Privacy Policy

1. Introduction

Vendilot ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Vendilot website, web application, and mobile apps for iPhone and Android, and related services (collectively, the "Service").

Vendilot has two kinds of accounts. Vendor accounts are for people who buy and sell cards as a business. Collector accounts are for people tracking their own collection. This policy covers both, and points out where they differ.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

2. Information We Collect

We may collect the following types of information:

• Account Information: Email address, name, and authentication credentials when you create an account. If you sign in with Apple or Google, we receive your name, your email address (or an Apple private relay address if you choose to hide your email), and an account identifier from that provider. We never receive your Apple or Google password.
• Inventory and Collection Data: Card details, quantities, conditions, prices and values you enter, lot data, consignment records, folders, wishlists, price alerts, trade records, sales you record, and other content you add to the Service.
• Uploaded Images: Photos of trading cards submitted through SmartScan, lot image uploads, or card photos you add, for processing and display within your account.
• Messages and Offers: Offer requests, offers, card inquiries, the messages you write in them, and the contact details you choose to share with another user.
• Location: The city you choose, and your device location only when you tap to use it. See section 5.
• Notification Tokens: A push notification token for each device where you allow notifications. See section 6.
• Purchase Information: Your vendor plan and subscription status from Stripe, and your Collector+ subscription status and transaction records from Apple, Google Play, and RevenueCat. We do not receive your full card number.
• Usage Events: Feature usage events linked to your account, such as opening the Collector+ screen, reaching a free limit, adding a wishlist card, requesting offers, viewing nearby vendors, and tapping buying links. We use them to run, secure, and improve the Service, not for advertising. We also count visits to our website from people who are not signed in, without identifying them.
• Device and Diagnostic Information: Browser type, operating system, app version, screen size, and crash and error reports that include your account ID, so we can keep the Service compatible and fix problems.

3. How We Use Your Information

• To provide, maintain, and improve the Service.
• To process card images through our AI identification system (SmartScan).
• To generate pricing quotes and collection values using third-party market data.
• To show nearby vendors, card shows, and wishlist matches, and to deliver offers and inquiries between collectors and vendors.
• To send the notifications you turn on, and important service updates and communications.
• To answer questions you ask the Collector+ assistant.
• To verify subscriptions and purchases.
• To monitor and analyze usage trends to enhance user experience.
• To review reports, enforce our Terms, and detect and prevent fraud, abuse, or security incidents.

4. What Other Users See

Your collection is private. Other users see only what you choose to send them:

• Offer requests: When you ask for offers, the vendors you choose (or the vendors near you or at the card show you pick) receive a snapshot of the cards you selected: card names, images, printings, conditions, quantities, and estimated values. They do not see your name, email, or the rest of your collection.
• Contact details: A vendor receives your contact details only after you accept that vendor's offer, and only the details you enter at that time. When you accept an offer, you see that vendor's contact details.
• Card inquiries: When you ask a vendor about a card, that vendor receives your message and the contact details you enter.
• Local demand: Vendors may see how many nearby collectors want a card. These counts never include names or accounts.
• Vendor profiles: If you are a vendor and turn on Collector Market, collectors can see your shop name, city, the games you buy, whether you are accepting offers, whether you ship cards, and any card show you announce. Your available cards and their prices are shown to collectors only if you also turn on inventory sharing. Your public contact details are shown to a collector only after they accept your offer.

If you report content or block another user, the other user is not told. Blocking stops that user's offers, requests, and inquiries from reaching you.

5. Location

Local features work at the city level. When you search for a city, the text you type is sent to Google Places to find matches, and we save the city's center point, not your address. If you tap to use your device location, it is used for that search. If you save it as your home area, we store only an approximate area about 5 km (3 miles) across, labeled "Near you." We do not track your location in the background.

Vendor profiles show the vendor's city center and, while a vendor is at a card show, that show's city. You can change your saved city in the app at any time.

6. Notifications

If you allow notifications, we store a push token for your device. Expo, Apple, and Google process push tokens and notification content to deliver them. You can choose alert types and quiet hours in the app, and turn notifications off in your device settings at any time. We remove tokens that stop working and delete them when you delete your account.

7. AI Features

Collector+ assistant: When you ask the collection assistant a question, third-party AI service providers process your question and a summary of your collection (card names, quantities, and values) to generate an answer. We keep your questions and the answers until you delete your account, so we can provide support, review reports, and improve quality. You can report an answer in the app. Answers are generated by AI, can be wrong, and are not financial advice.

SmartScan: Card photos are processed by our card-recognition system, which may use third-party AI service providers to help identify a card.

8. Data Sharing

We do not sell, rent, or trade your personal information or inventory data to third parties. We may share information only in the following circumstances:

• Service Providers: With trusted third-party services that help us operate the Service, bound by confidentiality agreements. These include Stripe, Inc. for vendor payments and subscriptions; Apple, Google Play, and RevenueCat for Collector+ purchases, transaction records, and account identifiers; Google Places for city search; third-party AI service providers for AI features; Expo, Apple, and Google for push notifications; SendGrid for email; Sentry for crash reports; and cloud hosting providers.
• Other Users: Only the information described in section 4, when you choose to send it.
• Affiliate Links: Some buying links, such as links to TCGplayer, go through an affiliate program, and Vendilot may earn a commission. When you tap one, we record that you tapped it and which card or list it was for, linked to your account. The site you visit may use its own cookies under its own privacy policy.
• Legal Requirements: When required by law, regulation, or legal process.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice provided to you.

9. Payment Information

Vendor payments are processed by Stripe, Inc. Collector+ payments are processed by Apple or Google Play, and RevenueCat verifies subscription access using your Vendilot account ID. We do not store your full credit card number, CVV, or other sensitive payment details on our servers. For more information, see Stripe's privacy policy at stripe.com/privacy.

10. Data Storage & Security

Your data is stored using Amazon Web Services, PostgreSQL, Google Cloud Platform, and Firebase infrastructure. We employ industry-standard security measures including encryption in transit (TLS) and at rest, authentication controls, and regular security monitoring.

While we strive to protect your information, no method of electronic storage is 100% secure. We cannot guarantee absolute security but are committed to implementing reasonable safeguards.

11. Cookies & Local Storage

We use browser local storage and session storage, and storage on your device in the mobile app, to keep your preferences (such as theme and display settings) and your sign-in session. We do not use tracking cookies for advertising purposes.

12. Your Rights & Account Deletion

You have the right to:

• Access: Request a copy of the personal data we hold about you.
• Export: Export vendor inventory data at any time using our built-in export tools, or ask us for a copy of your collection data.
• Correction: Update or correct your account information at any time through the Service.
• Choices: Turn notifications and alert types on or off, change your saved city, and turn vendor discovery and inventory sharing on or off in the app.
• Deletion: Request deletion of your account on our account deletion page, in the mobile app (Settings, then Delete account, for vendors; Profile, then Delete my account, for collectors), or by email. We confirm by email and permanently delete your account and associated data within 30 days.

Deleting your account cancels a vendor Stripe subscription at the end of the current billing period. It does not cancel a Collector+ subscription bought through the App Store or Google Play. Cancel that in your store's subscription settings.

13. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. If you cancel a subscription, your data remains on the platform so you can access it again if you resubscribe. When your account is deleted, we delete your inventory and collection, wishlist, sold history, offers and inquiries you sent, assistant questions and answers, usage events, buying link records, and push tokens. We may keep limited records where the law requires it, such as payment records, and reports needed to protect other users.

14. Children's Privacy

You must be at least 13 years old to use the Service. The Service is not directed to individuals under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware of such collection, we will take steps to delete the information.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the revised policy.

16. Contact Us

If you have questions about this Privacy Policy, please contact us at support@vendilot.com.