Cardlivo Privacy Policy

Last updated: October 5, 2026

Your privacy matters to us. This policy explains what information Cardlivo collects when you use our Pokémon card cataloging and pricing service, how we use and share it, how long we keep it, and the rights you have over it under the UK GDPR, EU GDPR, the California Consumer Privacy Act (CCPA/CPRA), and other applicable laws.

Information We Collect

We do not use tracking cookies, tracking pixels, or analytics scripts of any kind - see "Cookies" below. The only usage figures we keep are anonymous counts of visits to our home page and of how often our guided tour is started and finished - see "Visit and tour counts" below.

How We Use Your Information

Lawful Basis for Processing (UK / EU GDPR)

For users in the United Kingdom and European Economic Area, we rely on the following lawful bases under Article 6 of the UK and EU GDPR:

We currently have no processing that relies on consent as its lawful basis, since we don't track individuals or run advertising of any kind.

Who We Share Data With

We do not sell your personal data, and we do not use it for advertising. We share information only with the following, strictly to provide the service:

We may also disclose information where required by law, in response to a lawful request from a public authority, or where necessary to protect our rights, users, or the public.

Correction Photos and the Reference Index

Cardlivo identifies cards by comparing your photos against a shared reference index of card images. If a match comes back wrong and you submit a correction, that photo is not applied automatically - it's queued for a human moderator to review. If approved, the photo becomes part of the reference index used to match cards for every Cardlivo user going forward, not just your own account. We do not use your scanned or correction photos to train third-party AI models, and we do not use them in marketing or promotional materials without asking you first. If you'd rather not contribute a photo to the shared index, simply don't submit a correction for it.

Data Retention

Data Storage and Security

We use encryption in transit for all traffic to Cardlivo, and apply reasonable technical and organizational measures - access controls, hashed passwords, and secure session cookies - to protect your data against unauthorized access, loss, or disclosure. No system is completely secure, but we take this seriously as a small team handling real people's accounts and photos.

Visit and tour counts

When someone opens our home page, we count the visit anonymously so we can see how many people find Cardlivo and how: whether this browser has visited before, and the kind of website the visitor came from (for example a search engine, eBay or social media) - worked out from that website's name only, never the page you were on or what you searched for. The count holds no name, account, IP address or browser identifier, so it can't be linked to you.

When someone uses Take a Tour, we count it anonymously so we can see how many people take the tour and where it could be clearer: that a tour was opened (and from which button), started, finished or left part-way (with the chapter and step), and whether the visitor was logged in. These counts hold no name, account, IP address or browser identifier, so they can't be linked to you. Your browser also keeps a small note on your own device (not a cookie, and never sent to us) that you've opened the tour before, so a repeat visit isn't counted as a new one (the same goes for home page visits); clearing your browser data removes it.

Cookies

Cardlivo uses exactly one cookie: a session cookie that keeps you logged in. It's marked HttpOnly (inaccessible to page scripts) and Secure in production, expires after 30 days, and is strictly necessary for the service to work - without it, you'd have to log in on every page. We don't use analytics cookies, advertising cookies, or any third-party tracking scripts. Because this cookie is strictly necessary rather than optional, no cookie consent banner is required or shown.

If you complete a payment, Stripe's own checkout page may set its own cookies on stripe.com - that's covered by Stripe's privacy policy, not this one, since Stripe is a separate, independent service at that point.

Your Rights (UK and EU)

If you are in the UK or EEA, you have the following rights under the UK and EU GDPR:

To exercise any of these rights, email us at the address below. We aim to respond within 30 days.

California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the CPRA. In the preceding 12 months, we have collected identifiers (such as your email address), commercial information (subscription and billing data), and the account/listing details described above.

We do not sell personal information for money, and we do not share it for cross-context behavioral advertising. You have the right to:

To exercise any of these rights, email us at the address below. We aim to respond within 45 days.

Children's Privacy

Cardlivo accounts require you to be at least 18 years old - Cardlivo is a paid subscription service, and 18 is the age at which you can legally enter into that agreement yourself. We do not knowingly collect personal information from anyone under 18, and if we learn that we have, we will delete it promptly.

Changes to This Policy

We may update this policy from time to time. For material changes, we'll provide at least 30 days' notice by email before they take effect. The "Last updated" date above reflects the most recent version.

Contact Us

For privacy questions or to exercise any of the rights described above, email us at support@cardlivo.com.