Last updated: August 2026.
CollectionCardsClub ("we", "Service") respects your privacy. This Policy explains what data
we collect, why, how we use it and your rights as a data subject under Brazil's General Data
Protection Law (LGPD, Law 13.709/2018) and applicable international standards.
1. CONTROLLER AND DPO
Controller: CollectionCardsClub — independent project.
Data Protection Officer: legal@collectioncardsclub.com
2. DATA WE COLLECT
a) On sign-up: name, email, password (stored with bcrypt hashing, never in clear text).
b) Profile: nickname, avatar, country (optional).
c) Service use: cataloged collection, minigame results, scores, referrals.
d) Technical: IP address, browser type, timestamps — for security and diagnostics.
e) Scanned photos: processed by AI (Gemini Vision) for identification. We do NOT store the
original image — only the extracted metadata (name, number, set, HP, attacks, illustrator).
3. LEGAL BASES (LGPD Art. 7 / GDPR Art. 6)
- Contract performance: core features like login and cataloging.
- Legitimate interest: security, anti-fraud, scanner cheat prevention.
- Consent: non-essential cookies, marketing emails, use by minors aged 10-12.
4. MINORS
Users aged 10-12 need parental consent. We collect only the minimum necessary for Service
operation. We do not perform behavioral profiling of minors nor send them targeted advertising.
5. THIRD-PARTY INTEGRATIONS
- Google OAuth: if you choose Google login, we receive your name, email, and public profile picture.
- pokemontcg.io: queried only with extracted metadata, no personal data.
- Resend (email delivery): used exclusively for replying to contact form submissions.
- Emergent LLM Key (Gemini): processes the image during scan; no persistence beyond the
provider's own policy.
6. SHARING
We do not sell or rent your data. We may share aggregate/anonymous data for statistical
purposes. Individual data is shared only for: (a) legal obligation; (b) court order; (c)
protecting Service rights in fraud scenarios.
7. RETENTION
- Active account: as long as you use the Service.
- After deletion: data is erased within 30 days, except information needed for legal
compliance (LGPD Art. 16) or defense in proceedings.
8. SECURITY
We use: HTTPS/TLS in transit, bcrypt-hashed passwords, rotating session tokens, rate limiting
on sensitive endpoints, offensive-language filtering, and fraud attempt monitoring. No system
is 100% secure; report incidents immediately to legal@collectioncardsclub.com.
9. YOUR RIGHTS
You may request at any time via email:
- Confirmation that we process your data
- Access to your data
- Correction of incomplete or incorrect data
- Anonymization, blocking or erasure of unnecessary data
- Portability to another provider
- Deletion of consent-based data
- Information about who we share data with
- Withdrawal of consent
- Objection to legitimate-interest processing
Response time: up to 15 calendar days.
10. COOKIES AND SIMILAR
We use strictly necessary cookies (login, language preference, theme). No third-party
advertising cookies. You may clear cookies in your browser settings.
11. INTERNATIONAL TRANSFERS
Some providers (Google, Emergent) process data outside Brazil. We ensure they have adequate
protections and contractual clauses preserving your LGPD rights.
12. CHANGES
We may update this Policy. Material changes will be notified via email and/or in-app notice
at least 15 days in advance.
DPO contact: legal@collectioncardsclub.com
We use strictly necessary cookies for basic functionality (login, language, theme). By continuing you agree to our Terms of Service and Privacy Policy.