Privacy policy

CardLedger is run by Joshua Berry, a sole trader trading as CardLedger ("we"). This page explains what personal information CardLedger collects, why, who we share it with, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018). For any privacy question or request, email privacy@cardledger.uk.

If you're a vendor

When you have a CardLedger account we hold:

• your name and email address, and your password (stored only in scrambled, hashed form by our login provider);
• your shop details: shop name, bio, location, the shows you attend and table numbers;
• your stock, prices, costs and sales records, and the holds buyers send you;
• if you subscribe, billing details handled by Stripe (we never see your full card number).

We use this to run your account and shop (the contract between us), to keep CardLedger secure, and to send you sign-in codes and account emails. Your costs and profit figures are private to you; buyers only see your shop details, listed stock and prices.

If you're a buyer

You don't need an account to browse a vendor's binder. If you send a hold request, we collect the name you give, any phone number or social handle you choose to add, your note, and the cards you asked for. We share these with that vendor only, so they can find you at their table and sell you the cards. This is based on our and the vendor's legitimate interest in handling your request. Hold details stay in the vendor's records of their sales; ask us if you'd like yours removed. If you're under 13, please ask a parent or guardian before sending a hold.

Cookies and similar technology

We only use cookies that CardLedger needs to work. We don't use advertising or tracking cookies.

• sign-in cookies that keep vendors logged in;
• a short-lived cookie that remembers which email address is being confirmed during sign-up;
• a random device ID on buyers' phones, used only to stop one person tying up a vendor's stock with too many holds;
• your list of cards and recent holds, saved in your browser (local storage) on your own device.

We measure page visits with Vercel Web Analytics, which doesn't use cookies and reports only aggregated figures. We remove password-reset links and hold codes from page addresses before they're counted.

Who we share information with

We use these service providers to run CardLedger. They process information on our behalf, under contract:

• Neon: our database and login service, hosted in London;
• Vercel: website hosting (London region) and visit analytics;
• Resend: delivery of sign-in and account emails;
• Stripe: vendor subscription payments.

Some of these providers may process information outside the UK. Where they do, they use legal safeguards approved under UK law, such as the UK International Data Transfer Addendum. We don't sell personal information, and we never send personal information to eBay or other price-data sources. Card details come from TCGdex and contain no personal information.

How long we keep it

We keep vendor account information while the account is open, and delete it within 90 days of the account closing, except where we have to keep billing records for longer by law. Buyer hold details are kept with the vendor's sales records for as long as the vendor's account exists, unless you ask us to remove them.

Your rights

You can ask us for a copy of your personal information, ask us to correct or delete it, object to how we use it, or ask us to restrict its use. Email privacy@cardledger.uk and we'll reply within one month. If you're unhappy with how we handle your information, you can complain to the Information Commissioner's Office (ico.org.uk).

Changes

If we make significant changes to this policy, we'll update the date above and tell vendors by email.