Privacy Notice

1. Controller and contact

The controller is HoloRyn TCG, [BUSINESS ADDRESS REQUIRED]. Privacy contact: info@holoryntcg.co.uk.

2. Information we collect

• Account: name, email, password hash, account type, business/trading name, acceptance records and preferences.
• Collection and Vendor records: card details, images, costs, values, inventory, trades, sales, fees, notes, locations and reports that you enter.
• Collector recently paid price evidence: when an eligible Collector purchase date is within the previous 31 days, a pseudonymised contribution may contain card identity, raw/slab state, printing, grader, grade, paid amount, date and a pseudonymous contributor key. It excludes name, email, customer, notes, storage location, receipt, target price and profit.
• Shop access requests and workspace: requested business name, preferred plan and optional request notes; and, once access is granted, shop details, general and Pokémon products, stock movements, till sessions, sale items, payment route references, staff names/emails/roles, invitations and stocktake records.
• Optional market observations: exact card identity, raw/slab state, grader, grade, researched value, broad source, evidence link or note, and observation date when a Vendor actively chooses to contribute it. Private costs, target prices, profits, customer details and account balances are not included in the shared observation.
• Billing: customer, subscription, plan, status and renewal identifiers from Stripe, Apple or Google. Payment-card numbers and security codes are handled by the payment provider and are not stored in HoloRyn TCG.
• Technical and security: IP address, session information, device/browser information, timestamps, audit events, rate-limit events and error logs.
• Communications: support messages and information you provide when reporting a problem.

3. Purposes and lawful bases

4. Scanner processing and automated results

Routine card recognition is processed on the device where possible. After a Collector confirms a catalogue match, HoloRyn TCG stores the catalogue artwork reference and a compact visual fingerprint rather than retaining the camera photograph. The fingerprint contains image-comparison measurements, not a viewable photograph. A Vendor may deliberately choose to retain an exact-item photograph when it is needed for condition evidence, insurance, a transaction or a marketplace listing. When a card returns from professional grading, the Vendor must upload the original raw-card front image and may upload the back. HoloRyn TCG stores those images privately with the confirmed grader, grade and certificate as a verified AI Grader training example. A matching earlier AI prediction is calibrated automatically where one exists. The app produces suggestions for you to confirm. It does not make a solely automated decision that has a legal or similarly significant effect on you.

5. Recipients and service providers

Information may be handled by the production hosting/database provider, transactional email provider, payment provider, error-monitoring provider if enabled, and card catalogue or market-data services. Providers receive only the information reasonably needed for their task. Payment providers process payment information under their own privacy notices.

6. International transfers

Shop owners may choose third-party payment providers. HoloRyn TCG stores only the configured route and references unless a live connection is explicitly activated; the provider processes payment information under its own terms and privacy notice. Some providers may process information outside the UK. Before launch, the operator must identify each live provider and ensure an appropriate UK transfer mechanism and safeguards are in place where required, such as adequacy regulations or the UK International Data Transfer Agreement/Addendum.

7. Retention

Active account data is kept while the account is used. Account deletion removes linked live application records and stored uploads, except information that must be retained for billing, fraud prevention, legal claims or law. Deleted data may remain in encrypted backups for up to 30 days before rotation. Password-reset tokens expire after 30 minutes and deletion tokens after one hour. Production logs and support records must follow the documented retention schedule configured by the operator.

8. Your rights

Depending on the circumstances, UK data-protection law gives you rights to be informed, access your data, correct it, erase it, restrict processing, receive portable data, object to processing and complain about certain automated decisions. Consent can be withdrawn at any time where consent is used. Deleting or changing an eligible recent purchase withdraws or updates its future contribution. Withdrawing an optional market observation stops it being included in future shared calculations; it does not require us to rewrite calculations or reports already produced before withdrawal. Rights are not absolute and legal exceptions may apply.

Use Settings to delete an account, use the public deletion request page, or email info@holoryntcg.co.uk. We may verify identity before acting.

9. Complaints

Please contact us first so we can investigate. You also have the right to complain to the UK Information Commissioner’s Office.

10. Security

Controls include password hashing, HTTPS-ready secure cookies, session rotation, CSRF protection, server-side permissions, private image delivery, expiring signed marketplace-image links, upload validation, rate limiting, audit records and signed billing webhooks. No service can promise absolute security. Users should use a unique password and protect their device.

11. Children

Vendor subscriptions are for adults. A Collector user under 18 should have parent or guardian permission. HoloRyn TCG is not designed as a child-directed service and should not intentionally collect more information from children than necessary.

12. Cookies and local storage

HoloRyn TCG uses essential session, security, consent-preference and progressive-web-app storage needed to provide and protect the service. Optional analytics storage is disabled unless the user actively accepts it through the public-site consent controls. Users can reject optional storage as easily as accepting it and can change their choice later. See the Cookie and Local Storage Notice.

13. Changes

We may update this notice when providers, features or law change. Material changes will be highlighted in the app or by email where appropriate.

Website analytics and experience measurement

Subject to your cookie choices, we may use Google Analytics and Microsoft Clarity to understand website usage, diagnose faults and improve HoloRyn TCG. We also use Google Search Console to understand how our public pages perform in Google Search.

Google Analytics

Google Analytics may process information such as page views, sessions, referral source, approximate geographic area, browser, operating system, device category and interactions with public website features. We use this information to measure performance, improve navigation and understand which public content is useful. We do not permit Analytics to be used deliberately to collect passwords, complete payment-card numbers or the contents of private card photographs.

Google Search Console

Google Search Console provides aggregated reports about search queries, impressions, clicks, indexing, page performance and technical search issues. It does not operate as a normal session replay tool inside the HoloRyn TCG application.

Microsoft Clarity

Where you consent, Microsoft Clarity may provide heatmaps, clicks, scrolling information, technical diagnostics and masked or anonymised session-replay information. Sensitive fields should be masked or excluded, and Clarity should not be configured to record passwords, payment-card details or private uploaded card images.

Legal basis and consent

Where analytics involves cookies or similar device-access technologies that are not strictly necessary, we rely on your consent. Analytics remains disabled or restricted until that consent is provided where legally required. You may reject or later withdraw optional consent using the cookie controls without affecting the essential operation of your account.

Service providers and transfers

Google and Microsoft act as external service providers for their respective products and may process information outside the United Kingdom. Where applicable, we use the providers' contractual and data-protection controls for international transfers. Their own privacy information explains how they process information within their services.

Retention

Analytics and diagnostic information is retained only for the configured period necessary for measurement, security, troubleshooting and service improvement. Retention settings may differ between Google Analytics, Google Search Console and Microsoft Clarity.