Privacy Policy

1. Scope and who is responsible

This Privacy Policy explains how SwapSlabs collects, uses, shares, and protects personal information when you use the SwapSlabs marketplace to swap, sell, and buy collectible trading cards, and when you visit its website. It is part of, and incorporated into, the Terms of Service.

SwapSlabs is the controller (and, under US state law, the “business”) responsible for the personal information described here. Some activities rely on providers that act as processors or service providers on SwapSlabs's instructions (for example Supabase for authentication, database, and file storage; Netlify for hosting; Resend for email). Others involve independent controllers with their own privacy terms (for example Stripe for payments, Stripe Identity for identity verification, and the shipping carrier that delivers a card). Sections 5, 10, and 11 identify which is which.

[PLACEHOLDER — confirm the controlling legal entity, its jurisdiction, and whether a data-protection officer or an EU/UK Article 27 representative must be named, with counsel before launch.]

2. Information you provide

You give SwapSlabs information directly when you create an account and use the marketplace:

• •Account identity — your email address and a password. Passwords are handled and stored, hashed, by Supabase Auth; SwapSlabs never sees your plaintext password.
• •Profile — display name, general location, and an optional avatar image, plus anything else you add to your public profile.
• •Listings and photos — the card details you enter (category, player or game, set, year, grading company and grade, condition notes), any certification number you enter or scan, your asking price, and photos of the actual card.
• •Swap and transaction data — the offers you make and accept, the cash top-ups, and the confirmations you submit.
• •Messages — the content of messages you exchange with other members about a listing or a past deal.
• •Ratings and reviews — the star scores and written text you submit, and any reply you post to a review you received.
• •Support and dispute correspondence — what you send when you contact support or open a dispute, including evidence you upload such as dated photos of the packaging and the card as received, tracking screenshots, and grading or authentication records.
• •Shipping details — the name and postal address a card is shipped to or from, and your packaging, carrier, and service-level choices.
• •Payout details — information you provide to Stripe to receive seller payouts (handled by Stripe; see Section 5).

3. Information collected automatically

When you use SwapSlabs it automatically collects limited device and usage data: your IP address, approximate location derived from it, browser and device type and settings (user-agent), referring and exit pages, the pages and actions you take within the app, search terms, and timestamps. SwapSlabs records the IP address and user-agent captured when you accept the Terms as part of the acceptance audit log.

SwapSlabs uses strictly necessary cookies and similar local storage to run the service — primarily to keep you signed in (session cookies set through Supabase's cookie-based auth) and to protect against abuse — and privacy-conscious first-party analytics to understand how features are used. SwapSlabs does not use advertising cookies and does not track you across other websites. See the Cookie Policy at /cookies for the full list and how to control it.

4. Payment and card-on-file data

All payment card processing is handled by Stripe. Your full card number, expiration, and security code are entered directly into Stripe's fields and are tokenized by Stripe; they never touch SwapSlabs servers and SwapSlabs cannot see them.

From Stripe, SwapSlabs receives and stores only what it needs to show you which card is on file and to charge amounts you have authorized: the card brand, last four digits, and expiration month and year, together with Stripe customer and payment-method identifiers, and the status and amount of charges, refunds, payouts, and disputes.

Stripe processes this data as an independent controller under its own privacy policy, and also provides payouts, Stripe Connect, and fraud screening (Stripe Radar) for SwapSlabs. [PLACEHOLDER — link the current Stripe privacy policy URL before launch.]

5. Identity verification data

Listing a card valued over $1,000, or completing any transaction — a sale or a swap — valued at more than $1,000, requires the parties involved to complete identity verification first. Verification is also used for higher-volume selling and elevated identity tiers. It is performed by a third-party identity provider (Stripe Identity): you submit a government-issued photo ID (driver's license or passport) and a live selfie for face-matching directly to that provider.

SwapSlabs receives and stores only a reference to the verification session, its result (for example verified, pending, or failed), and the identity tier it unlocks. SwapSlabs does not receive or store the image of your ID document or the biometric face data — those are handled by the verification provider under its own terms and retention rules.

[PLACEHOLDER — confirm the biometric-verification consent flow, regional availability, BIPA and other state-law notice and retention requirements, and any GDPR Article 9 basis with counsel for each launch jurisdiction.]

6. Information from other sources

SwapSlabs also receives information about you from sources other than you:

• •Grading companies — when you enter or scan a certification number, the grading company's public cert-verification database returns card details (player or name, set, year, grade, population count) and a match result, which SwapSlabs stores on the listing for auditability.
• •Stripe — the identity-verification result and reference (Section 5), fraud signals from Stripe Radar, and the status of payments, payouts, and disputes (Section 4).
• •Shipping carriers and label partners — tracking scans and delivery events for shipments on your transactions.
• •The other party to a trade — the shipping name and address they provide so a card can reach you, and the confirmations and evidence they submit in a shared transaction or dispute.
• •Service providers and public sources — security and anti-fraud vendors, and public records where needed to investigate fraud, safety, or legal matters.

7. How we use information, and the legal bases

SwapSlabs uses personal information to operate and improve the marketplace. Where the EU/UK GDPR applies, the legal basis for each purpose is noted in brackets.

• •Operate the marketplace — create and secure your account, publish listings and photos, run browse and search, build swap proposals, run checkout, and deliver messaging. [Contract]
• •Value cards — compute estimated values and each side of a proposed swap from realized comparable sales, run cert lookups, and show realized prices to members who have a card on file. [Contract; legitimate interests]
• •Process payments, taxes, and payouts — charge commission-inclusive totals and itemized processing, charge shipping, packaging, and signature fees, calculate and remit tax where required, track what sellers are owed, and pay sellers out through Stripe. [Contract; legal obligation]
• •Operate the 100% Guarantee — review disputes on the evidence and, where a party is found on the balance of the evidence to have defaulted, charge that party's card on file and reimburse the wronged member; in counterfeit or knowing-misrepresentation cases, also suspend the account and refer the matter to law-enforcement authorities. [Contract; legitimate interests; legal obligation]
• •Verify identity — apply the over-$1,000 and elevated-tier verification gate. [Contract; legal obligation; consent where required for biometric processing]
• •Arrange shipping — generate carrier labels and QR codes and share the sender's and recipient's name and address with the other trade party and the carrier so a card can be delivered and tracked. [Contract]
• •Protect the platform — detect and prevent fraud, rating manipulation, coordinated abuse, account takeover, and Terms violations, and enforce identity tiers. [Legitimate interests; legal obligation]
• •Provide support and resolve disputes — respond to your requests and administer dispute outcomes. [Contract; legitimate interests]
• •Communicate with you — send transactional email about your account, transactions, shipments, disputes, and material changes to the legal terms; send marketing email only if you opt in, always with an unsubscribe link. [Contract; consent; legitimate interests]
• •Comply with law — meet tax, accounting, marketplace-facilitator, and anti-fraud obligations and respond to lawful requests. [Legal obligation]
• •Improve the product — analyze aggregated and de-identified usage to fix problems and prioritize features. [Legitimate interests]

8. Cookies and tracking

SwapSlabs relies on strictly necessary cookies and local storage to keep you signed in and to guard against abuse; blocking these will prevent you from logging in or transacting. It additionally uses limited first-party analytics storage to measure and improve the product. SwapSlabs does not set third-party advertising cookies, does not sell or share personal information for cross-context behavioral advertising, and does not track you across other websites.

You can control cookies through your browser settings, and where local law requires a consent mechanism for non-essential cookies SwapSlabs will present one. Full details, including each category and how to opt out of analytics, are in the Cookie Policy at /cookies. [PLACEHOLDER — confirm the cookie-consent approach and any Global Privacy Control (GPC) handling for your launch regions with counsel.]

9. How long we keep information

SwapSlabs keeps personal information for as long as your account is active and you can use the marketplace, and then only as long as needed for the purposes it was collected for.

After you close your account, SwapSlabs deletes or de-identifies personal information within a defined period, except where a longer period is required: transaction, payout, refund, tax, and fee records, and dispute and 100% Guarantee records, are retained for tax, accounting, fraud-prevention, and legal-defense purposes; audit logs such as the terms-acceptance log are retained longer as an integrity record; and backups age out on their own cycle. [PLACEHOLDER — state the specific post-closure retention period or periods once confirmed with counsel and your tax advisers.]

Content you shared publicly or with another member — for example a rating you left, or messages in a shared thread — may remain visible to that member or the community after your account closes.

10. How we share information

SwapSlabs does not sell your personal information and does not share it for cross-context behavioral advertising. It shares information only in these ways:

• •The other party to your trade — when a sale or swap is agreed, that member receives your display name, the transaction and value details, and the shipping name and address needed to send the card. Share only what you are comfortable another member seeing.
• •Stripe — for card-on-file setup, payments, itemized processing, payouts, Stripe Connect, fraud screening (Radar), and, through Stripe Identity, identity verification.
• •Shipping carriers and label or logistics partners (for example UPS, FedEx, USPS, and a label aggregator) — sender and recipient name and address, package dimensions and weight, service level, and declared-value and insurance details, to generate labels and provide tracking.
• •Grading companies — the certification number you enter or scan, sent to the grading company's public verification lookup to confirm a card and pull back its details.
• •Supabase — SwapSlabs's database, authentication, and file-storage provider, acting as a processor on SwapSlabs's instructions.
• •Netlify — SwapSlabs's website hosting provider.
• •Resend — SwapSlabs's email delivery provider, for transactional email and, if you opted in, marketing email.
• •Analytics provider — to deliver privacy-conscious first-party product analytics, in aggregated or de-identified form where feasible.
• •Internal moderators and dispute resolvers — SwapSlabs personnel who review reports, ratings, and disputes.
• •Advisors and authorities — auditors, accountants, and lawyers; and law enforcement, regulators, or courts where SwapSlabs is legally required to disclose, needs to enforce the Terms, or must protect the rights, property, or safety of members or the public.
• •A successor — an acquirer or successor in a merger, acquisition, financing, or sale of assets, subject to this Policy.

11. Third-party processors

SwapSlabs relies on a short list of service providers, each bound by a contract that limits their use of personal information to providing their service to SwapSlabs:

• •Stripe — payments, card-on-file tokenization, payouts, Stripe Connect, fraud screening, and identity verification (Stripe Identity). United States. Acts as an independent controller for payments and identity.
• •Supabase — authentication, PostgreSQL database, and file storage (listing photos, avatars, dispute evidence). Processor.
• •Netlify — web application hosting and content delivery. Processor.
• •Resend — transactional and opt-in marketing email delivery. Processor.
• •Grading companies (PSA at launch; BGS, SGC, CGC, TAG to follow) — certification-number verification lookups. Independent controller for their lookup service.
• •Shipping carriers and a label aggregator — label generation and package tracking. Independent controllers for delivery.
• •Product analytics provider — privacy-conscious first-party usage analytics. Processor.
• •[PLACEHOLDER — confirm the analytics provider, the label aggregator, and any additional sub-processors, and publish links to each provider's privacy notice and a data-processing addendum, before launch.]

12. Security

SwapSlabs uses technical and organizational measures to protect personal information, including encryption in transit (TLS), database row-level security so members can reach only the records they are entitled to, tokenization of payment cards by Stripe so card numbers never reach SwapSlabs servers, least-privilege access controls for staff, and an append-only audit log for terms acceptance and Guarantee actions.

No method of transmission or storage is completely secure. Use a strong, unique password, keep your payment card on file current, and tell SwapSlabs promptly if you believe your account has been accessed without your permission. Where the law requires it, SwapSlabs will notify affected users and regulators of a data breach.

13. International data transfers

SwapSlabs is operated from the United States, and personal information is processed there and in the locations where its service providers operate. If you use SwapSlabs from outside the United States, your information will be transferred to and processed in the United States, which may not offer the same level of data protection as your home country.

Where required for transfers from the EEA, the UK, or Switzerland, SwapSlabs relies on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK Addendum, together with supplementary measures. [PLACEHOLDER — confirm the specific transfer mechanism(s) and any Data Privacy Framework participation with counsel.]

14. Children

SwapSlabs is for adults. It is not directed to anyone under 18, or the higher age of majority where you live, and SwapSlabs does not knowingly collect personal information from anyone under that age. If you believe someone under 18 has provided personal information, contact SwapSlabs and it will be deleted.

15. Your privacy rights

Depending on where you live, you may have the right to access the personal information SwapSlabs holds about you, to correct inaccurate information, to delete it, to receive a portable copy, and to object to or restrict certain processing. SwapSlabs will not discriminate or retaliate against you for exercising these rights.

You can edit your profile data in your account settings and close your account at any time. SwapSlabs may need to verify your identity before acting on a request, and may decline or partially fulfill a request where the law requires or permits it to keep certain information — for example completed-transaction, tax, and dispute records, or where deletion would undermine fraud prevention or an active legal matter. You can opt out of marketing email at any time; transactional messages about your account and trades cannot be turned off while your account is open.

16. US state privacy rights (California and other states)

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). SwapSlabs has not sold or shared personal information in the preceding 12 months and does not knowingly sell or share the personal information of anyone under 16.

If you are a California resident, you have the right to know and access the categories and specific pieces of personal information collected, the sources, the business or commercial purposes, and the categories of recipients; to request correction of inaccurate personal information; to request deletion, subject to legal exceptions; and to opt out of any “sale” or “share” (SwapSlabs does neither) and to limit the use of sensitive personal information (SwapSlabs uses identity-verification data and precise identifiers only to provide the service, secure it, and comply with law, which does not require a separate limit-use right, but you may still contact SwapSlabs). SwapSlabs honors an opt-out preference signal such as Global Privacy Control where required.

The categories of personal information SwapSlabs collects map to the CCPA categories: identifiers (email, IP, account and device identifiers); customer records (name, shipping address); commercial information (transactions, listings); internet and network activity (usage, search); geolocation (approximate, from IP); visual information (card and evidence photos, avatar); and, through the verification provider, government identifiers and — handled by that provider, not stored by SwapSlabs — biometric information. Sensitive personal information is limited to account credentials, the over-$1,000 identity-verification result and reference, and precise identifiers used for security.

You may submit a request by emailing the address in Section 20 or through your account settings. You may use an authorized agent, who must provide proof of authorization and whose authority SwapSlabs may verify with you directly. SwapSlabs will acknowledge a request within the statutory timeframe and, if it denies a request, you may appeal by replying to the decision; SwapSlabs will respond to the appeal within the time the law allows.

Residents of other US states with comprehensive privacy laws (for example Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and Montana) have similar rights to access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and certain profiling. SwapSlabs extends the request and appeal process above to all such residents. [PLACEHOLDER — confirm the state-by-state disclosures, the “shine the light” notice, and any required metrics reporting with counsel.]

17. EEA, UK, and Switzerland (GDPR)

If you are in the EEA, the UK, or Switzerland, SwapSlabs processes your personal information on the legal bases identified in Section 7. In addition to the rights in Section 15, you have the right to withdraw consent at any time (without affecting prior processing), to object to processing based on legitimate interests, and to lodge a complaint with your local supervisory authority.

SwapSlabs does not use solely automated decision-making that produces legal or similarly significant effects about you; dispute outcomes and Guarantee charges involve human review. [PLACEHOLDER — name the EU/UK representative or DPO and the lead supervisory authority, if required, before launch.]

18. Changes to this Policy

SwapSlabs may update this Policy. Every legal document on SwapSlabs shares a single date-based version; when a change is material SwapSlabs publishes a new version, updates the last-updated date, and — through the mechanism in the Terms — prompts you to review and re-accept the current legal terms. Non-material fixes may not trigger a new version.

19. How to exercise your rights

To make an access, correction, deletion, portability, objection, or opt-out request, email the address in Section 20 with the email on your account and a description of your request, or use the controls in your account settings. SwapSlabs will verify your identity in proportion to the sensitivity of the request, respond within the timeframe the applicable law requires, and tell you if it needs an extension or must decline part of the request and why.

20. Contact

Privacy questions and rights requests: privacy@swapslabs.example. General support: support@swapslabs.example.

[PLACEHOLDER — add the legal entity name, postal address, and any required data-protection officer or EU/UK representative contact before launch.]