Privacy policy

CardEntry runs at netcup. The hosting provider is netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. When the website is accessed, server logs may in particular process the IP address, the time and target of the request, the volume of data transferred, browser and device details, and technical error and security information.

This processing serves the secure, stable and efficient provision of the service. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. Log data is only stored for as long as it is needed for operation, error analysis and security. Further information can be found in netcup’s privacy policy.

We use Clerk for registration, sign-in and session management. This may process in particular your email address, name or profile details, user and session identifiers, IP address, and browser and device information. This processing is necessary to maintain the user account and provide the protected area. The legal basis is Art. 6(1)(b) GDPR; security measures are additionally based on Art. 6(1)(f) GDPR.

The service provider is Clerk, Inc. Data may be processed in the USA. Clerk cites in particular the EU-US Data Privacy Framework and standard contractual clauses as its transfer mechanisms. Further information: Clerk’s privacy policy and Clerk’s data processing agreement.

Alternatively you can sign in with an existing Google or Discord account. If you choose this route you are redirected to the respective provider. That provider learns that you are signing in to CardEntry and, once you confirm, passes us your email address and, where applicable, your name and profile picture. The providers are Google Ireland Limited and Discord Netherlands BV; processing in the United States by Google LLC or Discord, Inc. respectively is possible. For the processing inside your account with them, the respective provider is independently responsible. The legal basis is Art. 6(1)(b) GDPR. If you would rather not use this, you can register with an email address and password instead.

When you upload card images, the image data is transmitted to the Google Gemini API in order to recognise the card name, set, card number, language and further card data. The provider is Google Ireland Limited; affiliated Google companies may technically be involved. The legal basis is Art. 6(1)(b) GDPR, because the processing is necessary to carry out the recognition you requested.

The card data and suggestions derived from the image are assigned to the scan session and stored. The image file itself is also retained for a limited time; where it is kept, for how long and what happens when a session is deleted is set out in section 5. Please upload card images only, no images containing people, addresses or other confidential information.

Information on processing and on possible international data transfers can be found in the Gemini API terms and data processing conditions.

In the course of use we store in particular the identifier and name of a scan session, recognised or selected cards, set, card number, language, quantity, condition, timestamps and credit consumption. Export profiles you create yourself, name, CSV format, fallback condition, language and filename prefix, are also stored with the user account, so they are available on every device you sign in with. This data is needed so that you can check, edit and export results. The legal basis is Art. 6(1)(b) GDPR.

Scan sessions remain available until you remove them using the delete function. After that they are no longer accessible in the user account. Archiving merely hides a session and does not remove it. You can request final deletion of the associated data or of the account at any time by email. Account data is generally stored for the duration of the user account. Legally required records may be stored for longer under existing retention obligations.

We additionally store the card images you upload. They are needed so that a result stays verifiable later and so that a reported misrecognition can be traced and corrected, including when you interrupt a session and continue days later. The legal basis is Art. 6(1)(b) GDPR, and additionally Art. 6(1)(f) GDPR for error analysis.

The image files are not kept in the CardEntry database but in non-public storage at Cloudflare R2. That storage is set to the EU jurisdiction; according to the provider, the images are therefore held in data centres inside the European Union. They can only be retrieved through short-lived signed addresses. Every card image is deleted automatically no later than 30 days after upload. If you delete the associated scan session earlier, that session’s images are deleted along with it immediately. We do not use the images to improve card recognition.

Clerk uses technically necessary cookies or comparable storage techniques for sign-in. CardEntry also stores local settings in the browser, such as the check status within a scan session, the selected interface language and the state of the side navigation. Your own export profiles are kept with the user account (section 5); only while no account is reachable are they stored locally in the browser instead, and taken over to the account the next time you sign in. Your choice in the privacy settings is also stored locally so that it can be honoured on later visits. This information serves the function and usability of the application. Advertising-related storage techniques are used only with your explicit consent; see section 7 for details.

If you visit CardEntry through an affiliate link and expressly consent to attribution, we store the referral code, a random visitor identifier and the time of the visit in the browser for up to 30 days. This lets us attribute a later registration, and any purchases arising from it, to the referring partner. Without your consent this attribution does not take place. Consent is voluntary and can be withdrawn by clearing your browser data. The legal basis is Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021.

If a user account is enabled as an affiliate partner, we additionally process the associated referral code, name, email address, postal address, country and a voluntarily provided tax or VAT number. We also store referred registrations and purchases, the agreed commission rate, payout amounts and monthly affiliate statements. This data is necessary for performing the partner relationship, for payouts and for legally required documentation. The legal bases are Art. 6(1)(b) and (c) GDPR. Accounting records are stored under statutory retention obligations.

You can clear browser data in your browser settings. Blocking technically necessary storage may impair sign-in and functionality.

If you explicitly consent to ad measurement, we embed the Meta Pixel. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We use the pixel to measure whether our ads on Facebook and Instagram actually lead to visits and registrations. Without your consent the pixel is not loaded and no script is requested from Meta.

Two events are transmitted: opening a page ("PageView") and successfully completing a registration ("CompleteRegistration"). This may involve your IP address, browser and device information, the address you opened and an identifier set by Meta. Meta’s automatic collection of buttons and form fields is disabled. Card images, recognised card names, file names, your name and your email address are not transmitted to Meta.

Meta also processes this data in the United States. According to the provider, the transfer is based on the EU-US Data Privacy Framework and on EU standard contractual clauses. In our assessment there remains a residual risk that US authorities may access this data and that no legal remedies comparable to the GDPR are available against this. For the processing carried out through the pixel, we and Meta are joint controllers within the meaning of Art. 26 GDPR. The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021. You can withdraw your consent at any time with effect for the future via "Privacy settings". Further information can be found in Meta’s privacy policy and in the controller addendum.

If you contact us by email, we process your contact details and the content of your message in order to handle your request. Depending on the request, the legal basis is Art. 6(1)(b) or (f) GDPR. The data is deleted once the matter is concluded and no legal obligations require further storage.

For messages sent through the feedback and bug form we additionally store the user identifier, the type and content of the report, the page it was sent from, processing status, internal notes and timestamps. We use this data solely for error analysis and the further development of CardEntry. Depending on the content, the legal basis is Art. 6(1)(b) or (f) GDPR.

If you agree in the dashboard or in the settings, we send you three short email tips at most: a tip for getting started if no card has been captured after a few days, a question after your first export and a note when your balance runs low. For this we process your email address, the interface language at the time of consent, the time of consent and the account details that trigger a tip: sign-up date, credit balance, and whether and when you scanned or exported. We store which tips have already been sent on your account so that none arrives twice.

The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with § 174 TKG 2021. Consent is voluntary and not required to use CardEntry. You can withdraw it at any time with effect for the future, via the unsubscribe link in every email or in the settings under "Email tips".

We use Resend to send these emails. The provider is Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend receives your email address and the content of the respective message and processes this data in the United States. According to the provider, the transfer is based on the EU-US Data Privacy Framework and EU standard contractual clauses. More information is available in the Resend privacy policy and the Resend data processing addendum.

If you connect your eBay seller account under Marketplaces, you sign in directly at eBay and allow CardEntry access there; we never receive your eBay password. eBay then sends us access keys (tokens), your eBay user ID and your eBay user name. We store the access keys encrypted. We use them to retrieve your business policies for shipping, returns and payment and your item locations from eBay. If you list cards on eBay through CardEntry, we send the details of those cards to eBay for this purpose, such as name, set, condition, language, price, quantity and image.

The legal basis is Art. 6(1)(b) GDPR, as the connection is established at your request to perform the user agreement. The connection is voluntary. You can remove it at any time under Marketplaces; we then delete the access keys and your eBay ID immediately. You additionally revoke the permission itself in your eBay account. If you delete your eBay account, eBay notifies us and we delete the connection automatically.

eBay itself is responsible for the processing in your eBay account, for users in the EU eBay GmbH, Kleinmachnow, Germany. The eBay privacy notice applies.

Only service providers necessary for operation and provision receive data: netcup for hosting, Clerk for authentication, Google for card image recognition and Cloudflare, Inc. for the time-limited storage of card images as described in section 5. Resend only receives your email address if you have agreed to email tips, as described in section 9; that processing takes place in the United States. If you sign in with an existing account, the chosen provider, Google or Discord, additionally learns about that sign-in, as described in section 3. Meta only receives the event data described in section 7 if you have consented to ad measurement; that processing also takes place in the United States. eBay only receives the data described in section 10 if you have connected your eBay account. If you connect CardEntry as a connector to an AI assistant, such as Claude by Anthropic or ChatGPT by OpenAI, the assistant receives, at your request, the data from your account that it retrieves: your sessions, the recognised cards with name, set, number, rarity, condition, language and quantity, the export file with the details it contains, and your credit balance. The legal basis is Art. 6(1)(b) GDPR, as the transfer takes place at your request to perform the contract of use. The provider of the assistant is responsible for the processing on its side, which may take place in the United States. You can disconnect in the settings of the assistant. Where data is processed outside the European Economic Area, the providers state that they base the transfer on an adequacy decision, the EU-US Data Privacy Framework or EU standard contractual clauses.

Personal data is stored only for as long as is necessary for the respective purpose. After that we delete or anonymise it, unless statutory retention periods, the assertion or defence of legal claims, or security reasons stand in the way. The specific duration depends on the type of data and the context of use.

Under the GDPR you have in particular the right to access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw consent you have given at any time with future effect. To exercise your rights, a message to matt@cardentry.app.

You may also lodge a complaint with a data protection supervisory authority. In Austria this is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, email: dsb@dsb.gv.at. Further information can be found on the website of the Data Protection Authority.

Card recognition produces automated suggestions but makes no decision with legal or similarly significant effect within the meaning of Art. 22 GDPR. You can check and change recognised details yourself. We apply appropriate technical and organisational measures to protect data against loss, misuse and unauthorised access.

We adapt this privacy policy when features, service providers or legal requirements change. The version published on this page is the applicable one.