Privacy Policy

Effective date: 08/29/2026

1. Who we are

Card Vendor ("we", "us") is a Shopify app for trading-card shops: buylist intake, market repricing, grading tracking, store-credit trade settlement, price tags, memberships, and postage labels. It is operated by Card Vendor LLC, PO Box 68, Harrisonville, MO 64701. This policy covers the Card Vendor app and this website.

2. Merchant and customer roles

Card Vendor is installed by merchants (shops). For personal data about a merchant's customers that the merchant processes through the app — for example a want-list recorded against a customer, or a store credit issued for a trade — the merchant is the data controller and Card Vendor processes that data on the merchant's behalf. For a merchant's own account data (staff sign-in, shop settings, billing plan), Card Vendor is the controller.

If you are a shop's customer and want to know about, correct, or erase data a shop holds about you, contact that shop — it controls the data and Card Vendor acts on its instructions, including the Shopify-mediated requests described in section 6.

3. What we collect

Merchant and shop data

• The shop's Shopify domain and an API access token, provided by Shopify when the app is installed.
• Staff sign-in details from Shopify authentication, including the signed-in staff member's name and email.
• Shop configuration: cash/trade rate tables, label layouts (including an uploaded store logo), buylist and bounty settings, an intake-approval notification email address, and postage settings including the shop's return address.
• The shop's own EasyPost API keys, when the merchant configures the postage feature. Keys are stored to sign the shop's EasyPost requests and are never sent to the browser (the settings screen shows at most the last four characters).
• Operational records the merchant creates: staged intake sessions and items (including amounts offered and paid), grading submissions and certificate numbers, repricing snapshots, binders, employee names, cash bag entries, membership tier configuration, consignment records, and postage purchase records (order numbers, tracking codes, label URLs, and amounts charged).

Customer data processed for the merchant

The app deliberately keeps customer identity in Shopify's own customer records rather than building a parallel contact database. What it stores app-side is limited to:

• Want-lists (bounties): a reference to the Shopify customer, a display copy of the customer's name, and the cards they are looking for.
• Online buylist submissions: the submitting customer's Shopify identity and a display copy of their name, alongside the submitted list.
• Memberships: a reference to the Shopify customer with display copies of their name and email, the tier they hold, and reward/credit activity.
• Store credit records: when a trade settles as Shopify store credit, the intake record notes the customer, the amount, and the time, and the trade receipt can carry the customer's name.
• Privacy-request records: when Shopify sends us a data or deletion request about a customer, we keep a short operational record that the request arrived — a reference to the Shopify customer, the date, and counts of what was found or removed. It carries no name, no email and nothing about what the customer collects. We keep it so the merchant can still show what was done after the hosting logs have rolled over; see retention below.

Customer name and email are read through Shopify's protected customer data access, with the merchant's authorization, and are used only for the features above. The app never collects customer passwords, and it never sees payment card details — all charges (the app subscription, and everything a shop's customers buy) are processed by Shopify.

4. How we use it

• To run the features the merchant operates: quoting buys, creating products, matching want-lists, tracking grading, issuing and recording store credit, managing memberships, and buying postage labels.
• To operate, secure, and troubleshoot the service.
• To respond when a merchant contacts support.

We do not sell personal data, we do not use it for advertising, and we do not profile customers beyond the features described here.

5. Third parties and subprocessors

• Shopify — the platform the app runs on: authentication, products, customers, store credit, and all billing. Charges are handled by Shopify; Card Vendor never receives payment card data.
• Render — cloud hosting for the app, its supporting price/PDF service, and its databases, in the United States (Oregon region), with TLS on all connections.
• TCGplayer — market price data for the price index. Lookups are made server-side and carry card and product identifiers only; no merchant or customer personal data is sent.
• PriceCharting — video-game price data. Same shape: server-side lookups by product identifier only; no personal data is sent.
• Grading services (PSA, TAG, CGC) — certificate numbers a merchant enters are verified server-side against the grader's certificate-verification service. No personal data is sent.
• EasyPost — when a merchant buys postage labels, the recipient names and addresses from the merchant's uploaded shipping export are transmitted to EasyPost to purchase the labels, billed to the merchant's own EasyPost account under EasyPost's terms. Card Vendor keeps the resulting label records (order number, tracking code, label URL, costs) but does not store recipient addresses in its database.

6. Data retention and deletion

• While installed: the app keeps the records above so the merchant can use them. What the app stores is largely a staging area and configuration; the durable business records — products, inventory, store credit balances — live in the merchant's Shopify store.
• On uninstall: the app deletes all of the shop's data immediately — staged intake, grading, bounties, memberships, binders, employees, cash bags, postage records, repricing data, settings, and the stored access token. If a deletion attempt fails, it is retried rather than acknowledged.
• Shop redaction webhook: Shopify additionally sends a shop/redact request about 48 hours after uninstall; the same full deletion runs again then, within Shopify's mandated timeline, so anything a failed first pass left behind is removed.
• Customer redaction webhook: on a customers/redact request, the customer's want-list rows are deleted, and their online buylist submissions are anonymized — the identity is removed while the shop's trade record survives. Membership records are anonymized the same way: the link to the customer account is broken and the stored name and email are removed while the shop's store-credit accounting survives, and store-credit notes on past intakes are scrubbed of the customer's identity as well. Our own record that a privacy request arrived, which stores the customer reference and counts and nothing else, is erased in the same pass. Those records also expire on their own after 90 days, whether or not a deletion request ever arrives.
• Customer data requests: on a customers/data_request, we compile what is held for that customer — want-list rows, online buylist submissions, membership records, store-credit notes, and any record of an earlier privacy request — so the merchant can answer within their response window.
• Generated documents: trade receipts and tag sheets are generated as PDFs for the merchant; a receipt can include a customer's name when store credit was issued.

7. Security

• All connections use TLS.
• Every shop-scoped database record carries the shop's domain, and per-shop isolation is enforced at the schema — a record cannot be written without its owning shop.
• Merchant EasyPost keys are held server-side and never sent to the browser.

8. Cookies

• This website sets no cookies.
• The app uses authentication and session state only: the embedded app authenticates with Shopify session tokens and keeps session data server-side, and the operator console uses a session cookie marked HttpOnly and SameSite=Lax.
• The customer-facing buylist pages on a shop's storefront set no cookies.
• No advertising, analytics, or cross-site tracking cookies are set by Card Vendor.

9. Changes to this policy

When this policy changes, the updated version is posted here with a new effective date.

10. Contact

Questions about this policy or a data request: tcgvendorshop@gmail.com.