Privacy Policy

Last updated: December 11, 2025

Introduction

CTCGX ("CTCGX", "we", "us", or "our") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our trading card marketplace platform and services.

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, including British Columbia's Personal Information Protection Act (PIPA).

Information We Collect

Account Information

When you create an account through OAuth providers (Google, Microsoft, LinkedIn, or Discord), we collect:

  • Email address
  • Full name
  • Profile picture (if provided by the OAuth provider)
  • OAuth provider identifier

Seller Information

If you register as a seller, additional information is collected through Stripe Connect:

  • Legal name and business name (if applicable)
  • Business address
  • Phone number
  • Date of birth
  • Government-issued identification (for identity verification)
  • Banking information (for payouts)
  • Tax identification number (if applicable)

This information is collected and processed by Stripe in accordance with their privacy policy. CTCGX receives limited seller information necessary to operate the marketplace.

Transaction Information

When you buy or sell on the Platform, we collect:

  • Purchase history and order details
  • Listing information (items, prices, descriptions)
  • Shipping addresses
  • Payment transaction identifiers
  • Communication between buyers and sellers
  • Ratings and feedback

Automatically Collected Information

When you access our Platform, we automatically collect:

  • IP address
  • Browser type and version
  • Device information
  • Usage data (pages visited, features used, time spent)
  • Session information and authentication tokens
  • Referring website or source

How We Use Your Information

We use your information to:

  • Provide and maintain the Platform
  • Process transactions between buyers and sellers
  • Authenticate your account and manage sessions
  • Facilitate communication between users
  • Process payments and payouts through Stripe
  • Provide shipping tracking and delivery confirmation
  • Send notifications about orders, listings, and account activity
  • Respond to customer support inquiries
  • Detect and prevent fraud, abuse, and policy violations
  • Enforce our Terms of Service
  • Improve and develop new features
  • Comply with legal obligations

Information Sharing and Disclosure

Between Buyers and Sellers

To complete transactions, we share certain information between buyers and sellers:

  • Sellers receive: Buyer's name, shipping address, and email address for order fulfillment
  • Buyers receive: Seller's store name, business location (city/province), and return address if applicable

By making a purchase, you direct us to share your shipping information with the seller to enable order fulfillment.

Third-Party Service Providers

We share information with service providers who process data on our behalf:

  • Stripe: Payment processing, seller payouts, and identity verification. Stripe collects and processes payment card information directly; we do not store your full card details.
  • OAuth Providers (Google, Microsoft, LinkedIn, Discord): Authentication services
  • Amazon Web Services (AWS): Cloud hosting and file storage
  • EasyPost: Shipping rate calculation and tracking
  • Resend: Transactional email delivery

These providers are contractually obligated to protect your data and may only use it to provide services to us.

Public Information

The following information is publicly visible on the Platform:

  • Your username and profile picture
  • Seller store names and descriptions
  • Listings you create (item details, prices, conditions)
  • Seller ratings and feedback scores
  • Aggregate transaction counts

Legal Requirements

We may disclose your information if required by law, court order, or government request, or to protect the rights, property, or safety of CTCGX, our users, or others. We may also disclose information to investigate potential violations of our Terms of Service or to detect and prevent fraud.

Data Storage and Security

Your data is stored on secure servers located in Canada and the United States through our use of AWS services. We implement industry-standard security measures including:

  • Encrypted connections (HTTPS/TLS) for all data transmission
  • Encrypted data at rest
  • Secure session management with automatic expiration
  • Access controls and role-based permissions
  • Regular security monitoring and updates
  • Rate limiting and abuse prevention

While we take reasonable precautions to protect your data, no internet transmission is completely secure. You are responsible for maintaining the confidentiality of your account access.

Data Retention

We retain your information as follows:

  • Active accounts: Information is retained while your account is active
  • Deleted accounts: Personal information is deleted within 30 days of account deletion
  • Transaction records: Order and payment records are retained for 7 years for legal, tax, and accounting purposes
  • Ratings and feedback: May be retained and anonymized after account deletion
  • Security logs: Retained for up to 90 days for security and fraud prevention

Your Rights

Under PIPEDA and applicable provincial laws, you have the right to:

  • Access: Request a copy of the personal information we hold about you
  • Correction: Update or correct inaccurate information
  • Deletion: Request deletion of your account and personal data (subject to legal retention requirements)
  • Withdraw consent: Withdraw consent for optional data processing (may limit Platform functionality)
  • Data portability: Request your data in a portable format
  • Complaint: File a complaint with the Office of the Privacy Commissioner of Canada

To exercise these rights, please contact us through the contact form or email us directly. We will respond to requests within 30 days.

Cookies and Tracking

We use essential cookies for authentication and session management. These cookies are necessary for the Platform to function and cannot be disabled. Specifically:

  • Authentication cookies: Maintain your logged-in session
  • CSRF tokens: Protect against cross-site request forgery attacks
  • Session cookies: Remember your preferences during a session

We do not use advertising or third-party tracking cookies. We do not sell your personal information to advertisers or data brokers.

Age Restrictions

The Platform is intended for users who are at least 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that a user is under 18, we will promptly terminate their account and delete their information.

International Data Transfers

Your information may be transferred to and processed in the United States through our use of AWS and Stripe services. When we transfer data outside Canada, we ensure appropriate safeguards are in place, including contractual protections with our service providers.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a prominent notice on the Platform at least 14 days before the changes take effect. Continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

Contact Us

For questions about this Privacy Policy or our data practices, or to exercise your privacy rights, please use the contact form.

You may also contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca if you have concerns about our privacy practices.