Privacy Policy

1. Information we collect

• Account data: email address, hashed password, display name, and role.
• Inventory data: slab photographs, certification numbers, values, and notes you enter.
• Billing data: Stripe customer ID, subscription status, and last four digits of your card (Stripe stores full card details).
• Usage data: API calls, feature usage, and error logs used to operate and improve the service.

2. How we use it

To operate your vault, process payments, provide support, prevent fraud, and improve the product. We do not sell your data.

3. Third parties

We share the minimum data needed with: Supabase (hosting and database), Stripe (payments), Google Cloud / OpenAI (AI analysis when you scan a slab), and PriceCharting (pricing lookups). Each is bound by their own privacy terms.

4. Data retention and deletion

Your vault data is retained for the life of your account plus 90 days after cancellation. You can export your full inventory at any time and request permanent deletion by emailing privacy@gradedcardvalue.com.

5. Security

Row-level security scopes every record to your account. Transport is HTTPS-only. Passwords are hashed with bcrypt. We do not store card numbers.

6. Your rights

Access, export, correct, or delete your data on request. EU/UK residents have GDPR rights; California residents have CCPA rights. Contact privacy@gradedcardvalue.com.

7. Changes

Material changes will be emailed to account holders at least 14 days before taking effect.