Privacy policy

Controller

The controller of your account data is the provider of KartIO (details on the "Company details" page).

What we keep

Account: email, name, password (hashed only), language. Computers: an anonymous identifier (hash), the computer’s name and operating system, when it was last used. Subscription and payments: plan, status, amounts and invoices (card details are handled by Stripe only). What you sell: the country, platforms and categories you chose in the app. Connected selling accounts: if you connect eBay or Allegro to list from KartIO, we keep the access key that platform gives us, encrypted (never your password), until you disconnect the account. Usage: how many eBay price lookups you made per day (and, from earlier versions, how many KartIO Cloud AI reads you made; deleted automatically after 13 months at the latest). Security history: sign-ins, email codes, account changes, with IP address.

Backup of your work

Once a day, when something has changed, KartIO sends our server a backup of its database: your batches, cards, prices, your listings on each platform, sales, orders and settings, with a short summary of the day’s numbers (cards per status, game and set, listings, sales and income per platform and per month). It exists so you can restore your work after a lost computer or a damaged file. On your account page we show you the summary and the list of your cards from the newest backup; we open the backup only for that and do not use its contents for anything else.

What we do NOT keep

The photos of your cards and your buyers’ messages stay on your computer. Your passwords on the selling platforms never reach us.

Why (legal basis)

To provide the service you bought (contract), for our tax obligations (invoices), and for security and abuse prevention (legitimate interest). Website visit statistics load only with your consent.

Card recognition (AI)

The AI runs on your computer: for recognition, card photos are not sent to us or to any AI company. Earlier versions of KartIO offered KartIO Cloud AI (photos passed through our server to Anthropic (Claude) only for recognition, without being stored) and the use of your own AI key; both have been removed.

Who we share it with

Only those needed to run the service, as processors: MongoDB Atlas (database), Stripe (payments), Mailjet (email), eBay (price searches with no personal data; and, if you connect your account, your listings), Allegro (only if you connect your account, for your listings), Plausible (anonymous statistics, only with consent) and our server host. Some are outside the EU; transfers use the EU standard contractual clauses. We do not sell data.

How long

Your account as long as it exists. Security history 12 months, usage statistics 13 months. Backups: for each computer the 7 newest days and one day from each of the 4 weeks before (40 per account at most); they are deleted with the account. Invoices and payments as long as tax law requires, without your email after the account is deleted. When an account is deleted we keep only a hash of the email so a second free trial is not given.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. Write to the support email. You can also complain to the Hellenic Data Protection Authority (www.dpa.gr).

Cookies

See the Cookie policy.

Contact: info@kartio.net