Privacy Policy
Effective date: July 18, 2026 · Last updated: July 18, 2026
Cardfolio IQ ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit or use cardfolioiq.com and any related services (collectively, the "Services"). Cardfolio IQ is built on and hosted through infrastructure provided by GoDaddy Operating Company, LLC and its affiliates and partners ("GoDaddy"). By using our Services, you agree to the terms of this Privacy Policy.
If you do not agree with the terms of this Privacy Policy, please do not access or use our Services.
1. Information We Collect
a. Information You Provide to Us
When you create an account, join our waitlist, or contact us, we may collect:
- Your name and email address
- A password (stored in hashed form — never in plain text)
- Sports card collection data you enter into the platform, including player names, card sets, years, grades, grading companies, cost basis, and valuations
- Payment information, processed securely through Stripe — we do not store full card numbers on our servers
- Any messages, feedback, or support inquiries you send to us
b. Information Collected Automatically
When you use our Services, we and our service providers (including GoDaddy and its affiliates) may automatically collect:
- IP address and approximate geographic location
- Browser type, operating system, and device identifiers
- Pages visited, session duration, and interaction data
- Referring URLs
- Cookies and similar tracking technologies (see Section 5)
c. Card Image Data
If you upload card images for AI grading, those images are processed server-side solely for the purpose of generating a grade. Images are scanned for malware before processing and are not shared with third parties beyond what is strictly necessary to deliver the grading result.
2. How We Use Your Information
We use the information we collect to:
- Create and manage your Cardfolio IQ account
- Provide AI-powered card valuations, grading, and market intelligence features
- Process payments and manage your subscription through Stripe
- Send transactional emails, including account confirmations, waitlist notifications, and subscription receipts
- Respond to your support requests and inquiries
- Improve, personalize, and expand our Services
- Monitor platform security, detect fraud, and enforce our Terms of Service
- Comply with applicable laws and legal obligations
- Analyze usage trends through Google Analytics (a GoDaddy partner service) to improve the platform
We do not sell your personal information to third parties.
3. How We Share Your Information
a. GoDaddy — Hosting & Infrastructure
Cardfolio IQ is built on and hosted through GoDaddy's platform. GoDaddy and its affiliates and partners provide the underlying infrastructure, database hosting, content delivery, and deployment services that power our platform. Your data is stored on GoDaddy-managed servers and is subject to GoDaddy's infrastructure security practices. For more information, see GoDaddy's Privacy Policy.
b. Stripe — Payment Processing
Payment processing is handled by Stripe, Inc., a GoDaddy-integrated payment partner. When you subscribe to a paid plan, your payment information is transmitted directly to Stripe and is governed by Stripe's Privacy Policy. We receive only a tokenized reference to your payment method.
c. Google Analytics — Usage Analytics
We use Google Analytics (GA4), available through GoDaddy's partner ecosystem, to understand how users interact with our platform. Google may collect usage data subject to Google's Privacy Policy. You can opt out using the Google Analytics Opt-out Browser Add-on. Analytics cookies are only loaded after you provide consent via our cookie banner.
d. OpenAI — AI Features
Our AI card valuation and grading features are powered by OpenAI's API. Card data submitted for valuation or grading may be sent to OpenAI for processing, subject to OpenAI's Privacy Policy. We do not send personally identifiable information to OpenAI beyond what is necessary to process your specific request.
e. eBay — Market Data
Our market trends and live sales features retrieve publicly available sold listing data from eBay's API. No personal information is shared with eBay in this process. Data retrieved is subject to eBay's Privacy Policy.
f. Legal Disclosures
We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Cardfolio IQ, our users, or others.
g. Business Transfers
In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any such change in ownership.
4. Data Retention
We retain your personal information for as long as your account is active or as needed to provide our Services. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal, tax, or fraud prevention purposes.
5. Cookies
We use cookies and similar technologies to maintain your session, remember your preferences, and analyze platform usage. You can control cookies through your browser settings. Disabling cookies may affect the functionality of certain features. We display a cookie consent banner on your first visit — analytics and tracking cookies are only loaded after you provide explicit consent.
GoDaddy's platform infrastructure may also set cookies necessary for the operation and security of the hosting environment. These are strictly necessary cookies and are not subject to consent controls.
6. Your Rights
Depending on your location, you may have the right to:
- Access — request a copy of the personal information we hold about you
- Correction — request that we correct inaccurate or incomplete information
- Deletion — request that we delete your personal information
- Portability — request your data in a portable, machine-readable format
- Opt-out — unsubscribe from marketing emails at any time via the unsubscribe link in any email we send
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
7. Children's Privacy
Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at [email protected] and we will promptly delete it.
8. Security
We implement industry-standard security measures to protect your information, including TLS encryption in transit, bcrypt password hashing, HTTP security headers (HSTS, CSP, X-Frame-Options), tiered rate limiting, and input validation on all endpoints. Our platform is hosted on GoDaddy infrastructure, which provides additional network-level security, DDoS mitigation, and encrypted database backups.
For a full overview of our application-level security practices, see our Security page. No system is 100% secure — if you believe your account has been compromised, contact us immediately at [email protected].
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will notify you by email or by posting a prominent notice on our platform. Your continued use of the Services after any changes constitutes your acceptance of the updated policy.
10. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: