Privacy Policy
AllCardzz (allcardzz.com) is operated by ALLPLAYZZ LTD, 16–18 Kosta Georgiou, 8010 Paphos, Cyprus (VAT 60107276F) — the "controller" of your personal data under the EU General Data Protection Regulation (GDPR).
1. What we collect
Account data. When you sign up we collect your email address and display name, and — if you sign in with Google — the name, email address and profile picture Google shares with us. If you sign up with an invite code, we record which code you used. We also record which version of the Terms you accepted, and when.
Your collection and listings. Cards you add, binders, wantlists, listings, prices, notes and other content you create on AllCardzz.
Photos. Photos of cards you upload. They are stored on our servers and, when you use photo identification, sent to our card-recognition provider (see "Who we share data with").
Trade and payment data. Orders, bids and trades you take part in; shipping names and addresses you provide for delivery; parcel tracking numbers; payment status. Your card/payment details are collected directly by our payment provider, Stripe — they never touch our servers.
Usage data. Page-view events (for example, how often a listing was viewed) and the technical logs needed to run and secure the service (such as IP address and browser type). We do not use third-party advertising or analytics trackers.
Cookies. Essential cookies only: a session cookie that keeps you signed in and short-lived cookies used during sign-in. No advertising cookies.
2. Why we process it, and on what legal basis
- To provide the service — your account, collection, marketplace, trades and payments (performance of a contract).
- To identify cards from photos you submit (performance of a contract).
- To send transactional email — sign-in links, trade and order updates (performance of a contract; legitimate interest).
- To keep the service secure, prevent fraud and abuse, and debug errors (legitimate interest).
- To comply with legal obligations, such as tax and accounting rules (legal obligation).
3. Who we share data with
We use a small number of service providers to run AllCardzz:
- Google — sign-in with Google.
- Stripe — payment processing and seller payouts. Stripe processes your payment details as its own controller.
- Ximilar — card recognition: photos you submit for identification are sent to Ximilar's API.
- 17TRACK — parcel tracking: shipment tracking numbers are sent to the tracking service so both sides of a trade can follow delivery.
- Email delivery providers — to send you transactional email.
- Sentry — error monitoring, which may process technical data connected to an error.
- Cloudflare — networking, content delivery and security in front of our servers.
- Hosting providers — the servers the service runs on.
Other users and the public. Your display name is visible to other users. Listings you publish, binder pages you share, and view counts on them are public. When you enter a trade, the other party sees the details needed to complete it — for example, the shipping details you provide.
We do not sell your personal data.
4. International transfers
Some providers (for example Google, Stripe, Sentry, 17TRACK) may process data outside the European Economic Area. Where that happens, transfers rely on an adequacy decision (such as the EU–US Data Privacy Framework) or standard contractual clauses.
5. Retention
We keep your data while your account is active. If you close your account, we delete or anonymise your personal data within a reasonable period, except records we must keep longer (for example, transaction records for tax and accounting) and content that is part of another user's completed trade history. Server logs and error reports are kept for a short period.
6. Your rights
Under the GDPR you can ask us for access to, correction, deletion or a portable copy of your data; ask us to restrict or object to processing; and withdraw consent where processing is based on consent. Write to [email protected] — we answer within a month. You can also complain to your local supervisory authority or to ours: the Office of the Commissioner for Personal Data Protection, Cyprus (dataprotection.gov.cy).
7. Age
AllCardzz is for adults. You must be 18 or older to create an account.
8. Changes
We will post any changes to this policy on this page and, for material changes, notify you in the service or by email.
See also: Terms of Service