1. Controller

The controller for the processing of personal data on this website is:

Schroll & Rosenegger GbR
Schönblickstr. 20
83346 Bergen
Germany

Represented by: Kilian Schroll
Email: info@cardtrademate.com

Further details about the provider are in the legal notice.

2. General principles

We process personal data only as far as it is needed to provide a working website together with our content and services.

Processing takes place either with your consent or where the law permits it.

3. Server log files

When you open this website, our hosting provider records technically necessary information in server log files. This may include:

• IP address
• date and time of access
• the page or file requested
• amount of data transferred
• browser type and version
• operating system
• referrer URL

This serves to keep the website working, stable and secure.

Legal basis: Art. 6(1)(f) GDPR.

4. Account registration

When you create an account, we process the details you enter in order to provide that account and let you use the application:

• user name
• email address
• display name
• password (stored only in hashed form, never in plain text)
• date of registration and of your most recent sign-in
• account type (collector or trader), which you choose when you first sign in
• a profile picture, if you upload one

The profile picture is optional. It is shown to you only, it is never published, and you can replace or delete it at any time in your account settings; deleting it removes the image from our database. Before the image is sent, your browser crops and re-encodes it, which removes any metadata the original file carried — including the location where a photo was taken.

Legal basis: Art. 6(1)(b) GDPR.

5. Inventory and import data

Using CardTradeMate means putting your own data into it — by importing files or by maintaining your card inventory. This may include:

• imported purchase and sales data
• card and inventory information
• cost and margin figures
• uploaded CSV files
• invoice details you enter, including your own sender address

This processing provides the core functions of the application.

Legal basis: Art. 6(1)(b) GDPR.

6. Bug reports and feature requests

When you send us a report from inside the application, we store what you wrote together with a few technical details that help us reproduce the problem:

• subject and description as you wrote them
• your user name and the account the report came from
• the page you were on, your browser identification, the application and addon version, and your plan
• date and time of the report

No inventory data, no card lists and no details of your customers are transmitted with a report. What you type into the description field is of course transmitted as written — please do not paste customer names or addresses in there.

Reports are kept for as long as they are being worked on and are deleted once they are no longer needed, at the latest twelve months after they were closed. You can ask us to delete a report of yours earlier at any time.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in finding and fixing faults in our own software.

7. External sources and links

The application may show links to external services such as Cardmarket, Scryfall or TCGplayer. Following such a link takes you off our website; what happens on those sites is solely their operators' responsibility.

Card images are not loaded from third-party servers. Where an image is needed, our server fetches it once from Scryfall, MTGJSON, TCGplayer or the respective manufacturer and stores it here. Your browser only ever receives it from us, so your IP address is not disclosed to those providers.

Please refer to the privacy notices of those providers where relevant.

8. Payments (Stripe)

Paid subscriptions are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

Checkout takes place entirely on a page operated by Stripe. Payment details such as card numbers never reach us and are not stored by us. We pass on only what is needed to match the payment to your account — in particular your email address and an internal account identifier.

In return we receive whether a subscription exists, its status and the date it is paid until. We store this on your account in order to unlock the corresponding feature set.

Our contracting party is Stripe's Irish entity, so processing takes place within the EU. Stripe may pass data on to its parent company Stripe, Inc. in the United States. For such transfers Stripe relies on the standard contractual clauses adopted by the European Commission and on its certification under the EU–US Data Privacy Framework. Details are set out in Stripe's own privacy documentation.

Legal basis: Art. 6(1)(b) GDPR; for the transfer, Art. 45 or Art. 46 GDPR.

9. Cookies and local storage

This website uses strictly necessary cookies only. No cookies are set for analytics, advertising or reach measurement, and no third-party cookies are embedded. In detail:

• Sign-in (.AspNetCore.Identity.Application) — keeps you signed in.
• Session (.AspNetCore.Session) — remembers the active scope (personal or group) for the duration of a session.
• Security (.AspNetCore.Antiforgery.*) — protects forms against cross-site request forgery.

In addition, the application stores a few display preferences in your browser's local storage, such as the chosen inventory view and the number of tiles per row. Those stay in your browser, are never transmitted to us, and can be cleared through your browser settings.

Because all of this is strictly necessary to provide the service you asked for, it requires no consent: Art. 6(1)(f) GDPR and § 25(2) TDDDG — the German implementation of the ePrivacy Directive, called TTDSG until May 2024.

10. Retention

Personal data is kept only as long as it is needed for the respective purpose or as long as statutory retention periods require.

Account data and the content belonging to an account are generally kept for as long as the account exists, unless legal obligations or legitimate interests require longer storage.

11. Recipients

Personal data is passed on only where this is necessary to provide the website or the application, where the law requires it, or where you have consented.

Recipients may in particular be hosting or IT providers acting as processors on our behalf.

12. Your rights

Within the limits of the law you have the following rights in particular:

• access — Art. 15 GDPR
• rectification — Art. 16 GDPR
• erasure — Art. 17 GDPR
• restriction of processing — Art. 18 GDPR
• data portability — Art. 20 GDPR
• objection — Art. 21 GDPR
• lodging a complaint with a supervisory authority

You may lodge that complaint with the supervisory authority of the EU member state where you live or work, or where you believe an infringement took place.

13. Contact for privacy matters

For questions about the processing of personal data, please write to:

Email: info@cardtrademate.com

14. Version

This privacy policy is dated 25 September 2026.