CardBento Privacy Policy

1 Information you provide

Account information. We collect your email address, account identifier, profile name and sign-in information. If you use Google sign-in, Google provides the identity and profile information allowed by your sign-in settings, which may include your name, email address and profile image. We do not receive your Google password.

Eligibility information. We request an age category and country and, where needed, state or province to apply our age requirements. For minor accounts, we also request a parent or guardian contact and keep the permission status, confirmation date and version of the notices accepted. We do not routinely request government identification for this process.

Saved information. We process the collections, product and printing selections, quantities, purchase costs, sale records, watchlist entries and notes, price targets, decks and deck versions that you choose to save. We also receive the content of support messages and attachments you send us.

2 Scanner images and diagnostics

When you use the Scanner or upload a card photo, we process captured or selected images and image crops, extracted card text, candidate matches and your selected result. Images are sent to our servers and recognition providers, including Google Cloud services, to identify the card and distinguish possible versions. Browser camera permission controls camera access; it does not mean recognition happens entirely on your device.

For diagnostic testing where diagnostic capture is available and enabled, we may retain captured images, crops, extracted text and recognition details in restricted storage to investigate failures and improve matching. Ordinary operational logs can still be recorded when image diagnostics are disabled. Avoid including faces, addresses, identification documents or other private information in card photos.

3 Information collected automatically

Our hosting and security services process technical information such as IP address, request time, browser and device information, requested pages, response status and error details. Scanner logs can include a session identifier, timing, image dimensions, camera status, detected card identifiers and recognition outcomes.

We use Vercel Web Analytics to understand traffic and service use. Its standard analytics uses aggregated page and device information without third-party analytics cookies. This does not mean all CardBento services are cookie-free or that operational logs contain no personal information.

4 Why we use information

We use information to create and secure accounts; save and display your collections, watchlists and decks; recognize cards; calculate the values you request; send account messages and price-target alerts you enable; respond to support and privacy requests; diagnose errors; improve the service; prevent abuse; and meet legal obligations. Optional marketing, if introduced, requires the choices and consent required by law. Creating an account is not consent to unrelated marketing.

5 Service providers and other disclosures

We do not sell your personal information. We disclose information to service providers as needed to operate CardBento and in the other circumstances described in this policy.

We use service providers for the purposes described above: Supabase for authentication, database and storage; Vercel for hosting, delivery, logs and analytics; Google for Google sign-in and Google Cloud recognition infrastructure; and Resend for guardian-review messages and enabled price-alert emails. Information sent to each provider depends on the feature you use. For example, an alert email can include your email address, card name, printing and price target.

If you choose a paid plan when one is offered, Stripe processes checkout and payment information. We may receive customer and subscription identifiers and billing status. Separate payment details and terms are presented before purchase.

We may also disclose information when legally required, to investigate fraud or protect rights and safety, to advisers subject to appropriate confidentiality obligations, or in connection with a business transaction subject to applicable privacy requirements. We may disclose information at your direction.

6 Cookies browser storage and affiliate links

We do not use advertising trackers on CardBento. We use the operational services and analytics described in this policy, and some outbound links use affiliate attribution.

Authentication cookies keep you signed in. Browser storage can retain theme preferences, saved settings, unfinished collection drafts and navigation context. You can manage cookies and local storage in your browser; blocking them can prevent sign-in or remove locally saved preferences and drafts.

Some TCGplayer links are affiliate links. We may earn a commission when you follow one and make a qualifying purchase. Clicking can route you through an affiliate network and allow that network and the destination site to process request or attribution information under their own policies. Purchases and activity on external sites are governed by those sites.

7 Retention security and processing locations

Account information and saved collections, watchlists and decks are retained while your account is active, subject to valid deletion requests and applicable exceptions. Retained scanner photos and diagnostic bundles are deleted after 30 days. Routine scanner logs are kept for up to 90 days where hosting supports it; some providers keep them for a shorter period. Recognition images are not routinely saved as diagnostics.

Expired registration reviews unlinked to an account are removed after 30 days. Age, location and acceptance or guardian-confirmation records follow the account’s retention period. We periodically review the minimal privacy-request log and retain it only as needed to document our response and obligations.

Selected financial or compliance records may be kept for up to seven years where we document a need. This is not a blanket retention period. A legal obligation or preservation requirement may require a different period. Backup copies follow the provider’s backup lifecycle and may not disappear immediately when active records are deleted. If a request cannot be fully fulfilled, we explain what must be retained and why unless disclosure is legally restricted.

We use safeguards intended to protect personal information, but no online service can guarantee absolute security. CardBento is operated from the United States. Information may be processed in the United States and other countries where our providers operate, including outside Canada or your province. Foreign laws can permit courts or public authorities to access information. Contact us for information about our processing arrangements and applicable safeguards.

8 Your choices requests and complaints

You can update available profile settings, change saved records and revoke camera permission through your browser. Enabled price-target emails include an unsubscribe option. To request access, correction, a copy of your information, account closure or deletion, or to ask about withdrawing consent, email support@cardbento.com. Requests are handled by CardBento’s privacy contact. We verify that you control the account before releasing or deleting its information, and may request additional information when reasonably needed. Government identification is not our routine verification method. Withdrawing consent may prevent us from providing features that require that information.

We aim to acknowledge requests within two business days and complete our response within 30 days, while following the deadlines and any permitted extensions under applicable law. If an extension is needed, we explain it as required. We provide access or a copy, correct information or delete account records as appropriate, including applicable instructions to service providers. We keep a limited request log recording the date, request type, action and outcome to document our response.

Depending on applicable law, you may have additional privacy rights, including rights to appeal a request decision or opt out of certain uses. We respond as required by the law that applies to the request. You may complain to the Office of the Privacy Commissioner of Canada, an applicable provincial privacy regulator, or the relevant United States authority. You can contact us first without giving up those rights.

9 Age requirements and policy changes

CardBento is for people aged 13 and older. If you are below the age of majority where you live, your parent or legal guardian must review the Terms of Service and this Privacy Policy and confirm permission before your account is activated. The same requirements apply to Google signup. A minor’s own statement that a parent agrees does not replace the parent or guardian’s confirmation. Children under 13 may not create an account or submit personal information. If you believe a child under 13 has provided information, contact us so we can investigate and take appropriate action.

We will post policy changes with an updated effective date and provide additional notice or obtain consent when required by law. This policy does not replace a consent request required for a new use of personal information.

10 Contact

Privacy Officer, CardBento LLC Illinois, United States Email: support@cardbento.com Mailing address: 12447 S Polaris St Plainfield, IL 60585 United States