sell your data, rent it, or show ads. Your data is processed by a few service providers we need to run the app (hosting, database, AI). You can delete your account yourself at any time.
1. Who we are
[BUSINESS LEGAL NAME] [MAILING ADDRESS], Santa Barbara, California, USA Privacy requests: [SUPPORT EMAIL]
2. What we collect (notice at collection)
2.1 Information you give us
| Category | Examples | Why we collect it |
|---|---|---|
| Account identifiers | Email address, password (stored hashed by our auth provider), Google account ID if you sign in with Google | To create and secure your account |
| Profile | Display name, profile photo, optional social profile link, accent colour preference | To personalise your account |
| Inventory and business records | Card descriptions, photos of cards and slabs, purchase prices and dates, sale prices, fees, expenses, shipping addresses | To run the inventory, sales and bookkeeping features |
| Contacts you add | Names and contact details of buyers, sellers and consignors you deal with | To let you track who you bought from and sold to |
| Questions to Ace | The text you type to the AI assistant | To generate an answer |
| Support messages | Emails you send us | To help you |
2.2 Information the app creates
| Category | Examples | Why |
|---|---|---|
| Calculated figures | Profit, margin, totals, reports built from your own numbers | Core function of the app |
| Comps | Sold prices for similar cards gathered from public sold listings (for example Fanatics Collect public sales history). These are about cards, not about you | To show you market reference points |
| AI photo extraction output | Card details read from a slab photo | To save you typing |
2.3 Information collected automatically
| Category | Examples | Why |
|---|---|---|
| Technical and usage data | IP address, browser type, device type, pages visited, timestamps, error logs | To keep the app running, secure it and fix bugs |
| Cookies and similar | A session cookie so you stay signed in; a local-storage setting for your preferences | To keep you logged in and remember settings |
| Analytics | [ANALYTICS TOOL — e.g. Vercel Web Analytics, which is cookie-less and aggregated, or "none"] | To see which features are used |
2.4 Sensitive personal information
We do not ask for government IDs, financial account numbers, precise location, health data or similar sensitive categories. Your login credentials are the only "sensitive" category under California law, and we use them only to log you in.
2.5 Sold or shared?
We do not sell your personal information and we do not share it for cross-context behavioural advertising. We have not done so in the past 12 months.
2.6 How long we keep it
See Section 7.
3. How we use your information
- To run the app: store your records, do the maths, show comps, answer Ace questions.
- To secure the app: detect abuse, prevent fraud, keep logs.
- To support you: reply to your emails.
- To improve the app: look at aggregated usage, fix bugs.
- To tell you important things: security notices, changes to these terms, and (if you opt in) product news.
- To comply with the law.
We do not use your data to train AI models, and we do not allow our AI provider to do so.
4. Who sees your information
We do not sell or rent personal information. We share it only with:
| Who | What they get | Why |
|---|---|---|
| Vercel (hosting, USA) | Everything that passes through the app, plus technical logs | Hosts the app |
| Supabase (database and login, Postgres in a US region) | All your account and business records, photos, and login credentials | Stores your data and handles sign-in |
| Google (if you sign in with Google) | Your Google login | Sign-in only. Google's own privacy policy covers what Google does |
| Anthropic (Claude API, USA) | Your Ace question plus the relevant rows of your data; slab photos you submit for AI extraction | Generates AI answers and reads slab photos. Processed under Anthropic's commercial terms, which do not permit training on customer data |
| [ANALYTICS TOOL] | Aggregated page and feature usage | Usage analytics |
| Email provider (if we send email) | Your email address and the message | Account and support email |
| Legal and safety | What the law requires | To respond to lawful requests, protect our rights, or prevent harm |
| A buyer of the business | Your account data | If CardIntel is sold or merged, your data goes with it under this policy |
These providers are "service providers" under California law: they may only use your data to provide their service to us.
5. Your choices and rights
5.1 Everyone
- See and change your data from inside the app at any time.
- Export: email [SUPPORT EMAIL] and we will send you a copy of your records.
- Delete your account from inside the app. This removes your profile, cards, sales, contacts, expenses and photos from the live database. Backups may persist up to 30 days.
- Marketing email: we only send product news if you opt in, and every such email has an unsubscribe link.
5.2 California residents (CCPA/CPRA)
If you live in California you have the right to:
- Know what personal information we collect, use, disclose and (if ever) sell or share, and to get a copy.
- Delete your personal information, with some legal exceptions.
- Correct inaccurate personal information.
- Opt out of sale or sharing — we do not sell or share, so there is nothing to opt out of.
- Limit use of sensitive personal information — we only use it to log you in, so this right does not apply.
- Not be discriminated against for using these rights.
To exercise these rights, email [SUPPORT EMAIL] with the subject "Privacy request", or use the delete button in the app. We will confirm within 10 business days and respond within 45 days (we may extend by another 45 with notice). We verify requests by matching your logged-in account or by emailing the address on file. You may use an authorised agent; we will ask for proof that you authorised them.
We treat the full list of categories in Section 2 as our CCPA disclosure of categories collected, sources (you, your device, our service providers, public sold listings) and purposes.
5.3 "Do Not Track" (CalOPPA)
We do not track you across other websites over time, and we do not let third parties do so through our app. Because of that, we do not respond to browser "Do Not Track" signals; there is nothing to turn off. If we ever add a tool that could track across sites, we will update this section first.
5.4 Global Privacy Control
Because we do not sell or share personal information, Global Privacy Control signals do not change anything about how we handle your data.
5.5 Other states
If your state gives you similar rights (for example to access, correct, delete or export), email [SUPPORT EMAIL] and we will honour them.
6. The AI assistant and AI photo extraction
- Ace: your question plus the relevant rows of your own data are sent to Anthropic's Claude API, which returns an answer. We keep the conversation in your account so you can see it again.
- Photo extraction: the slab photo is sent to the same API, which returns the card details it reads.
- Anthropic processes this data as our service provider under its commercial terms and does not use it to train models. We do not use it to train models either.
- AI output can be wrong. Check it.
- Do not type other people's sensitive information into Ace.
7. How long we keep your information
| Data | Kept until |
|---|---|
| Account and business records, photos, contacts | You delete them or delete your account; then up to 30 days in backups |
| Ace conversation history | [RETENTION PERIOD — recommend: same as account, or 12 months, whichever is shorter] |
| Technical logs | [RETENTION PERIOD — recommend 90 days] |
| Support emails | [RETENTION PERIOD — recommend 2 years] |
| Billing records (future) | 7 years, for tax law |
If you stop using the app for a long time we may email you before deleting an inactive account.
8. Security
Your data is stored in Supabase (Postgres, US region) with encryption in transit and at rest, row-level access rules so each user only sees their own records, and passwords hashed by the auth provider. No system is perfectly secure, so keep your password private and use a unique one. If we learn of a breach affecting your personal information, we will notify you as California law requires.
9. Children
The app is for adults 18 and over. We do not knowingly collect information from anyone under 18. If you think a minor has an account, email [SUPPORT EMAIL] and we will delete it.
10. Where your data lives
Our servers and providers are in the United States. If you use the app from outside the US, your data is transferred to and processed in the US.
11. Links to other sites
Comps link to third-party marketplaces. Their privacy policies, not ours, apply there.
12. Changes to this policy
We will post any changes at [DOMAIN]/privacy with a new effective date, and for material changes we will email you or show a notice in the app at least 14 days before they take effect. We review this policy at least once every 12 months.
13. Contact us
[BUSINESS LEGAL NAME] [MAILING ADDRESS] Santa Barbara, California, USA [SUPPORT EMAIL]