Privacy Policy

1. Introduction and Identity of the Controller

Card Butler (operating under the trade name "TCG Inventory"), a company established under the laws of Switzerland, with its registered office in Zurich, Switzerland ("Company," "we," "us," or "our"), is the Data Controller for the personal data collected through the TCG Inventory web application, the Card Butler hardware device, and the website https://www.tcg-inventory.com (collectively, the "Service").

We are committed to protecting your privacy in accordance with the Swiss Federal Act on Data Protection (nFADP) and, where applicable to users in the European Economic Area (EEA), the General Data Protection Regulation (GDPR).

2. Categories of Data We Collect

We collect and process the following categories of personal data:

2.1 Information You Provide to Us

• Identity & Contact Data: Email address (used for Magic Link authentication), username, and full name (if provided for shipping).
• Shipping Data: Physical address, phone number, and delivery preferences (collected primarily from Kickstarter backers for hardware fulfillment).
• Inventory Data: Lists of trading cards, deck compositions, and collection valuations.
• User Content: Images/scans of cards uploaded via the Card Butler device or web interface.
• Support Data: Correspondence, feedback, and issue reports sent to our support team.

2.2 Information We Collect Automatically

• Technical Data: Internet Protocol (IP) address, browser type and version, time zone setting, operating system, and platform.
• Usage Data: Clickstreams, page response times, download errors, and page interaction information (scrolling, clicks).
• Device Telemetry (Hardware Users): If you use the Card Butler device, we collect device health status, firmware version, and connection stability logs.
• Authentication Data: Session tokens and login timestamps.

2.3 Information from Third Parties

• Kickstarter: If you backed our project, we receive your pledge details, email, and shipping address from Kickstarter.
• Stripe: We receive payment confirmation and subscription status (Active/Canceled) from Stripe. We do not store complete credit card numbers.

3. Why We Process Your Data

We process your data for the following purposes:

• Service Provision: To provide the TCG Inventory application, authenticate users via Magic Link, and manage card databases (Contract Performance).
• Order Fulfillment: To ship Card Butler hardware and process Kickstarter rewards (Contract Performance).
• Billing: To manage subscriptions and process payments via Stripe (Contract Performance).
• Security: To prevent fraud, secure user accounts, and detect API abuse (Legitimate Interests).
• Analytics: To improve the app and understand user behavior (Legitimate Interests/Consent).
• Marketing: To send newsletters and product updates (Consent).
• Legal Compliance: To maintain financial records for tax authorities (Legal Obligation).

4. International Data Transfers

Card Butler is based in Switzerland. However, our technology stack relies on service providers located in the United States and other regions. Therefore, your personal data will be transferred to, and processed in, these jurisdictions.

4.1 Transfer Protection

We ensure your data is protected during these transfers through mechanisms compliant with Swiss and EU law, such as the Swiss-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs).

4.2 Key Service Providers

We use the following key service providers to operate our Service:

• Vercel: Hosting and Analytics (USA)
• Neon: Database Provider (USA)
• Resend: Email Service (USA)
• Stripe: Payment Processing (USA)
• AWS: Storage and Infrastructure (USA/EU)

5. Data Retention and Deletion

We adhere to the principle of storage limitation:

• Account Data: Retained as long as your account is active. You may request deletion at any time. Upon deletion, your data is removed from our live database within 30 days.
• Backups: Deleted data may persist in encrypted backups for up to 90 days.
• Hardware Telemetry: Retained for 12 months on a rolling basis.
• Financial Records: Retained for 10 years as required by law.

6. Your Rights

Under applicable data protection laws, you possess the following rights:

• Right of Access: You may request a copy of all personal data we hold about you.
• Right to Rectification: You may correct inaccurate or incomplete data.
• Right to Erasure: You may request the deletion of your account. Note that we may retain transaction records for legal reasons.
• Right to Data Portability: You may request your inventory data in a structured, machine-readable format.
• Right to Object: You may object to the processing of your data for direct marketing purposes.

Exercise of Rights: To exercise these rights, please contact us at privacy@tcg-inventory.com.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to operate core features, remember preferences, and manage your consent choices.

• Strictly Necessary Cookies: Required for the operation of the app, authentication, and account security.
• Functional Cookies: Used to remember interface and TCG preferences.

For full details about cookie categories and current cookie names, please review our Cookie Policy.

8. Security

We implement appropriate technical and organizational measures to protect your data, including encryption at rest and in transit. However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee its absolute security.