Privacy Notice

1. Introduction and Scope

This Notice applies to the CardDirector website, the free launch waitlist, the CardDirector Windows desktop application, account and activation services, connected market data and marketplace features, subscription and billing administration, and support communications (together, the "Services").

This Notice does not apply to the practices of third parties that operate independently of CardDirector, including eBay, the market data provider, the Merchant of Record, or any other site or service that you reach through a link. Those parties handle information under their own notices and terms, which you should review.

Where this Notice describes a feature that has not yet been released publicly, that description explains how the feature is designed to operate and applies from the point that the feature becomes available to you.

2. Who We Are and How to Contact Us

CardDirector LLC is the business responsible for the personal information described in this Notice.

CardDirector LLC, 5013 S Louise Ave #1123, Sioux Falls, SD 57108, United States.

Privacy requests and questions: privacy@carddirector.com. Product and account support: support@carddirector.com. Billing, cancellation and refunds: billing@carddirector.com.

3. Summary of What We Collect and Why

The following is a summary only. The detailed descriptions in Sections 4 to 14 govern.

Waitlist and contact information, to send you the launch notification you requested and to respond to your inquiries.

Account, activation, device and access-check information, to provision, verify, secure and support your access to the Software.

Connected service request information, including search terms, card and listing identifiers and, where you use image identification, the photograph you select, to complete the lookup you requested.

Authorized eBay account information, to show you your own order, listing and shipment information inside the Software.

Subscription, transaction and license status information received from the Merchant of Record, to provision access and provide billing support.

Website technical, security and, with your consent, analytics information, to deliver, protect and improve the Website.

CardDirector does not sell personal information, does not share personal information for cross-context behavioral advertising, and does not use personal information for third-party targeted advertising.

4. Website and Launch Waitlist Information

The waitlist form collects your name, email address and your consent to receive a confirmation message and launch notifications. You may optionally provide information about your card workflow, your desktop platform, your primary need, and a free-text message.

CardDirector records the time of submission, the version of the consent text you accepted, and the browser user-agent string associated with the submission. This information is stored in the website database in order to manage your request, understand which workflows are of interest, provide support, prevent abuse and plan the release.

Joining the waitlist does not enroll you in unrelated newsletters or ongoing promotional programs, does not create a software account, and does not collect payment information.

Historic records may contain review or invitation history from earlier access arrangements. That history does not change the current free waitlist offer.

5. Account, Activation and Device Information

For customer and invited access, CardDirector stores your name and email address, an account identifier, the dates and source of any access grant, and administrative access history.

Setup and activation records include hashed activation tokens, their expiration and use status, device activation identifiers, and access-check information necessary to activate the Software, bind the license to one computer at a time, enforce the granted access period, administer the once-per-customer money-back guarantee and process activation transfers.

CardDirector records the processing status of invitation and activation emails. Acceptance by an email provider confirms that the message was accepted for delivery; it does not confirm inbox delivery.

Account services are separate from the public waitlist. Leaving the waitlist does not revoke customer access and does not stop necessary account, security or support messages.

6. Local Records on Your Computer

Core card, workflow, pricing assumption, note, follow-up, submission, selling, retained card and imported working records are designed to be stored in a local CardDirector database on your own Windows computer. Photographs you add to your own records are likewise designed to be stored locally.

CardDirector does not routinely upload, mirror, synchronize or back up your local records to CardDirector's servers, and CardDirector personnel do not have routine access to them. A subscription is not a backup or cloud storage service, and you are responsible for maintaining your own backups.

Local storage does not mean that every feature is offline. When you use a connected feature, the information needed for that specific request leaves your computer as described in Sections 7 to 9. When the Software performs an access check, the technical information described in Section 12 is transmitted.

Because local records are under your control, deleting them is something you do in the Software on your own computer. CardDirector cannot delete them for you and cannot recover them if you delete them.

7. Photographs, Centering and Image Identification

Photographs are handled differently depending on which feature you use. Please read this Section carefully.

Manual centering

The manual centering tool operates on your own computer. The photograph and the boundaries you place on it are processed locally and are not transmitted to CardDirector or to any third-party provider for the purpose of that calculation.

Optional image identification

Where you choose to use image-based identification, the photograph you select is transmitted from your computer through CardDirector's service to the market data provider so that the provider can attempt to identify the card. The transmission includes the image itself and the technical request information necessary to route and complete the request.

Before you first use photo identification, CardDirector asks for your express permission to transmit selected photographs for identification. This permission applies to your CardDirector account across your devices; we do not ask again merely because you use another installation with the same account and current valid permission. Each transmission still requires you to request identification. Activating an account, purchasing a subscription, selecting a file or viewing this Privacy Notice does not give this permission.

You may withdraw permission in Settings > Connected Services. Withdrawal immediately stops queued and future photo sends on the device where you withdraw. If CardDirector has not yet confirmed the withdrawal, that device continues to block sends, but your other devices may still be able to send. Once CardDirector records and confirms the withdrawal, new photo sends are blocked across your account. Withdrawal cannot recall a photograph already transmitted and does not by itself cancel processing or delete a copy held by a provider.

Withdrawing permission does not delete your original photographs, card records or identification results, or cancel your subscription. Manual entry and local centering remain available without this permission, subject to your ordinary access. If you wish to enable photo identification again, you must give permission under the wording then applicable. We keep a record of your permission and withdrawal as described in Section 20.

CardDirector processes that image only to route, complete, secure, rate-limit and troubleshoot the request. CardDirector does not use identification images for advertising, does not disclose them to anyone other than the provider performing the identification, and does not use them to train general-purpose artificial intelligence models.

The provider performing identification uses its own custom image-matching system, hosted by a third-party technical provider that the identification provider manages and is responsible for. CardDirector's own transmission ends once your request reaches the identification provider; what happens after that is described in the rest of this Section, based on what the provider has confirmed to CardDirector.

The identification provider has confirmed that images submitted for identification are deleted on its systems on a short cycle after processing, typically within minutes, and that it does not use those images to train, fine-tune or improve any model. CardDirector is working to have this commitment stated in the parties' written agreement so that this Notice can describe it as a contractual guarantee rather than a stated practice; until that is complete, this paragraph reflects what the provider has told CardDirector rather than a term CardDirector can independently enforce.

Card images returned by the identification feature, or shown elsewhere in the Software as provider reference images, are owned by the provider or its licensors, not by CardDirector. The provider has confirmed that CardDirector may display these images to you, within the Software, as the ordinary operation of the identification and research features you are using. The provider has not granted rights in the intellectual property, trademark or publicity rights of anything the image depicts, such as card artwork or a player's likeness. This matters if you intend to do anything with a provider image beyond viewing it in the Software, such as exporting it, printing it, or sharing it publicly: that use is your own responsibility to clear, in the same way it would be if you had sourced the image yourself. CardDirector's own use of the image, to show it to you inside the Software, is licensed and does not require anything further from you.

If you prefer not to transmit an image, do not use the image identification feature; manual entry and text search remain available.

You should avoid including other people, identity documents, addresses, screens showing account information, or other sensitive material in the background of any photograph you transmit.

8. Connected Market Data

When you use a connected market data feature, CardDirector may process search criteria, card identifiers, set, player, year, grade and condition context, pricing parameters, the provider's response, and the technical details necessary to complete, secure, rate-limit and troubleshoot the request.

Market data requests are made through CardDirector's protected service so that provider credentials are not exposed on your computer. CardDirector may retain limited operational and security logs relating to those requests as described in Section 20.

Provider responses that you save into your own records are stored locally on your computer under Section 6.

Provider reference images are not stored by CardDirector on your computer. They are displayed from addresses hosted by the provider, and what is saved locally is the address information rather than the image file. Your browser or operating system may cache a copy in the ordinary way, outside CardDirector's control. Photographs you take yourself can be stored inside your local CardDirector database.

9. Authorized eBay Connection

Listing research may transmit search terms, listing identifiers, and buyer location information where you supply it for shipping estimates, through CardDirector's protected service to eBay.

Where you authorize your own eBay account, CardDirector may receive account references, purchase and sale order information, listing references, shipment and tracking information, delivery estimates and authorization status, in each case only for the account you authorized and only as necessary for the connected workflow.

Imported order and shipment records are designed to remain with the desktop program on your computer rather than being stored as complete order or shipment histories in CardDirector's online services. Limited security, compliance and operational logs may be retained as described in Section 20.

Disconnecting your eBay account ends the authorization supported by CardDirector. Records already imported to your computer are controlled separately by you in the Software. The Software allows you to disconnect the marketplace authorization and to remove imported marketplace order and shipment records, while keeping your own underlying card records, notes, costs, photographs and history, which are yours and are not marketplace-derived.

Two limits on that function should be stated plainly. It removes the specific imported order and shipment records it covers. It does not sweep every field anywhere in your database that originally came from the marketplace, and it does not reach backups you made earlier, which are copies you hold and only you can delete. Broader removal, including coverage of older backups while preserving information you entered yourself, is recorded as a development requirement and is not available today. CardDirector will update this Notice when it is.

CardDirector maintains an endpoint that receives marketplace account deletion and closure notifications. On receipt of a valid notification, CardDirector deletes or de-identifies the marketplace-derived personal information within its own control.

Marketplace-derived records that you have already imported to your own computer are not within CardDirector's control. The server-side notification handler does not reach into your computer and does not remotely purge anything from it. Removing them is a step you take yourself, using the removal function described above. CardDirector will tell you this in response to any related inquiry and will assist you in using the function.

This division is how the obligation is met. CardDirector deletes what it holds, promptly and without being asked. For the copy on your computer, CardDirector provides a working function that removes it and tells you plainly that the step is yours. CardDirector does not claim an ability it does not have, because a promise to delete records on a computer that may be switched off for months, reinstalled, or never connected again would not be a promise it could keep.

On receipt of a valid deletion notification, CardDirector deletes or de-identifies marketplace-derived personal information in its own systems, including cached lookup results and operational logs holding it, and ends the stored authorization for that marketplace account so that no further data can be retrieved. CardDirector keeps a record that the notification was handled, holding no more marketplace-derived data than is needed for that purpose.

CardDirector is extending the coverage and the automated verification of this process, and this Notice will be updated if the description above changes. The commitment to delete marketplace-derived information within CardDirector's control on receipt of a valid notification applies now and does not depend on that work.

What is left for you to do, on your own computer: use the removal function in the Software to remove imported marketplace order and shipment records from your workspace; and, if you keep backups or exports that contain marketplace-derived fields, delete or replace those copies, since CardDirector cannot reach them. Support will walk you through either step.

Mixed records, where your own collection information sits alongside imported marketplace fields on the same card, are handled by removing the marketplace-derived fields and leaving your own information in place. You do not lose the card, the condition, what you paid, what you sold it for, your notes or your photographs because an order record was removed.

The distinction that matters is origin, not location. Marketplace-derived information is information that came from the connected marketplace: order identifiers, buyer or seller account references, marketplace transaction records, shipment and tracking data, and listing data retrieved through the connection. Your own collection information is information you created or entered: card identities, conditions, grades, the amounts you paid and received, cost basis and accounting figures, your notes and photographs, and your submission, grading and follow-up history. Your own collection information does not become marketplace-derived merely because you recorded it alongside an imported order, or because you first learned a figure from a marketplace.

Your own collection information is outside the scope of a marketplace deletion notification. It remains yours, remains on your computer, and is unaffected by disconnecting a marketplace or by a deletion notification. You should never lose your acquisition costs, sale figures or accounting history because a marketplace account was closed.

Backups and exports follow the same rule. A backup or export you made yourself is your own copy, held by you, and CardDirector has no access to it and no ability to alter or delete it. Where a backup or export contains marketplace-derived fields, those fields remain marketplace-derived in origin, and removing them from a copy you hold is a step only you can take. CardDirector will tell you which fields those are if you ask.

10. Subscription, Billing and Transaction Information

Paid subscriptions are sold through a Merchant of Record, currently Freemius, Inc. The Merchant of Record collects and processes your payment details, billing address, tax information and payment method under its own privacy notice and transaction terms, and is the seller of record for the transaction.

CardDirector receives from the Merchant of Record only the information necessary to provision and maintain your access and to provide support, which may include your name and email address, customer and subscription identifiers, plan, price, currency, transaction and invoice identifiers, payment status, paid-through date, license status, activation counts, cancellation status, refund status and dispute status.

CardDirector does not receive, request or store full payment card numbers, card security codes or bank account credentials. You should never send those to CardDirector by email or in a support ticket.

11. Support Communications

When you contact support, billing or privacy, CardDirector processes your name, email address, the content of your message, any attachments or screenshots you send, and the technical details you provide, such as the Software version, your Windows version, the approximate time of an error and the error message.

Support correspondence is handled using Microsoft 365 business email. CardDirector uses support content to diagnose and resolve your issue, to improve documentation and the product, and to maintain a record of the request.

Do not send passwords, activation codes, private invitation links or full payment details in a support message.

12. Technical, Security and Access-Check Information

When you use the Website, Cloudflare processes limited network, browser, request, security and challenge information in order to deliver and protect the site. CardDirector uses Cloudflare Turnstile and transformed, salted rate-limit identifiers to reduce automated abuse. Rate-limit identifiers are not added to the ordinary waitlist applicant record.

When the Software performs an access check, it transmits the information necessary to verify your entitlement, which may include the account or license identifier, a device activation identifier, the Software version and the time of the request, together with the network information inherent in making an internet connection.

Protected account, invitation, activation, billing and enrollment routes may use temporary Secure, HttpOnly, SameSite cookies for session and request integrity.

CardDirector retains limited operational and security logs in order to operate the service, detect and investigate abuse, enforce license controls and meet legal obligations.

13. Cookies and Similar Technologies

This Section forms the CardDirector cookie disclosure. You can review and change your choices at any time using the Cookie Preferences control in the footer of www.carddirector.com.

Strictly necessary

Strictly necessary cookies and equivalent local storage are used for site delivery and security, for bot mitigation through Cloudflare Turnstile, for request integrity on protected routes, and to remember your cookie preference itself. These are set without consent because the Website cannot operate securely without them.

Preference

CardDirector stores your analytics choice on your browser for up to one hundred and eighty (180) days, and stores a local preference-change signal so that other open tabs can stop measurement immediately when you withdraw consent.

Analytics, consent based

Google Analytics is loaded only if you select Accept Analytics Cookies. It is not loaded, and no analytics cookies are set, if you decline or take no action. You may decline and continue to use the Website and join the waitlist with no loss of functionality.

Advertising

CardDirector does not use advertising cookies, does not use Google Signals or Google advertising features, and does not permit advertising trackers on the Website.

Blocking or clearing cookies through your browser is always available and may affect Website functionality. The Software is a desktop application and does not use browser advertising cookies.

14. Analytics Configuration and Consent

Where you consent, Google Analytics uses cookies and pseudonymous browser and session identifiers and processes information such as page visits, scroll events, browser and device details and general location. Google receives network information, including your IP address, when your browser connects to its service.

CardDirector configures its analytics restrictively. Names, email addresses, form responses, card records, account identifiers and private links are not sent as analytics event fields. Page addresses are transmitted without query strings or fragments, and referrers are not sent as event fields. Pages opened with query strings or fragments, and private account, activation, billing, invitation, enrollment and unsubscribe routes, are excluded from measurement. Google Signals and advertising features are disabled. Analytics cookies are configured to expire after no more than one hundred and eighty (180) days.

For a qualifying new signup made with analytics allowed, a random confirmation cookie and a matching hashed receipt permit a single signup event to be counted. Receipts contain no name, email address or customer identifier, expire after five minutes, and are deleted when used or during cleanup, normally within an hour. Repeat submissions and direct visits to the confirmation page are not counted as new registrations, and the message shown after submission does not change.

Withdrawing consent stops future measurement and removes accessible Google Analytics cookies for the site. It does not erase information already transmitted to Google.

CardDirector also uses Cloudflare Web Analytics for aggregate traffic and performance measurement. Cloudflare states that this service does not collect or use visitors' personal data. CardDirector does not use it for advertising.

15. How We Use Information

CardDirector uses personal information for the following purposes only.

To provide, operate, maintain and improve the Services and to make the features you request work.

To create, verify, provision and secure accounts, activations, licenses and entitlements, to process activation transfers, and to administer the once-per-customer money-back guarantee and prevent license abuse.

To complete connected service requests that you initiate.

To administer subscriptions, provide billing, cancellation and refund support, and maintain transaction records.

To communicate with you, including confirmations, receipts, renewal and price-change notices, activation information, security alerts, service notices and responses to your inquiries.

To send launch notifications and optional product updates where you have asked for them.

To detect, investigate, prevent and address fraud, abuse, security incidents, technical issues and violations of the CardDirector terms or a provider's terms.

To understand aggregate website activity and measure registrations, where you have consented to analytics.

To comply with legal obligations, respond to lawful requests, establish, exercise or defend legal claims, and enforce agreements.

CardDirector does not use your card records, photographs or workflow data for advertising, for resale, or to train general-purpose artificial intelligence models.

16. No Sale, No Sharing and No Targeted Advertising

CardDirector does not sell personal information and has not sold personal information in the preceding twelve months. CardDirector does not share personal information for cross-context behavioral advertising, does not disclose personal information to third parties for their own independent marketing, and does not process sensitive personal information for the purpose of inferring characteristics.

Disclosures to service providers and to connected services described in this Notice are made in order to operate the Services, secure them, administer billing, or complete a feature that you have requested. They are not sales or shares as those terms are defined in United States state privacy laws.

If CardDirector's practices change in a way that creates additional rights or choices under applicable law, this Notice will be updated and the required notices and choices will be provided before the change takes effect.

17. Automated Decision-Making and Artificial Intelligence

CardDirector does not use automated decision-making that produces legal or similarly significant effects concerning you. Access verification, activation-transfer checks, rate limiting and abuse prevention are automated technical controls; if such a control restricts your access, you may ask for human review by contacting support@carddirector.com.

Estimates, comparisons, projections and identification suggestions generated by the Software are informational outputs based on available data and on assumptions you enter or accept. They are not decisions about you, are not profiling, and must not be relied upon as guarantees. The limitations that apply to them are set out in the CardDirector Terms of Use and the End User License Agreement.

Artificial intelligence tools were used to assist in the development of the Software. That does not affect how your personal information is handled, and CardDirector does not transmit your personal information to a general-purpose artificial intelligence provider as part of ordinary operation of the Services.

18. Service Providers and Disclosures

CardDirector discloses personal information only as described below.

Cloudflare, for website and application delivery, edge compute, database storage, bot mitigation through Turnstile, web analytics, security and limited operational logging. See www.cloudflare.com/privacypolicy.

Google, for consent-based Google Analytics only. See policies.google.com/privacy and policies.google.com/technologies/partner-sites.

Microsoft, for Microsoft 365 business and support email. See privacy.microsoft.com/privacystatement.

Freemius, Inc., as Merchant of Record and subscription biller for paid access, including payment processing, invoicing, tax determination, renewal, cancellation and refund processing.

The market data provider, for card research, pricing and, where you use it, image identification. That provider in turn uses a third-party technical provider to operate its image-matching system, under arrangements the market data provider is responsible for.

eBay, for listing research and for the authorized account, order and shipment features that you enable.

CardDirector may also disclose personal information where reasonably necessary to comply with applicable law or a lawful request, to enforce its terms, to protect the rights, property or safety of CardDirector, its users or the public, to investigate suspected fraud, abuse or a security incident, or in connection with a merger, acquisition, financing, reorganization or sale of assets, in which case CardDirector will require the recipient to honor this Notice or will give you notice and an opportunity to exercise available rights.

Each third party listed above processes information under its own terms and privacy notice. CardDirector requires its service providers, by contract, to process personal information only on CardDirector's instructions and for the purposes of providing the relevant service.

19. Location of Processing and International Transfers

CardDirector operates from the United States and the Services are intended for users in the United States. Personal information is processed in the United States and, because several service providers operate global infrastructure, may be processed in other countries.

If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection law may differ from the law of your location. CardDirector relies on appropriate contractual protections with its service providers.

20. Retention

CardDirector keeps personal information only for as long as necessary for the purpose for which it was collected, and applies the following schedule.

New, reviewing, waitlisted or invited requests: retained for up to twenty-four (24) months after the most recent submission, status activity or meaningful contact.

Declined requests: direct identifiers and free-text content removed after twelve (12) months; minimal status and audit records retained for up to twenty-four (24) months after the final decision.

Unused expired or revoked invitation records: up to twelve (12) months after expiration or revocation. Accepted invitation records and related website audit history: up to twenty-four (24) months after acceptance.

Temporary website enrollment session records: up to ninety (90) days after expiration or completion.

Browser user-agent information submitted with a waitlist request: up to ninety (90) days, unless needed for a documented security investigation.

Transformed rate-limit identifiers: intended to be held no more than twenty-four (24) hours. Automatic deletion within that window is a requirement CardDirector is implementing rather than a description of current behavior for every identifier, including those held by the identification gateway. Until it is in place, these identifiers are deleted on the schedule the relevant system applies, or on request.

Identification gateway application logs: the current hosting plan applies a documented three (3) day retention window to these logs. That window is the provider's, and CardDirector describes it rather than guaranteeing it.

Other connected service request logs, analytics records and recovery copies: these have different lifecycles depending on the system that holds them, and CardDirector does not apply a single retention period across all of them. Where a record is not yet subject to automatic deletion, CardDirector deletes it on request under Section 22 and is working toward automatic deletion as a development requirement.

Images transmitted for identification: processed temporarily to complete the request and not saved by CardDirector afterward. CardDirector does not keep a copy of an identification photograph for investigation purposes. The gateway's application logs record operational details of the request and do not contain photograph contents. The provider's own retention is governed by its notice, as described in Section 7.

Acceptance records evidencing which documents and versions you agreed to, and when: retained for six (6) years from the date your last subscription ends, matching the contract limitation period in South Dakota. The clock runs from the end of the subscription and does not wait for you to close your account, so an account left dormant does not keep the records indefinitely. If you subscribe again before the six years expire, the clock resets and runs from the end of that later subscription. Where a dispute, claim or legal or regulatory process involving the record is underway or reasonably anticipated when the period would expire, the record is kept until that matter is resolved and then deleted. If you never subscribe, the acceptance record is deleted twenty-four (24) months after your last account activity. The record consists of the document names and version numbers displayed, the consent wording shown, the state of each checkbox, the server-side timestamp and the account identifier.

Photo-identification permission and withdrawal records identify your account, your action, the wording and version shown, and when the action was recorded. For customers who have subscribed, we retain these records for six years after the last subscription ends. If you subscribe again before that period expires, the period runs from the end of that later subscription. For customers whose access has only been complimentary, we retain these records for twenty-four months after the later of that access ending and the last account use. A later paid subscription moves these permission and withdrawal records to the subscriber period. Where a dispute, claim or legal or regulatory process involving a record is underway or reasonably anticipated when its period would expire, we retain that record until the matter is resolved and then delete it.

The IP address captured at the moment of acceptance or purchase: retained for twelve (12) months and then deleted in full. The rest of the acceptance record is retained for the period specified above for acceptance records. Deleting the address outright, rather than truncating it, means no part of it survives the twelve months.

Support correspondence: up to twenty-four (24) months after resolution. A minimal record showing that a privacy or deletion request was handled: up to three (3) years.

Subscription, transaction, invoice, refund, chargeback and tax records: retained for the period required by applicable tax, accounting and limitation law, generally up to seven (7) years.

Account, entitlement and activation records: retained while access is held and for up to twenty-four (24) months afterward, in order to operate and secure access, preserve license history and administer the once-per-customer money-back guarantee.

If you withdraw a waitlist request or make a valid deletion request, CardDirector aims to remove the ordinary record within thirty (30) days. Limited information may be retained where reasonably necessary to honor an opt-out, evidence completion of the request, protect security, comply with law or provider obligations, or resolve a dispute. A minimal suppression record consisting of the email address, request date, request source and handling actor is kept for as long as necessary to honor an opt-out. Hashed unsubscribe tokens and the associated address are kept so that older confirmation emails remain usable for unsubscribing.

Local records on your own computer remain there until you delete them. The website cleanup process does not affect them, and does not delete customer account, entitlement or activation records.

21. Security

CardDirector maintains administrative, technical and organizational safeguards appropriate to the nature of the information it holds, including protected service credentials held in server-side infrastructure rather than on user computers, authorization checks on protected routes, signed provider requests where required, rate limiting, encryption of data in transit using current transport security, access controls limiting staff access to what is necessary, logging of administrative access, and periodic review of provider configuration.

No system is completely secure. CardDirector cannot guarantee absolute security, and you are responsible for the security of your own computer, your account credentials, your activation links and your local records.

If CardDirector becomes aware of a security incident affecting your personal information, it will notify affected individuals and any required authority in accordance with applicable state breach notification law.

22. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights in respect of personal information about you.

The right to know or access the categories and specific pieces of personal information collected, the sources, the purposes, and the categories of recipients.

The right to obtain a copy of your personal information in a portable format.

The right to correct inaccurate personal information.

The right to request deletion of your personal information, subject to legal exceptions.

The right to opt out of the sale or sharing of personal information and of targeted advertising. CardDirector does not engage in any of these activities.

The right to limit the use of sensitive personal information. CardDirector does not use sensitive personal information for purposes that trigger this right.

The right not to receive discriminatory or retaliatory treatment for exercising a privacy right.

The right to appeal a refusal of a request, where your state provides one.

To exercise a right, email privacy@carddirector.com from the address associated with your record, or use the contact route published on the Website, and describe the right you wish to exercise. CardDirector will acknowledge your request promptly and will respond within forty-five (45) days, extendable once by a further forty-five (45) days where reasonably necessary, with notice to you.

CardDirector will take reasonable steps to verify your identity before acting, which normally means confirming control of the email address on file and, for a substantive access or deletion request, asking you to confirm details that match the record. CardDirector will not create a new account or collect additional identifying documents solely to verify a request. If CardDirector cannot verify a request, it will explain why.

An authorized agent may submit a request on your behalf with written authorization signed by you, and CardDirector may contact you to confirm the authorization.

If CardDirector declines a request in whole or in part, it will explain the basis. You may appeal by replying to that decision with the word Appeal in the subject line. CardDirector will respond to an appeal within forty-five (45) days and, if the appeal is denied, will tell you how to contact your state attorney general.

23. Additional State Disclosures

For residents of California: the categories of personal information collected in the preceding twelve months are identifiers, customer records information, commercial information relating to subscriptions and card workflow, internet or network activity information, approximate geolocation derived from network information, audio-visual information in the form of card photographs you transmit, and inferences limited to product interest. The sources, purposes, retention periods and recipients are those described in Sections 3 to 20. CardDirector has not sold or shared personal information in the preceding twelve months, and does not knowingly sell or share the personal information of consumers under sixteen (16) years of age. CardDirector honors the Global Privacy Control and comparable browser-level opt-out signals in respect of any processing to which an opt-out right applies.

For residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states with a comprehensive privacy statute in force: the rights described in Section 22 are available to you to the extent your state law provides them, including the right to appeal. CardDirector does not process personal information for targeted advertising, for sale, or for profiling in furtherance of decisions producing legal or similarly significant effects, and therefore no opt-out of those activities is required.

For residents of Nevada: CardDirector does not sell covered information as defined by Nevada law. You may submit a verified request regarding sale to privacy@carddirector.com.

CardDirector does not knowingly collect or process biometric identifiers. Photographs of trading cards are not biometric information. You should not transmit photographs of people through the Services.

24. Children's Privacy

The Services are not directed to children under thirteen (13) years of age, and CardDirector does not knowingly collect personal information from a child under thirteen. Paid subscriptions and accounts are restricted to persons aged eighteen (18) or over, or the age of majority where they live.

If CardDirector learns that it has collected personal information from a child under thirteen without verifiable parental consent, it will delete that information promptly. A parent or guardian who believes that a child has provided personal information should contact privacy@carddirector.com so that the matter can be reviewed.

25. Changes, Accessibility and Contact

CardDirector may update this Notice as the Services, connected providers, billing arrangements and legal requirements change. The effective date at the top of this Notice will be revised whenever a change is published.

Where a change materially affects how personal information about you is collected, used or disclosed, CardDirector will give notice in advance by email to the address associated with your record, by a notice on the Website, or within the Software, and, where the change requires your consent, will obtain that consent before the change applies to you. In particular, CardDirector will publish a specific update once the retention and no-training commitment described in Section 7 is reflected in the written agreement with the identification provider, so that this Notice can state it as a guarantee rather than a described practice.

CardDirector will provide this Notice in an alternative accessible format on request to privacy@carddirector.com.

CardDirector LLC, 5013 S Louise Ave #1123, Sioux Falls, SD 57108, United States. Privacy requests: privacy@carddirector.com. Support: support@carddirector.com. Billing: billing@carddirector.com. Website: www.carddirector.com.