Privacy Policy

Last updated: 1 February 2026

CardSync is an early-stage service currently operating in closed beta.

1. Who We Are

CardSync is an early-stage software project operated by an independent developer based in the Netherlands. The service is currently offered as part of a closed beta.

For any privacy-related questions or requests, contact us at: info@cardsync.eu

2. What Data We Collect

Account data

When you create an account, we collect:

• Your email address
• Your password (stored as a hash; we never have access to your plaintext password)

Order data (synced via the Chrome extension)

When you sync an order from Cardmarket, the extension reads the following data from the order page and sends it to our server:

• Cardmarket order ID
• Buyer username
• Buyer shipping address (name, street, house number, postal code, city, country)
• Buyer email address (if available on the order page)
• Shipping method and weight
• Insurance amount
• Order item details (card names, quantities, conditions, set names)
• Order totals (article value, shipping cost, total)

Tracking data

When you import tracking codes (from MyParcel or PostNL), we store the tracking code linked to the corresponding order.

Data we do NOT collect

• We do not collect your Cardmarket login credentials.
• We do not collect payment information or financial data.
• We do not collect browsing history or activity outside of Cardmarket order pages and shipping provider pages.
• The Chrome extension only activates on Cardmarket order pages, MyParcel, PostNL, and the CardSync dashboard.

3. Why We Process Your Data (Legal Basis)

Under the GDPR, we process your data on the following legal bases:

Data	Purpose	Legal basis
Email and password	Account creation and authentication	Performance of contract (Art. 6(1)(b) GDPR)
Order and shipping data	Providing the sync and export service	Performance of contract (Art. 6(1)(b) GDPR)
Buyer shipping addresses	Generating shipping provider CSV exports	Legitimate interest (Art. 6(1)(f) GDPR)

4. How We Use Your Data

We use your data solely to provide the CardSync service:

• Storing synced orders so you can manage them from the dashboard.
• Generating CSV files for import into shipping providers (MyParcel, PostNL).
• Matching tracking codes to orders.
• Sending password reset emails when you request them.

We do not use your data for advertising, profiling, or any purpose unrelated to the service.

5. Automatic Data Deletion (PII Purge)

When an order is marked as shipped, we automatically and permanently delete the following personal data from that order:

• Buyer name
• Shipping address (street, house number, postal code, city)
• Buyer email address

After this purge, only non-personal order metadata is retained (order ID, status, tracking code, shipped date, order totals). This data minimisation is built into CardSync by design.

6. Data Sharing

We do not sell, rent, or share your data with third parties for their own purposes. Your data is shared only with the following service providers, who act as data processors on our behalf:

Provider	Purpose	Location
Supabase	Database hosting and authentication	EU (Stockholm, Sweden)
Vercel	Web application hosting	Global (edge network), company based in US

Both providers are bound by their own data processing agreements and privacy policies.

When you export a CSV file and upload it to a shipping provider (MyParcel, PostNL), that transfer is initiated by you and governed by that provider's terms and privacy policy.

7. Data Storage and Security

• All data is transmitted over HTTPS (encrypted in transit).
• Passwords are hashed and never stored in plaintext.
• API access requires authentication via JWT tokens.
• User data is isolated: you can only access your own orders.
• The backend enforces rate limiting and security headers.

8. Data Retention

Personal data is retained only as long as necessary to provide the service during the beta period and may be deleted at any time.

Data	Retention period
Account data (email)	Until you delete your account
Order data (unshipped)	Until the order is shipped or you delete it
Order data (shipped)	Non-personal metadata retained indefinitely; PII is purged automatically on shipment

9. Your Rights Under GDPR

As a data subject in the EU, you have the following rights:

• Access: You can request a copy of the personal data we hold about you.
• Rectification: You can ask us to correct inaccurate data.
• Erasure: You can request deletion of your account and all associated data.
• Restriction: You can ask us to restrict processing of your data.
• Data portability: You can request your data in a structured, machine-readable format.
• Objection: You can object to processing based on legitimate interest.

To exercise any of these rights, email us at info@cardsync.eu. We will respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

10. Chrome Extension Permissions

The CardSync Chrome extension requests the following permissions:

Permission	Why
Access to Cardmarket order pages	To read order data for syncing
Access to MyParcel and PostNL pages	To import tracking codes
Access to CardSync dashboard	To sync your login session between the dashboard and extension
Storage	To store your authentication session locally

The extension does not access any other websites or collect any data outside of these specific pages.

11. Cookies

CardSync uses only functional cookies and local storage for authentication purposes (keeping you signed in). We do not use tracking cookies, analytics cookies, or any third-party advertising cookies.

12. Children

CardSync is not intended for use by anyone under the age of 16. We do not knowingly collect data from children.

13. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes via email or through the dashboard. The "last updated" date at the top of this page indicates when the policy was last revised.