PRIVACY POLICY
Effective: May 29, 2026 · Last updated: August 26, 2026
⚠ Template content — requires legal review before public registration opens. This policy is structured to support GDPR (EU/UK), CCPA (California), and general U.S. privacy expectations, but should be reviewed by qualified counsel before binding new users.
1. INTRODUCTION
This Privacy Policy describes how Leumas Card Craze LLC ("we", "us", "our") collects, uses, stores, and shares personal data when you use the service available at inventory.leumascc.com (the "Service") or visit our website. It applies to all visitors, waitlist subscribers, and registered users.
We are the data controller for the personal data described in this Policy. For privacy questions or to exercise your rights, contact support@leumascc.com.
2. INFORMATION WE COLLECT
| Category | Examples | Source |
|---|
| Account identity | Email address, display name, password hash | You, at registration |
| Profile | Return shipping address, ship-from address, eBay seller username | You, in Account Settings |
| eBay account data | OAuth refresh token (encrypted), seller ID, internal eBay user ID, listing data, order data, fees | eBay APIs after you Connect |
| TCGplayer data | Your order records (including the buyer's name and the cards, quantities and amounts on each order), your listing and pricing data | You, via file upload — or, if you install it, the Leumas TCG Sync browser extension reading your own TCGplayer seller account (see 2.2) |
| ManaPool / CardTrader data | Your order records, listing and pricing data | Their APIs, after you connect the account |
| Business data | Inventory, combine lists, lot tracking, expenses, picklist, audit logs | You, via the Service |
| Operational telemetry | Session timestamps, last login, last token refresh, error logs (no PII content) | Automatically |
| Usage analytics | Anonymized page views and in-app actions (no names, emails, card titles, or dollar amounts) | Google Analytics (GA4) — only after you accept analytics cookies |
| Waitlist | Email address only | You, at landing-page signup |
2.1 What we don't collect
- We use only privacy-first, consent-gated analytics (see Section 10) — no analytics run at all unless you accept cookies, and we never send personal data to our analytics provider.
- We do not use advertising trackers or cross-site/behavioral advertising cookies.
- We do not collect device fingerprinting data beyond what your browser sends in normal HTTP requests.
- We do not access your eBay messages, buyer personal data beyond what's required for order fulfillment, or other sellers' data.
2.2 The Leumas TCG Sync browser extension
TCGplayer provides no seller API, so keeping your Leumas inventory in step with your TCGplayer store requires an optional Chrome extension that works inside your own browser. It is not installed by default, and the Service works without it.
- It uses your existing TCGplayer session. It never asks for, stores, or transmits your TCGplayer password. It acts only on your own seller account, and only on your own orders and listings — it does not browse the TCGplayer catalogue and it cannot see any other seller's data.
- What it sends to us. Your own TCGplayer order records, so your Leumas inventory can be updated when something sells. These include the buyer's name, because TCGplayer puts it on the order. The extension does not send us the buyer's shipping address or contact details.
- What it stores on your computer. The shape of the requests it learned from your own manual actions, small settings, and — if you switch on automatic sync — a pairing token that authorises syncing your Leumas account and nothing else. You can remove a paired computer at any time from inside Leumas Live, which stops it immediately.
- Shared request patterns. Since version 0.19.0 the extension may also send us the structure of a TCGplayer request it learned (the address it calls, the method, and the names of its fields), so that other Leumas sellers can sync without teaching it by hand. Before anything is sent, your seller key, order numbers, tracking numbers and any value that could identify a person, address or account are removed, and nothing is sent if that cannot be done; no captured values, passwords or credentials are ever included.
- Automatic sync is off unless you turn it on. By default the extension acts only when you click. If you enable automatic sync, it checks your orders on a timer (roughly every ten minutes) while your browser is running, and sends any new ones to your Leumas account. You can switch it off at any time.
Order data that reaches us through the extension is treated exactly like order data that reaches us any other way: it is Your Data, it is stored under your account only, and it is never sold or used to build a profile of you or of your buyers.
3. HOW WE USE YOUR DATA
- Provide the Service — sync your listings, process orders, render dashboards, generate shipping labels.
- Account communication — notify you about Service changes, security events, scheduled maintenance, and (for waitlist subscribers) when public registration opens.
- Security & abuse prevention — detect unusual login patterns, enforce rate limits, investigate breaches.
- Service improvement — aggregated, anonymized usage patterns may inform feature priorities. Individual data is never combined across tenants.
- Legal compliance — respond to lawful requests, enforce our Terms, and protect our rights.
We do not sell your personal data. We do not share Your Data with other tenants. We do not use Your Data to train AI models.
4. LEGAL BASIS (GDPR)
For users in the EU/UK, we process personal data under the following legal bases:
- Contract performance — providing the Service you signed up for.
- Legitimate interest — security, fraud prevention, Service improvement.
- Consent — waitlist email subscription, optional features.
- Legal obligation — tax records, regulatory compliance.
5. DATA SHARING
We share personal data only with the following categories of recipients:
- Infrastructure providers processing data on our behalf:
- Supabase (database hosting, authentication, edge functions) — based in the United States; SOC 2 Type 2 certified.
- Netlify (static hosting + CDN) — based in the United States.
- Cloudflare, Inc. (Turnstile bot protection on sign-up forms) — based in the United States.
- Google LLC (Google Analytics / GA4, anonymized usage measurement, consent-gated — no personal data sent) — based in the United States.
- Stripe, Inc. (payment processing — applies only once paid billing is enabled) — based in the United States.
- Marketplace partners at your direction — eBay, ManaPool and CardTrader (when you connect each account), and TCGplayer (when you upload an export, or through the optional browser extension described in 2.2, which acts in your own logged-in TCGplayer session).
- Email provider — Microsoft Outlook (operator's business inbox).
- Legal recipients — law enforcement, regulators, or courts when required by valid legal process.
- Successors — in connection with a merger, acquisition, or sale of assets, subject to confidentiality protections.
All third-party processors operate under data-processing agreements that restrict their use of Your Data to providing services to us.
6. DATA STORAGE & SECURITY
- Encryption in transit — all connections use TLS 1.2+ (HTTPS).
- Encryption at rest — Supabase Postgres encrypts disk-level. eBay OAuth refresh tokens are additionally encrypted at the column level using
pgcrypto with a master key stored in Supabase Vault (pgsodium-backed).
- Row-level security — every business table enforces a Postgres row-level security policy (
user_id = auth.uid()) at the database layer. Application code cannot bypass tenant isolation; the database refuses cross-tenant access regardless of bugs.
- Access controls — service-role credentials are restricted to backend Edge Functions; never exposed to client browsers.
- Audit trail — destructive operations are logged with batch_id and revert paths.
7. DATA RETENTION
| Data | Retention |
|---|
| Active account data | Retained while your account is active. |
| Account terminated | 30 days after termination, then permanently deleted. |
| Waitlist email | Retained until public registration opens or you unsubscribe. |
| Operational logs | 90 days, then aggregated/anonymized. |
| Backups | Up to 90 days following deletion, then purged. |
| Records required by law | As required by applicable law (typically 7 years for financial records). |
8. YOUR RIGHTS
8.1 Universal rights
- Access — request a copy of personal data we hold about you.
- Correction — update inaccurate information via Account Settings or by emailing us.
- Deletion — request permanent removal of your account and data.
- Export / portability — download Your Data in CSV format at any time via the Service's export tools.
- Restriction — request we suspend processing while we investigate a dispute.
- Objection — object to processing based on legitimate interest.
- Withdraw consent — disconnect eBay, unsubscribe from waitlist, or close your account at any time.
8.2 California (CCPA / CPRA) rights
California residents have additional rights to know what categories of personal data we collect, sources, business purposes, and recipients (all disclosed above). California residents may also opt out of "sale" or "sharing" of personal data — though we do not sell or share personal data for cross-context behavioral advertising.
8.3 How to exercise
Email support@leumascc.com with the request and the email address on your account. We will respond within 30 days. We may require identity verification before fulfilling deletion or export requests.
9. INTERNATIONAL TRANSFERS
Our infrastructure is located in the United States. If you access the Service from outside the U.S., your data will be transferred to and processed in the U.S. We rely on Standard Contractual Clauses (or equivalent transfer mechanisms) for EU/UK data transfers.
10. COOKIES & ANALYTICS
The Service uses session storage (sessionStorage) and local storage (localStorage) in your browser to store your auth token, user preferences (e.g., onboarding state, feature flags), and OAuth state. These are essential for the Service to function and are not used for tracking.
We also use Google Analytics (GA4) to understand aggregate, anonymized usage. Analytics runs with Google Consent Mode set to DENIED by default — nothing is sent to Google until you click Accept on our cookie banner. You can decline, change your choice at any time via the "Cookie settings" link, or block cookies in your browser. We do not send personal data (names, emails, card titles, or dollar amounts) to our analytics provider, and we do not use advertising or cross-site behavioral cookies.
11. CHILDREN
The Service is not directed to children under 18. We do not knowingly collect personal data from minors. If you believe a child has provided personal data, contact us at support@leumascc.com and we will delete the data promptly.
12. DATA BREACH NOTIFICATION
If we become aware of a breach of personal data that creates a high risk to your rights and freedoms, we will notify affected users without undue delay (and within 72 hours where required by law) by email and via in-Service notification. Notifications will describe the nature of the breach, likely consequences, mitigations taken, and contact information for further questions.
13. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users at least 14 days before taking effect. The "Last updated" date above reflects the most recent revision.
We also record what changed, so you do not have to compare versions yourself:
13.1 Revision history
- August 26, 2026 — Added section 2.2 describing the optional Leumas TCG Sync browser extension, and corrected the data table, which had described TCGplayer order data as "manually uploaded". That was inaccurate: since June 2026 the extension has been able to read your own TCGplayer orders directly from your logged-in session, and those records include the buyer's name. This corrects how we described something we were already doing — it does not change what we do. We also named ManaPool and CardTrader as data sources, which had been omitted. Finally, we documented the optional automatic-sync feature before releasing it, so that when you are offered it the disclosure is already in front of you: it is off by default, you choose whether to switch it on, and you can stop it at any time by removing a paired computer.
14. CONTACT
Privacy questions, requests, or complaints: support@leumascc.com.
EU/UK residents may also lodge a complaint with their national data protection authority.
Mailing address available upon request.
Leumas Card Craze LLC · Sioux Falls, South Dakota, United States
← Back to home