Privacy Policy

CardYard ("we", "us", "our") is committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what personal information we collect, why, and how we handle it.

1. Who we are

CardYard operates an online marketplace for trading card game singles in Australia. For privacy matters, contact us at [email protected].

CardYard is operated under ABN 88 317 126 236. Our website is https://cardyard.com.au and our contact email is [email protected].

2. What we collect

We collect personal information you provide, including:

• Account information: name, email address, password (hashed), and profile details.
• Transaction and account-service information: listings, purchases, bids, accepted and declined offers, trades, order history, refunds, disputes, promotion and coupon use, referral attribution and rewards, Pro subscription status, billing records and store settings.
• Payment information: Stripe processes card payments and saved payment methods. We do not store your full card number. We hold the payment, customer, subscription and payment-method identifiers Stripe provides to operate payments and associate saved methods with your account. Cash payout information for we-buy may also be provided directly to CardYard as described below.
• Delivery information: name and address for delivery.
• Usage information: pages visited, searches, and device information (collected via cookies and analytics).
• Store and public-content information: shop names, biographies, banners, logos, social links, category images, collection entries, visibility settings, "For Trade" and "For Sale" status, reviews, ratings and other content you submit.
• Images: uploaded photographs and other images, together with technical information needed to process and display them. Our image metadata handling is explained in section 9.
• Messages and support information: messages sent through CardYard, support requests and information supplied to resolve a transaction or complaint.
• Staff access information: staff invitations, staff account associations and permissions. Staff acting for a store may access that store's listings, orders and messages.
• Tracking information: carrier, tracking number, order identifier, tracking events and delivery status.
• Connected Shopify information: inventory and product records, linked order information and customer information needed to synchronise the connected store, including customer names, contact details and delivery information where included in the order.
• We-buy information: your name, contact and address details, bank account details needed for cash payout, submitted-card records, condition and authenticity assessments, valuation and offer records, acceptance records, payout choice, store-credit records and payment history. Information about submitted cards is personal information where it is linked to an identifiable person.

3. How we collect it

We collect personal information directly from you (when you register, list, buy, bid, or contact us) and automatically (through cookies and similar technologies when you use the site).

We also collect relevant information from other participants in a transaction, store owners who invite staff, Stripe, carrier-status information supplied through TrackingMore, and a seller's Shopify store when the seller enables the integration.

Shopify synchronisation may provide information about that store's customers even if those customers do not have a CardYard account.

For we-buy, we collect information from your submission and correspondence and create records when we inspect, assess, value and purchase your cards.

Where reasonable and practicable, we allow you to deal with us anonymously or using a pseudonym, for example when making a general enquiry. We may need identifying information to operate an account, complete a transaction, verify a payout or meet a legal obligation. If required information is not provided, we may be unable to provide the relevant service.

4. Why we collect, hold and use it

We collect, hold and use personal information to:

• provide and operate the marketplace (accounts, listings, transactions);
• process payments and payouts;
• provide sellers and buyers with information needed for seller-arranged delivery or local pickup, display tracking updates and resolve disputes;
• detect and prevent fraud, abuse and unlawful activity;
• improve the platform and personalise your experience;
• communicate with you (including transactional and, with your consent, marketing messages);
• comply with legal obligations (including record-keeping and tax);
• assess we-buy submissions, make purchase offers, verify ownership and authenticity where necessary, issue cash or store-credit payouts and maintain purchase records;
• administer Pro subscriptions, discounts, referral eligibility and rewards;
• provide collections, trade offers, storefronts and reviews in accordance with the visibility applicable to those features;
• enable owners to delegate store management to staff;
• synchronise authorised inventory and order data with connected Shopify stores;
• use delivery-status information to support payout release, subject to dispute and payment-provider controls.

5. Disclosure

We may disclose personal information to:

• Transaction participants: we provide buyers and sellers with information reasonably needed to complete their purchase, trade, delivery or pickup and handle related enquiries or disputes. For example, a seller receives the buyer's delivery name and address.
• Store owners and authorised staff: staff may access the store's listings, orders and messages within their available permissions. This can include customer contact details, delivery information and message content. Owners are responsible for granting and revoking staff access.
• Stripe: for payment processing, saved payment methods, subscriptions, connected-account payouts and fraud prevention. Stripe receives payment information through its payment interfaces and handles information under its own privacy policy.
• UploadThing: to host and deliver uploaded images after our server-side metadata-removal process described in section 9.
• TrackingMore: we send the tracking number, carrier and order identifier needed to register a supported tracked order and obtain delivery-status updates.
• Resend: to send transactional email, including the recipient's email address and the message content needed for account and transaction communications.
• Shopify and the connected seller's store: where an integration is enabled, we exchange the inventory, order and customer information needed for the authorised synchronisation. The seller and Shopify also handle information under their applicable privacy arrangements.
• Other operational providers: hosting, infrastructure, security and support providers that need information to provide their services to CardYard, subject to appropriate contractual and security arrangements.
• Advertising and analytics providers: as explained in sections 7 and 8.
• Law enforcement or regulators where required or authorised by law.

Public information

Storefront content, public collections, public listings, and published reviews and ratings are visible to other users and potentially to anyone on the internet. A review may be displayed with the account identity used for reviews. Public content may be indexed by search engines or copied by others.

A collection is disclosed publicly when its visibility is set to public. Marking cards "For Trade" or "For Sale" may also make that status visible where the relevant feature indicates that it will be displayed.

Making content private or removing it from CardYard does not necessarily remove copies, search-engine caches or records already lawfully held by others.

Referral links or codes and qualifying-sale records are used to attribute eligibility and rewards. We do not need to disclose a referred seller's customer details to a referrer merely to administer a reward.

6. Overseas handling

Some of our service providers, and their authorised subprocessors, may store or access personal information outside Australia. Overseas access may occur even where the main hosting location is in Australia.

Where we disclose personal information to an overseas recipient, we take the steps required by the Privacy Act 1988 (Cth), including reasonable steps required by APP 8 to ensure that the recipient does not breach the APPs in relation to that information, unless a lawful exception applies.

We do not treat your use of CardYard or acceptance of this policy as a general waiver of the protections applicable to overseas disclosure.

The countries in which recipients are likely to handle information, where practicable to identify, are:

• Stripe: United States;
• UploadThing: United States;
• TrackingMore: China;
• Resend: United States;
• Shopify: Canada;
• Google: United States;
• Meta: United States;
• TikTok: Singapore;
• Reddit: United States.

Contact [email protected] if you would like further information about our overseas handling arrangements.

7. Cookies and analytics

We use cookies and similar technologies for functionality, security and analytics. You can control cookies through your browser settings, though some features may not work without them.

8. Third-party advertising and analytics

With your consent, we use advertising and analytics pixels provided by Meta (Facebook), TikTok and Reddit. These pixels load only after you accept our cookie banner, and collect device and browsing information (such as pages visited, device identifiers and interactions) used for ad measurement, attribution and personalisation of advertising. That information may be processed by those providers under their own privacy policies, including outside Australia.

We use Google Tag Manager to manage and deploy website tags. Tag Manager is a deployment tool; the information collected depends on the tags enabled through it.

Our consent settings apply to advertising tags deployed through Tag Manager as well as tags installed directly. Meta, TikTok and Reddit advertising pixels must not load before you have given the consent described in this section.

Your consent is stored in a cookie on your device. You can decline these cookies in the banner when it first appears. To withdraw or change your consent at any time, use the "Cookie preferences" link in the site footer or clear cookies in your browser settings. Declining or withdrawing consent does not stop you using CardYard.

9. Storage and security

We store personal information on secure servers and take reasonable steps to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Uploaded images and location metadata

We process uploaded images server-side to remove EXIF, GPS and XMP metadata before the images are stored with our image-hosting provider or published. This is intended to remove embedded information such as camera details and location coordinates.

Removing embedded metadata does not remove information visible in the image itself. Faces, address labels, documents, reflections, landmarks and other visible details may still identify a person or location. Please check images carefully before uploading them.

Metadata removal is not a guarantee that an image is anonymous. It also does not remove copies previously published or stored elsewhere.

Where we have reasonable grounds to suspect an eligible data breach, we will carry out the assessment required by the Privacy Act. Where notification is required under the Notifiable Data Breaches scheme, we will notify the OAIC and affected individuals as required by law.

10. Access and correction

You may request access to, or correction of, the personal information we hold about you. Contact us at [email protected]. We will respond within a reasonable time, as required by the APPs.

11. Marketing and opting out

Where you have consented, we may send you marketing communications. You may opt out at any time using the unsubscribe link in the message or by contacting us.

12. Retention

We retain personal information only for as long as reasonably needed for the purposes described in this policy, including applicable legal record-keeping requirements and the establishment, exercise or defence of legal claims.

Retention depends on the type of record:

• account and store information is kept while needed to provide the account and address outstanding obligations;
• order, payment, subscription and we-buy purchase records are kept for applicable tax, accounting and other statutory record-keeping periods;
• we-buy submission images, condition and authenticity assessments, offers and acceptance records are kept while needed to complete the submission and address reasonably anticipated disputes or legal requirements;
• bank account details are retained only while needed for payouts, reconciliation, fraud prevention or a specific legal requirement;
• messages, tracking records and dispute material are kept while reasonably needed to administer the transaction and resolve related issues; and
• integration credentials are revoked or deleted when no longer needed after disconnection, while relevant transaction records may need to be retained separately.

Closing an account or disconnecting Shopify does not automatically erase records we must lawfully retain. It does not delete copies independently held by a seller, Shopify, a payment provider or another transaction participant.

When information is no longer needed and no law or court or tribunal order requires its retention, we take reasonable steps to destroy it or ensure that it is de-identified. Backup copies are removed through our backup-retention cycle and remain subject to security controls until removal.

13. Privacy complaints

If you have a privacy complaint, contact [email protected] with enough information for us to understand and investigate it. We may need to verify your identity before discussing account or transaction information.

We will acknowledge your complaint, investigate it and aim to provide a substantive response within 30 days. If more time is reasonably needed, we will explain why and provide an update.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner. Information is available at https://www.oaic.gov.au.

14. Changes

We may update this policy from time to time. The updated version will be posted with a revised date.

15. Contact

CardYard — [email protected].