Privacy Policy

QUALIAX TECHNOLOGIES, S.L., [REGISTERED ADDRESS], [CIF]. Contact for privacy matters:support@cardtrading.eu.

Account data (username, email, password stored hashed); profile and seller data (Stripe Connect onboarding is handled by Stripe — we store your Stripe account identifier and status, never your banking details); transaction data (orders, bids, listings, payments, shipping and tracking information, addresses where provided); communications (dispute messages, reviews, seller replies); usage data strictly necessary to operate the service (session tokens, security logs); price alerts and portfolio data you create.

We process your data to: provide the marketplace and execute transactions (performance of contract, art. 6.1.b GDPR); send transactional emails and in-app notifications about your orders, disputes and alerts (performance of contract); prevent fraud and secure the platform (legitimate interest, art. 6.1.f); comply with tax, accounting and anti-money-laundering obligations (legal obligation, art. 6.1.c); and, only with your consent, any optional communications (art. 6.1.a).

We share data with processors strictly to operate the service: Stripe (payment processing — Stripe acts as independent controller for its own regulatory obligations), Brevo (transactional email), Railway (application and database hosting), Vercel (web hosting). Some providers process data in the United States; transfers are protected by the EU–US Data Privacy Framework and/or Standard Contractual Clauses. We do not sell personal data.

Account data is kept while your account is active. Transaction and invoicing data is retained for the periods required by Spanish tax and commercial law (generally up to 6 years). Dispute records are kept as long as needed to handle claims. Reset tokens expire within 30 minutes and are stored hashed.

You may exercise access, rectification, erasure, restriction, portability and objection rights by writing to support@cardtrading.eu. You may also lodge a complaint with the Spanish supervisory authority (AEPD, aepd.es).

CardTrading uses only technical cookies and local storage strictly necessary for authentication and site operation. We do not use advertising or third-party analytics cookies. For this reason no consent banner is required; this section serves as the cookie notice.

If you join our launch waitlist we store only your email address and the page you signed up from, on the basis of your consent (art. 6.1.a GDPR). We use it for a single purpose: to send you one notification when CardTrading opens. It is not a newsletter and your address is not used for any other marketing. The address is also stored with Brevo, our email provider, for the sole purpose of delivering that message. We keep it until launch or until you ask us to remove it, whichever comes first, and you can withdraw your consent at any time by writing to support@cardtrading.eu.

We apply appropriate technical and organisational measures: passwords hashed with bcrypt, transport encryption (HTTPS), access controls, hashed single-use reset tokens, continuous backups and monitoring.

We will update this policy when our processing changes and notify material changes through the platform.