Privacy Notice

CaseLink is operated by CaseLink Technologies LLC. CaseLink is the controller of personal data used for its public website and Help Center, waitlist, user accounts, service security, support, product analytics, and any CaseLink subscription billing. For any privacy question or request, use our Help Center support form, email hello@getcaselink.com, or write to 30 N Gould St, Ste N, Sheridan, WY 82801, United States.

When a dealer chooses why and how to record a collector’s or customer’s details in its workspace, that dealer is normally the controller of that record and CaseLink processes it for the dealer. Contact the dealer first about a record that dealer entered; you may also contact CaseLink and we will assist where required. This notice covers the CaseLink website, Help Center and support form, access waitlist, and the CaseLink app for dealers and collectors.

Depending on how you use CaseLink, we collect:

• Access waitlist: your email, and optionally your name, role (dealer/collector), business or dealer name, Instagram handle, and a short note, plus your consent to be contacted. We also process a hashed form of your email and IP address to prevent spam and abuse. After approval, application details are scrubbed while normalized email, access status, and role may remain to operate the access gate.
• Support and feedback: the topic you select, optional name, reply email address, subject, message, and, for signed-in product feedback, relevant account and dealer identifiers. Our hosting and firewall provider also processes the source IP address. We create salted hashes from the email address and, when available, the IP address of Help Center submissions to rate-limit spam and abuse; these hashes are not included in the support email.
• Account and authentication: your email, authentication credentials handled by our authentication provider, display name, optional first and last name, account role, legal-document acceptance record, security and session information, and—if social sign-in is enabled and you choose it—sign-in identifiers supplied by Google or Apple.
• Collector profile: display name, optional phone number and preferred contact method, and the cards you save or make offers on.
• Collector Vault: the cards you add to your private vault — card details, optional photos (stored privately, visible only to your account), and the purchase price, estimated value, and currency you enter. For matching raw TCG cards we also attach an automatic market-value estimate (see “Who we share data with”).
• Dealer workspace: your business display name, contact name, optional phone, location, biography, avatar or banner, website and social handles, preferences (language, currency, time zone), and the data you create — inventory, cards, shows, sales, trades, offers, holds, notes, label data, staff invitations, roles, permissions, and security or audit attribution.
• Offers and activity: offer amounts and the collector name and contact details submitted or recorded for a deal, plus a history of that offer activity.
• Card recognition and lookups: the card image or card identifiers you submit, the selected recognition provider or model, an image hash, operation status, usage or credit records, and the recognition or lookup result.
• Subscription billing, if enabled: dealer name and email, selected plan, Stripe customer and subscription identifiers, subscription status, current billing period, and cancellation status. CaseLink does not receive the full payment-card number.
• Website and product usage: basic analytics about how our website and product are used, diagnostic information for unhandled browser errors when optional analytics is enabled, server-side events for signed-in product actions, and, if you accept marketing cookies, website events used to measure Meta campaigns (see “Cookies and analytics” below).

Fields marked optional may be left blank. Required account, authentication, and support fields are needed to create or secure the account, provide the requested feature, or answer the request; without them we may be unable to do so.

• To provide CaseLink, authenticate and secure your account, deliver requested features and support, and administer any CaseLink subscription (performance of our agreement or steps you request before entering one, Article 6(1)(b) GDPR).
• To run the access waitlist and contact you about approved access (your consent, Article 6(1)(a) GDPR).
• To handle support requests about an existing or requested CaseLink service (performance of our agreement or steps you request before entering one, Article 6(1)(b) GDPR); for other enquiries, our legitimate interest in answering them (Article 6(1)(f) GDPR).
• To keep CaseLink and the Help Center secure, manage sessions and staff access, rate-limit submissions, keep audit evidence, and prevent fraud, spam, and abuse (our legitimate interests in service security, accountability, and availability, Article 6(1)(f), and legal obligations where applicable).
• To run optional browser analytics and error diagnostics (your consent, Article 6(1)(a)); and to record limited signed-in server events and aggregate performance data needed to operate and improve the service (our legitimate interest, Article 6(1)(f)).
• To measure Meta campaigns where you grant Marketing consent (Article 6(1)(a)).
• To send push notifications after you enable them and to deliver app updates needed for a secure, current app (performance of our agreement, your device permission, and our legitimate interest in service security).
• For collector or customer records that a dealer enters, CaseLink acts on that dealer’s instructions as its processor; the dealer is responsible for selecting and documenting the lawful basis and retention period.

Where we rely on your consent, you can withdraw it at any time.

We do not sell your personal information. We share it with the providers and other recipients below for the stated purposes; their role depends on the service and context. Optional marketing measurement providers receive data only when you consent:

• Supabase and Vercel: Supabase provides the primary database, authentication, storage, and server functions. Vercel hosts the website and Help Center, provides firewall protection, and supplies aggregate performance measurement.
• Support and email providers: authorized CaseLink support staff access support requests as needed. Vercel processes the form submission and source IP address. Resend (Plus Five Five, Inc.) receives the reply email address, topic, optional name, subject, and message to deliver the request to our support inbox; our mailbox provider stores the resulting correspondence. For signed-in product feedback, Resend also receives the feedback type and message, dealer identifier and name, user identifier and email, and reply-to address. Resend additionally delivers access and account emails.
• Card recognition and certification providers: CardHedge and, depending on configuration, Anthropic’s Claude or Google’s Gemini process the card image and printed details submitted for recognition. CardHedge or PSA may process certificate numbers, grader, grade, and card identifiers for certificate or comparable-price lookups.
• Mobile delivery providers: Expo delivers app updates and, if you opt in, push notifications through Apple Push Notification service or Firebase Cloud Messaging.
• Map providers that render the show-discovery maps — Esri/ArcGIS tiles on the website, Apple Maps on iOS, and Google Maps on Android. They receive the map area you view and your IP address. We do not send them your precise location.
• Analytics and performance providers: Google Tag Manager/Analytics, PostHog, and Ahrefs run in the browser after Analytics consent; Vercel supplies cookieless aggregate traffic and performance measurement. Limited signed-in product events are also sent server-side to PostHog.
• Meta Pixel, if you accept Marketing cookies, to measure and improve Meta advertising campaigns.
• Google or Apple, if you choose to sign in with your Google or Apple account.
• Card market-data providers — to attach market values and reference prices, our servers send card identities (the game, card name, set, and number — never your name, account, or contact details) to pricing sources such as pokemontcg.io, Scryfall, YGOPRODeck, and eBay’s Browse API. Frankfurter receives requested currency symbols to provide exchange rates; direct mobile requests also include ordinary network data such as the device IP address.
• Stripe, if subscription billing is enabled, processes checkout and payment details and receives the account email, dealer name and identifier, and selected plan. CaseLink receives subscription and status data, not the full card number.

We may also disclose data if the law requires it. Separately, when you ask a dealer to see a card or send them an offer, that dealer can see your display name and any contact details you choose to share, so they can follow up with you. Saving a card is private — it does not share your identity with the dealer.

Account and workspace data is generally kept while the account or dealer workspace is active. After closure, we keep only what remains necessary to complete deletion, secure the service, meet legal obligations, resolve disputes, or establish, exercise, or defend claims. See the account & data deletion page for the account-specific flow. A dealer controls the retention of collector or customer records it entered and must apply its own legal and tax requirements.

Waitlist application details are removed after approval, while normalized email, role, and access status may remain while needed to operate and evidence the access gate. Support messages are kept only as long as needed to resolve and document the request, handle reasonable follow-up, prevent abuse, meet legal obligations, or handle claims. Inactive encrypted multi-account session tokens are scheduled for deletion after 90 days. Legal-acceptance, security, audit, billing, and AI-operation records are kept only for the period reasonably needed for their stated purpose and applicable legal requirements. Backup copies expire under the configured provider schedule and are not restored for ordinary product use.

Depending on where you live, you have rights over your personal data. If you are in the EEA or UK, these include access, correction, deletion, restriction, portability, and objection, plus the right to withdraw consent and to lodge a complaint with your data protection authority. If you are in California or another US state with a privacy law, see “California & US state privacy rights” below.

For account, website, support, security, analytics, or CaseLink billing data, direct the request to CaseLink. For a collector or customer record entered and controlled by a dealer, contact that dealer first; CaseLink will assist the dealer with a valid request as required.

To exercise any right, use our Help Center support form, email hello@getcaselink.com, or delete your account in the app.

We do not sell your personal information for money. If you accept Marketing cookies, Meta Pixel may receive website event data for campaign measurement and optimization, which some US state privacy laws may treat as “sharing” for cross-context behavioral advertising. You can opt out at any time by rejecting Marketing cookies in Cookie settings or using our support form. Do not submit sensitive personal information in the Help Center support form unless it is necessary for the request.

The categories of personal information we collect, in the terms used by California law, are:

• Identifiers — such as your name, email address, phone number, and account and sign-in details.
• Customer records — business or dealer name, social handles, and contact details you provide.
• Commercial information — your inventory, offers, holds, sales, trades, and saved or watched cards.
• Internet or network activity — optional consent-based browser analytics, cookieless aggregate performance measurement, limited signed-in server events, and Meta website event data if Marketing consent is granted.

We collect this from you directly and from your use of CaseLink, use it for the purposes described above, and disclose it only to the providers listed under “Who we share data with” for those business purposes.

Where an applicable US state privacy law covers CaseLink and your request, you may have rights to know, access, delete, and correct personal information and to opt out of sale, sharing, or targeted advertising. Rejecting Marketing cookies is the self-serve opt-out for website marketing sharing. We also honor the Global Privacy Control signal: while GPC is active, Marketing remains declined; if no choice is saved, Analytics and Marketing both default to declined. We will not discriminate against you for exercising an applicable right. Use the Help Center support form to make a request. You may use an authorized agent where the law permits, and we respond within the timeframe required by the applicable law.