Effective 2026-07-27
Privacy Notice
We use the information needed to operate and secure HoloRyn TCG, provide your collection or Vendor workspace, process subscriptions and answer support requests. We do not store full payment-card details and do not sell personal information.
1. Controller and contact
The controller is [LEGAL OPERATOR NAME REQUIRED], [BUSINESS ADDRESS REQUIRED]. Privacy contact: support@example.com.
2. Information we collect
- Account: name, email, password hash, account type, business/trading name, acceptance records and preferences.
- Collection and Vendor records: card details, images, costs, values, inventory, trades, sales, fees, notes, locations and reports that you enter.
- Collector recently paid price evidence: when an eligible Collector purchase date is within the previous 31 days, a pseudonymised contribution may contain card identity, raw/slab state, printing, grader, grade, paid amount, date and a pseudonymous contributor key. It excludes name, email, customer, notes, storage location, receipt, target price and profit.
- Shop access requests and workspace: requested business name, preferred plan and optional request notes; and, once access is granted, shop details, general and Pokémon products, stock movements, till sessions, sale items, payment route references, staff names/emails/roles, invitations and stocktake records.
- Optional market observations: exact card identity, raw/slab state, grader, grade, researched value, broad source, evidence link or note, and observation date when a Vendor actively chooses to contribute it. Private costs, target prices, profits, customer details and account balances are not included in the shared observation.
- Billing: customer, subscription, plan, status and renewal identifiers from Stripe, Apple or Google. Payment-card numbers and security codes are handled by the payment provider and are not stored in HoloRyn TCG.
- Technical and security: IP address, session information, device/browser information, timestamps, audit events, rate-limit events and error logs.
- Communications: support messages and information you provide when reporting a problem.
3. Purposes and lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Create accounts; provide collection, scanning and Vendor features; process subscriptions | Contract or steps at your request before a contract |
| Create a Vendor-requested inventory or marketplace export and temporary signed stock-image links | Contract and your deliberate request to generate the export |
| Secure the service, prevent fraud and diagnose faults | Legitimate interests in operating a safe and reliable service |
| Keep billing, tax or legal records | Legal obligation and legitimate interests |
| Respond to support and rights requests | Contract, legal obligation or legitimate interests depending on the request |
| Use recent pseudonymised purchase prices, opted-in Vendor-sale evidence and researched market observations to improve shared estimates and daily movement | Legitimate interests in improving valuation quality with safeguards, and your optional choice/consent where a separate contribution control is offered |
| Provide Shop stock, till, staff-role and stocktake workflows | Contract, steps at your request, and legitimate interests in account security and auditability |
4. Scanner processing and automated results
Routine card recognition is processed on the device where possible. After a Collector confirms a catalogue match, HoloRyn TCG stores the catalogue artwork reference and a compact visual fingerprint rather than retaining the camera photograph. The fingerprint contains image-comparison measurements, not a viewable photograph. A Vendor may deliberately choose to retain an exact-item photograph when it is needed for condition evidence, insurance, a transaction or a marketplace listing. When a card returns from professional grading, the Vendor must upload the original raw-card front image and may upload the back. HoloRyn TCG stores those images privately with the confirmed grader, grade and certificate as a verified AI Grader training example. A matching earlier AI prediction is calibrated automatically where one exists. The app produces suggestions for you to confirm. It does not make a solely automated decision that has a legal or similarly significant effect on you.
5. Recipients and service providers
Information may be handled by the production hosting/database provider, transactional email provider, payment provider, error-monitoring provider if enabled, and card catalogue or market-data services. Providers receive only the information reasonably needed for their task. Payment providers process payment information under their own privacy notices.
6. International transfers
Shop owners may choose third-party payment providers. HoloRyn TCG stores only the configured route and references unless a live connection is explicitly activated; the provider processes payment information under its own terms and privacy notice. Some providers may process information outside the UK. Before launch, the operator must identify each live provider and ensure an appropriate UK transfer mechanism and safeguards are in place where required, such as adequacy regulations or the UK International Data Transfer Agreement/Addendum.
7. Retention
Active account data is kept while the account is used. Account deletion removes linked live application records and stored uploads, except information that must be retained for billing, fraud prevention, legal claims or law. Deleted data may remain in encrypted backups for up to 30 days before rotation. Password-reset tokens expire after 30 minutes and deletion tokens after one hour. Production logs and support records must follow the documented retention schedule configured by the operator.
8. Your rights
Depending on the circumstances, UK data-protection law gives you rights to be informed, access your data, correct it, erase it, restrict processing, receive portable data, object to processing and complain about certain automated decisions. Consent can be withdrawn at any time where consent is used. Deleting or changing an eligible recent purchase withdraws or updates its future contribution. Withdrawing an optional market observation stops it being included in future shared calculations; it does not require us to rewrite calculations or reports already produced before withdrawal. Rights are not absolute and legal exceptions may apply.
Use Settings to delete an account, use the public deletion request page, or email support@example.com. We may verify identity before acting.
9. Complaints
Please contact us first so we can investigate. You also have the right to complain to the UK Information Commissioner’s Office.
10. Security
Controls include password hashing, HTTPS-ready secure cookies, session rotation, CSRF protection, server-side permissions, private image delivery, expiring signed marketplace-image links, upload validation, rate limiting, audit records and signed billing webhooks. No service can promise absolute security. Users should use a unique password and protect their device.
11. Children
Vendor subscriptions are for adults. A Collector user under 18 should have parent or guardian permission. HoloRyn TCG is not designed as a child-directed service and should not intentionally collect more information from children than necessary.
12. Cookies and local storage
HoloRyn TCG uses essential session, security, consent-preference and progressive-web-app storage needed to provide and protect the service. Optional analytics storage is disabled unless the user actively accepts it through the public-site consent controls. Users can reject optional storage as easily as accepting it and can change their choice later. See the Cookie and Local Storage Notice.
13. Changes
We may update this notice when providers, features or law change. Material changes will be highlighted in the app or by email where appropriate.