What we collect
To take and deliver an order: your name, email address, shipping and billing address, and phone number if you provide one.
To operate an account: your email address and a password, stored only as a bcrypt hash. We cannot read your password.
Automatically: server logs containing IP address, user agent and requested URL, retained for 30 days for security and abuse prevention.
What we never collect
We never receive, transmit or store raw payment card numbers. Manual payment methods (Apple Pay, Google Pay, Bitcoin, Zelle, Cash App) are completed off-site. We hold only an order reference.
Who we share it with
- Shipping carrier — name and delivery address only.
- Email provider — to send invoices, receipts and shipping notices.
We do not sell personal data, and we do not share it for advertising.
How long we keep it
| Data | Retention |
| Order records | 7 years (tax and accounting obligations) |
| Account data | Until you delete the account |
| Server logs | 30 days |
| Newsletter subscription | Until you unsubscribe |
Your rights
You can ask us to give you a copy of your data, correct it, delete it, or stop using it. Email order@pokemonscards.com and we will respond within 30 days.
Cookies
See the cookie policy for the specific cookies used.
Changes
Material changes to this policy are announced on this page with a new effective date before they take effect.