Privacy policy

Who is responsible

TCGGraph is the data controller for the personal data described here. For anything in this policy, including exercising your rights, contact privacy@tcggraph.com.

What we collect

• Account data. Email address, and optionally a name and company. Needed to create an account and to contact you about the service.
• Billing data. For card and bank payments, Stripe collects your name, billing address and payment details, and we store the amount, the last four digits and a Stripe reference — never a full card number. Tax law requires us to keep evidence of where a customer is located, so a billing country is retained for as long as our tax obligations require. If you ask us to put those on an invoice for your accountant, we store what you gave us and nothing more.
• API request logs. Timestamp, endpoint, status code, credits consumed and a truncated IP address. Used for rate limiting, billing accuracy, abuse prevention and debugging.
• Website analytics. Aggregate, cookie-free page counts. No cross-site tracking, no advertising pixels, no profiles.
• Arrival source. If you arrive from a link on another site, your browser tells us which site (only the site name, such as chatgpt.com or reddit.com, never the page). If you arrive from one of our Google Ads, the link carries a click identifier and campaign name. We keep this in a first-party cookie for up to 90 days, and if you sign up in that time it is stored on your account so we know what brought you. No advertising script runs on the site and nothing is read from other websites.
• Discord connection. Only if you connect a Discord account from the dashboard: its user ID and username, so we can add you to our server and give accounts on a paid plan the Customer role. Disconnecting deletes both.

We do not collect special category data and we have no reason to. Please do not send it to us.

Why we process it, and on what basis

• To provide the service — performance of a contract. Account data, request logs.
• To bill you — performance of a contract and legal obligation. Billing data.
• To prevent abuse and keep the service up — legitimate interests. Request logs.
• To send product email — consent, which you can withdraw in one click. Service and billing notices are sent regardless, because you need them.
• To know what brings people here: legitimate interests. Arrival source. Which sites, assistants and ads send us customers decides where we spend effort. For Google Ads we also report back to Google that a given ad click led to a signup or a first payment, so we can tell which ads are worth running.

How long we keep it

• Account data: for the life of the account, then 30 days.
• Request logs: 30 days, then deleted. Aggregate usage counters are kept for billing history.
• Invoices: seven years, because tax law requires it.

Who we share it with

We use a small number of processors, each under a data processing agreement:

• Vercel — application hosting and edge delivery.
• Cloudflare — CDN, DDoS protection and image delivery.
• Postmark — transactional email.
• Stripe — card and bank payment processing, invoicing and VAT calculation. Stripe receives your name, billing address, VAT number where you supply one, and your payment details, which it processes as an independent controller under its own privacy policy. We never see or store full card numbers.
• Google Ads: advertising measurement. For accounts that arrived from one of our ads we send Google the click identifier it issued, the time of the signup or first payment, and the payment amount. Never your email, name or anything else about you.
• Discord: only if you connect it. Your Discord account is added to our server, and members of that server can see whether it has the Customer role. Discord receives nothing else from us, and acts as an independent controller under its own privacy policy.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We disclose data to authorities only where legally compelled, and we will tell you unless we are prohibited from doing so.

International transfers

Data may be processed in the United States. Those transfers rely on the EU Standard Contractual Clauses together with supplementary technical measures, principally encryption in transit and at rest.

Your rights

Depending on where you live you have rights to access, correct, delete, port, restrict and object to the processing of your personal data, and to withdraw consent. California residents additionally have the right not to be discriminated against for exercising those rights.

Email privacy@tcggraph.com and we will respond within thirty days. No account verification hoops beyond confirming you control the address. If you think we have handled your data badly, you can complain to your local supervisory authority; in the Netherlands that is the Autoriteit Persoonsgegevens.

Cookies

The marketing site sets one cookie, and only when you arrive from somewhere: a first-party cookie holding the name of the site that linked here, or the click identifier and campaign name when the link was one of our Google Ads, kept for 90 days or until you sign up, whichever comes first. Type the address or open a bookmark and no cookie is set. The dashboard sets one first-party session cookie so you can stay logged in, plus one storing your light or dark theme preference. None of these follow you to other sites or build a profile, which is why you are not being asked to dismiss a banner.

Security

TLS 1.3 in transit, encryption at rest, hashed API keys, least-privilege internal access and audit logging. If a breach affects your personal data we will notify you and the relevant authority within 72 hours of becoming aware.

Children

The service is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, email us and we will delete it.

Changes

Material changes are announced by email at least thirty days ahead. The date at the top of this page always reflects the current version.