Privacy policy
Last updated: 2026-11-08
Controller
ARTIO Mining GmbH, Chapfstrasse 58, 8625 Gossau ZH, Switzerland, UID CHE-443.857.465, e-mail: info@holofoilx.artiomining.ch. This policy covers the processing of personal data under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).
Data we process
Account data (name, e-mail, password hash, language, currency, time and version of the terms you accepted), collection data you enter (cards, purchase and sale prices, notes, storage locations, uploaded photos and receipts), scan photos (linked to your account, not anonymised), usage data (sign-ins with IP address and device, scans, alerts), billing data (handled by Stripe; we store invoice metadata only) and support messages.
Purposes and legal bases
Providing the service and your account (contract), security and abuse prevention (legitimate interest), billing and statutory retention (legal obligation), optional product e-mails and optional retention of scan photos for improving recognition (consent, revocable at any time).
Processors and transfers
Hosting of the web app: Vercel Inc. (USA), server functions in Frankfurt (Germany), delivery through Vercel's global network. Database: Databricks, Inc. with its subsidiary Neon, LLC (USA, Neon service) [contracting entity to be checked], data centre in Frankfurt (Germany). Background processing and object storage (photos, receipts, backup copies): Railway Corporation (USA), data centres in Amsterdam (Netherlands). E-mail delivery: Hostpoint AG (Switzerland). AI image analysis, only when AI recognition is enabled and only for scans, grading checks and reading a sports card from a photo that you start: Anthropic PBC (USA) and Google LLC (USA, Gemini API) [Google contracting entity of the billing account to be checked]. For scans, the photo can also be converted into a numerical image fingerprint to compare it with the card catalogue. We use both providers as paid services under their commercial terms: they do not use the images to train or improve their models. Google logs requests for a limited period solely to detect misuse and may process them temporarily in other countries where it operates facilities. Payments (only once paid plans are offered): Stripe Payments Europe, Limited (Ireland), with onward transfer to Stripe, LLC (USA).
Reading a sports card from a photo (“Sports cards” page, only when you start it): the photo of the front and, if you wish, the back is sent to the AI provider that reads the card’s details – Google (Gemini API, used only as a paid service) and, if that service is unavailable, Anthropic (Claude). Before that we remove the photo’s metadata (EXIF, e.g. the location where it was taken) and scale it down. The photo is processed in memory only and then discarded: we do not store it and no scan record is created. The result only pre-fills the form; nothing is saved until you check it and save it. Each reading counts as one scan towards your monthly scan quota. [Draft, legal review pending]
Card images are loaded directly from the servers of the data providers (Scryfall, TCGdex, Lorcast), which therefore receive your IP address and browser details. Push notifications (only if you turn them on) are delivered through your browser vendor's push service (e.g. Google, Mozilla, Apple, Microsoft).
Recipients are located in Switzerland, the EU and the USA. Transfers to countries without adequate protection rely on the EU standard contractual clauses as recognised by the FDPIC or on certification under the Swiss-U.S. Data Privacy Framework [to be checked per recipient]. This information is a draft pending legal review.
Retention
Account and collection data: until you delete your account. Scan photos: 90 days after the scan; with your consent at most 24 months. Security log (sign-ins with IP address and device): 12 months, also after an account is deleted. Error logs: 90 days. Expired sessions: deleted continuously. Invoices: 10 years (Swiss Code of Obligations art. 958f).
Your rights
You can access, correct, export (Settings → Privacy) and delete (Settings → Privacy) your data, object to processing and withdraw consent. You may lodge a complaint with the FDPIC or your local supervisory authority.
Security
Encrypted transport (TLS), hashed passwords, optional two-factor authentication, encrypted storage of API secrets, role-based access for staff and an audit log of security-relevant actions.
Affiliate links and links to providers
On card, set, collection, watchlist and grading pages we show links to eBay (search results and listings) and to the websites of grading companies (PSA, CGC, Beckett, SGC, TAG). A click opens that provider’s website in a new tab. From then on, that provider is responsible for processing your data: eBay may record the click and your visit with cookies and similar technologies under the privacy policy of eBay or of the respective provider.
Once HoloFoilX takes part in the eBay Partner Network, the eBay links are affiliate links and are labelled “Ad · affiliate link”. If you buy on eBay after such a click, HoloFoilX may receive a commission; your price does not change. The link then contains our campaign ID and an identifier of the place where it is shown (e.g. “card page”), but no information about you, your account or your collection. The links to grading companies are not affiliate links; there is no partnership with these companies.
Click counting: when you click one of these links, your browser sends a short notice to HoloFoilX. We use it to count per day how often which destination (e.g. ebay.ch or a grading company) was clicked from which type of page. Only the count is stored – no user ID, no IP address, no card and no cookie; as with every page request, our hosting provider processes the IP address only technically. The counters are deleted after 400 days. Legal basis, where the GDPR applies: our legitimate interest in measuring the use of our links (Art. 6(1)(f) GDPR). [Draft, legal review pending]
Cookies and storage in your browser
HoloFoilX only sets its own cookies: no third-party cookies, no analytics or advertising cookies and no tracking. The cookies and browser storage below are technically necessary or keep a setting you choose yourself. They are not used for advertising and are not passed on to third parties, which is why we do not ask for consent. On holofoilx.artiomining.ch the names of the sign-in cookies also start with “__Secure-” (sent over HTTPS only).
Sign-in (technically necessary; set only once you sign in, not readable by scripts, SameSite=Lax): “holofoilx.session_token” keeps you signed in – 14 days, extended daily while you use the service; without “Stay signed in” only until you close the browser. “holofoilx.session_data” holds a signed copy of the session details so that not every page has to query the database – 60 seconds. “holofoilx.dont_remember” remembers that you did not choose “Stay signed in” – until you close the browser.
Two-factor sign-in (technically necessary, only if you have enabled it): “holofoilx.two_factor” links the two steps of the sign-in – 10 minutes. “holofoilx.trust_device” only if you choose to trust the device for 30 days: on this device we do not ask for a code for 30 days.
Account view by support (technically necessary, only for staff with administrator rights): “holofoilx.admin_session” keeps the staff member’s own session while an administrator views a user account to help. The view ends after 30 minutes at the latest, and the cookie is deleted when it ends.
Settings you choose (for display): “holofoilx-locale” stores the language if it differs from your browser’s language setting or if you switch it – 1 year. “holofoilx.theme” stores light, dark or “System” – 1 year. “holofoilx.intro” records with the value “1” that the logo intro on the home page has already been shown in this browser session – until you close the browser.
Browser storage (sessionStorage, deleted when you close the tab; we do not use localStorage): “holofoilx.scanMode” remembers whether you chose single card or batch scan. “holofoilx.batchScan.v1” keeps the list of an ongoing batch scan with small preview images (at most 160 pixels) so that reloading the page does not lose it; the photos themselves are not stored, and the list is cleared once it has been added to the collection or deleted.
Push notifications: only if you enable them, your browser registers a HoloFoilX service worker that shows the notifications (it does not store page content). You can delete cookies and browser storage in your browser at any time; you are then signed out and your display settings are reset. [Draft, legal review pending]
Closed beta Draft
Draft, not yet reviewed by a lawyer. This section applies only during the closed beta and will be reviewed by legal counsel before the beta starts.
Participation: by invitation only and from the age of 18. At sign-up we store when you accepted the terms of use, the privacy policy and the beta terms and confirmed your age, together with the version of these texts.
Invite list: the e-mail address we invited you with, an internal note, who invited you and when the invite was accepted or revoked. Purpose: access to the closed beta. The list is deleted after the beta ends; if you delete your account earlier, the link to your account is removed.
Feedback and survey (optional): your message, topic, rating, the page you were on (without search parameters), where relevant the card or scan concerned, your willingness-to-pay answers and whether we may contact you, linked to your account. Staff see feedback with your user id, not your e-mail address. Purpose: improving HoloFoilX and pricing. Kept for at most 12 months; deleted with your account. Feedback is included in your data export.
Scan photos: scan photos are not anonymised. They stay linked to your account until you delete your account or the retention period ends (90 days after the scan). Only if you consent for a photo when scanning, or for all scans in the settings, do we keep photos longer, at most 24 months, and use them to test and improve card recognition (e.g. as internal test photos). They are never published and never passed to third parties to train models. In internal test datasets we replace the scan id with a hash and store no account or e-mail details.
Withdrawal: you can withdraw photo consents at any time under Settings → Privacy (individual scans) or Settings → Notifications (all scans). Photos older than 90 days are then deleted in the next maintenance run and removed from internal test datasets at the next sync.
Anonymous usage counters: during the beta we count per day how often features are used (e.g. scans, searches, exports), without user id, IP address or cookie. The counters are deleted after 400 days. There are no third-party analytics or advertising trackers.
Not public: during the beta the catalogue, prices and all other pages except sign-in and legal texts are reachable only for signed-in testers and closed to search engines. Payments are disabled and no payment data is processed. AI recognition (Anthropic, USA) is used only when it is enabled.