Privacy notice
Version 2026-10-18 · updated October 18, 2026
This notice explains how CardPlaza processes the personal data of people who visit CardPlaza (https://cardplaza.net) and of people who sign up to use its services, under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and the Italian Privacy Code (Legislative Decree 196/2003).
For the rules of using the service see the Terms and Conditions; for the data stored in your browser see the Cookie Policy.
1. Data controller
The data controller is CardPlaza.
For any question about how your data is processed and to exercise your rights, write to privacy@cardplaza.net.
2. Data processed, purposes and legal bases
The table shows, for each purpose, which data we process, on which legal basis and for how long we keep it. The legal bases are those of Article 6 GDPR: performance of a contract (point b), legal obligation (point c), legitimate interests (point f) and consent (point a).
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Creating and managing your account, authenticating you and protecting it (password, two-factor authentication, passkeys, one-time codes, sign-in links) | Name, email, username, password (stored only in encrypted form), 2FA and passkey data, sessions (date, IP address, device and browser) | Contract (Art. 6(1)(b)) | While the account is active. The IP address and device of a session are deleted after 30 days. |
| Service security and abuse prevention: access log | Date and time of each login, IP address and device/browser used | Legitimate interest (Art. 6(1)(f)): protecting accounts, detecting unauthorised access and abuse, answering requests from authorities | 12 months from the login, then deleted. They are kept for this period even after the account is closed. |
| Publishing listings, showing them in your city and letting you search for cards | Listings (card, price, condition, quantity), city and its geographic coordinates, public profile (username, city, biography, image, ratings, badges and Aura Points) | Contract (Art. 6(1)(b)) | While the account is active; a withdrawn listing is no longer visible. |
| Putting you in touch with other users: chat, trade proposals, per-seller cart, transactions, reviews | Messages, proposals and amounts, cart lines, transaction status, reviews, chosen meeting point | Contract (Art. 6(1)(b)) | While the account is active. A conversation hidden by both participants is deleted after 12 months. When the account is closed, messages and transactions stay with the other party in anonymous form. |
| Wishlist, favorites, followed users, in-site notifications and service emails (new message, target price reached, reply to a proposal) | Cards searched and target price, saved listings, follow relationships, notification content, email address | Contract (Art. 6(1)(b)) | While the account is active. Notifications that have been read are deleted after 12 months. |
| Store events: "I'm going" sign-ups and attendee management | Event, public name and image of the attendee, sign-up date (visible to the organizing store and its authorized staff) | Contract (Art. 6(1)(b)) | Until the sign-up or the account is deleted. |
| Pro and Store plans, Early Adopter offer, store verification and management | Plan and expiry, badge, store request (company name, VAT number, address, contacts, opening hours, images), invited staff, "Notify me" preferences | Contract (Art. 6(1)(b)); legal obligations for business data (Art. 6(1)(c)) | While the plan or store is active; accounting and tax records for 10 years from the transaction. |
| "Find a table" tables (games organised by Pro and Store users) and players' sign-ups | Title, game, day and time, place chosen by the organiser (venue, address, map position), notes, seats; for players, the sign-up to the table; the messages of the table's group chat (text, author, date and time) with joins and leaves | Contract (Art. 6(1)(b)) | While the table exists; the table's chat is deleted 6 months after the table starts. If you close your account your sign-ups are deleted, the future tables you organise are cancelled and the messages you wrote stay with the other members as "Deleted user". |
| Support and priority support | Name, email and content of the request; the WhatsApp number only if you choose that channel | Contract (Art. 6(1)(b)) | For as long as needed to handle the request and to protect our rights in case of disputes. |
| Problem reports about the site (“Report a problem” and “Send the problem” after an error) | The text you write, the page you are on (without the address parameters), the language and the browser type; if you send it from an error screen, also the technical error message (without request values); your email only if you provide it; your account, if you are signed in | Legitimate interests (Art. 6(1)(f)) in fixing defects and keeping the service secure; consent (Art. 6(1)(a)) for an email left to be contacted | 12 months after the report is closed. If you close your account, the link to you and the email are deleted. |
| Security, fraud and abuse prevention, moderation (reports, disputes, blocks), enforcement of usage limits | IP address, device, technical logs, reports and the related decisions, statements of reasons | Legitimate interests (Art. 6(1)(f)) in keeping the service secure and protecting users; legal obligations (Art. 6(1)(c)) | Technical logs for the time strictly necessary; reports and moderation decisions 24 months after closure. |
| Aggregate usage statistics: views of listings and store pages, most searched cards, analytics for stores | A random anonymous key stored in your browser, the listing or store visited, date. It does not identify you and is not linked to your account | Legitimate interests (Art. 6(1)(f)) in giving sellers statistics and improving the service | Individual views are deleted after 24 months. |
| Usage statistics with Google Analytics (pages visited, referral source, device and browser, visit duration) | Random identifier in the _ga cookies, IP address (which Google Analytics does not log in full), pages visited, device and browser type, approximate location. We do not link this data to your account | Consent (Art. 6(1)(a)), given through the cookie banner and revocable at any time via “Cookie preferences” in the footer | Analytics data is kept for 14 months (Google Analytics setting). |
| Finding the city near you ("Use my location" button) | Device coordinates, sent to the server only to find the nearest city and not stored | Consent (Art. 6(1)(a)), given by enabling the browser's location permission | Not stored. You can withdraw the permission at any time in your browser settings. |
| Legal obligations and defense of legal claims | Data needed to meet tax, accounting and authority obligations and to establish or defend a right | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) | For the periods set by law or by the limitation period of the rights concerned. |
We do not use advertising profiling cookies, we do not show personalized advertising, we do not use the advertising features of Google Analytics and we do not sell your data. We do not take decisions based solely on automated processing that produce legal effects on you.
3. Providing your data
To sign up we need your name, email, username and password: without them we cannot create the account. The other profile data (city, biography, image) is optional, but the city is needed to publish listings and to trade in person. To open a store, the business data requested in the application is mandatory.
4. Who sees your data inside the site
The site is a meeting place between people: some information is visible to other users.
- A store's public page: company name, VAT number, address, contacts and opening hours (these are business operator details, not those of a private person).
- Public profile: username, display name, city, biography, image, ratings received, badges, Aura Points, active listings. You can hide your profile and listings by turning off the public profile in the settings.
- Chats and proposals: visible to you and the other party. If the other party is a store, the store's conversations and trades are also visible to the store owner and to the staff the owner has authorized.
- Event sign-ups: the organizing store and its authorized staff see your public name, image and sign-up date.
- "Find a table" tables: title, game, day, time, place (venue name, address and map position), notes, the organiser's public name and the number of seats are visible to everyone, even without an account. The list of people who joined (public name and picture) is visible only to the organiser and the other participants; the table's group chat is visible only to them, and the organiser can delete its messages and remove a participant.
- Moderation: site administrators may see content, reports and the conversations involved when needed to handle a report, a dispute or a breach of the Terms.
Think carefully about what you write in your biography and in chats: do not include data you do not want to be known, nor data about other people.
5. Recipients and service providers
We do not sell data. We share it only with providers that process it on our behalf as processors (Art. 28 GDPR), under contracts that bind them to our instructions, and with authorities that request it in the cases provided by law.
| Provider | Service | Data | Data location |
|---|---|---|---|
| Resend, Inc. | Sending service emails (confirmations, password reset, notifications, support) | Email address, name, email content | United States: transfer with appropriate safeguards (see below) |
| Aruba S.p.A. | Contact mailboxes (support, privacy, legal) | Email address and content of the messages you write to us | Italy (European Union) |
| Sentry (Functional Software, Inc.) | Technical error monitoring, where enabled | Technical error data (error type, page without parameters, browser and system). Before sending we remove account, cookies, IP address, email addresses and URL parameters | United States or European Union depending on configuration: appropriate safeguards |
| Contabo GmbH | Servers running the application and the PostgreSQL database | All account and service data, browsing and traffic data | European Union (Germany) |
| Cloudflare, Inc. | Storage of database backups (Cloudflare R2) | Copy of all account and service data, kept for 14 days | United States or European Union depending on the storage jurisdiction: appropriate safeguards (see below) |
| Google Ireland Limited (Google LLC) | Usage statistics with Google Analytics, only if you accept analytics cookies | Browsing data described in the purposes table | European Union and United States: appropriate safeguards (EU-US Data Privacy Framework or standard contractual clauses) |
| Stripe Payments Europe, Ltd. | Subscription payments, once enabled | Data needed for the payment. Stripe processes card data as an independent controller; we neither receive nor store it | European Union / United States with appropriate safeguards |
If you choose to contact us on WhatsApp from the support link, the conversation takes place on the WhatsApp platform, which acts as an independent controller under its own notice.
6. Card images and maps loaded from third-party services
Catalog card images may be loaded directly from the servers of public card-data services (for example Scryfall, TCGdex, YGOPRODeck, Lorcast and optcgapi). When you view a card, your browser contacts those servers, which may receive your IP address and browser technical information under their own policies. We send them no data from your account.
The maps in "Find a table" load map tiles from OpenStreetMap servers (OpenStreetMap Foundation): your browser contacts them and they may receive your IP address, browser technical information and the map area you are viewing, under their own policy. We send them no data from your account.
7. Transfers outside the European Economic Area
The application and the database are hosted in the European Union (Germany). Some providers (for example for sending emails and storing backups) may process data in the United States. In those cases the transfer is based on a European Commission adequacy decision (EU-US Data Privacy Framework, if the provider participates) or on the standard contractual clauses approved by the Commission (Art. 46 GDPR), with supplementary measures where needed. You can ask us for a copy of the safeguards by writing to privacy@cardplaza.net.
8. How long we keep your data
Retention periods are given for each purpose in the table above. In short: account data for as long as the account is active; when the account is closed we delete or anonymize personal data, except what we must or may keep by law or to defend a right (for example accounting and tax records, for 10 years). Messages and transactions shared with another person stay available to the other party, but without any reference that identifies you: "Utente eliminato" (Deleted user) appears in your place.
Backups: we take periodic copies of the database and keep them for 14 days, after which they are replaced. Data you delete (or an account you close) disappears from the service immediately but may remain in backups for up to 14 days; if a backup is restored, later deletions are carried out again.
After the account is closed we keep, without any other data that identifies you, proof of your acceptance of the Terms and of your age declaration (version and date), so that we can show we met our obligations and defend a legal claim.
9. Your rights
You have the right to:
- access your data and obtain a copy (Art. 15);
- have inaccurate data corrected and incomplete data completed (Art. 16);
- have your data erased (Art. 17);
- have processing restricted (Art. 18);
- receive your data in a structured, commonly used, machine-readable format and transmit it to another controller (portability, Art. 20);
- object to processing based on legitimate interests (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of earlier processing (Art. 7(3)).
You can exercise many of these rights yourself: in Settings you edit your profile data, download a copy of your data as JSON and delete your account. For any other request write to privacy@cardplaza.net: we reply without undue delay and in any case within one month of the request (extendable by two months in complex cases, with notice).
To protect you, we may ask you to verify your identity before acting on a request.
10. Complaint to the supervisory authority
If you believe the processing breaches the law you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it, Piazza Venezia 11, 00187 Rome) or with the supervisory authority of the EU country where you live or work, and you may go to the courts.
11. Minors
The service is reserved for people aged 18 or over. We do not knowingly collect data of minors; if we learn that an account belongs to a younger person we close it and delete the data. If you think a minor has signed up, tell us at privacy@cardplaza.net.
12. Security
We adopt appropriate technical and organizational measures (Art. 32 GDPR): encrypted connections, passwords stored only in encrypted form, two-factor authentication and passkeys available to users, role-based access controls on data, administrative access limited to authorized personnel. If a personal data breach presents a risk to you, we notify the people concerned and the supervisory authority in the cases and within the time limits set by Arts. 33 and 34 GDPR.
13. Changes to this notice
We may update this notice, for example when we introduce new features or new providers. The version in force is always the one published on this page, with its date and version number at the top. For substantial changes we notify you with a notice on the site or by email before they take effect.