Privacy Policy

This Privacy Policy describes how VaultXchange LLC ("VaultXchange," "we," "us," or "our") collects, uses, discloses, and protects information in connection with our websites, applications, products, and services, including vaultxchange.io, vaultxchange.app, the VaultXchange store dashboard, the VaultXchange Collector app, and our iOS and Android apps (collectively, the "Service"). It is part of our Terms of Service, and capitalized terms not defined here have the meanings given there.

This Privacy Policy applies to:

• visitors to our websites;
• people who request a walkthrough, contact us, apply to an affiliate or creator program, or submit other forms;
• businesses and their Staff who use Store, Vendor, Shop, and Event Promoter accounts ("Business Accounts");
• individuals who use Collector accounts; and
• information processed through the Service on behalf of businesses, such as information about their customers and employees.

If you do not agree with this Privacy Policy, do not use the Service.

1. Our Role

For website visitors, leads, Collectors, and the account information of businesses and their Staff, VaultXchange decides how information is used and is responsible for it under this Privacy Policy.

Businesses also use the Service to keep records about their own customers, employees, vendors, and operations. When we process that information for a business, we act as a service provider or processor for that business, to the extent applicable law treats us that way. The business is responsible for giving its own privacy notices, obtaining any required consents, responding to requests from its customers and employees, and complying with law. If you are a customer or employee of a business that uses VaultXchange, please contact that business with questions about its records.

2. Information We Collect

2.1 Website Visitors, Leads, and Applicants

When you use a form on our website, we collect what you submit, which may include:

• name, email address, and phone number;
• business, shop, or show name and the plan or topic you are interested in;
• your message;
• for affiliate and creator applications: city and state, your VaultXchange account email, social media platforms and links, audience size, and how you plan to share VaultXchange; and
• how you found us, such as campaign tags, the referring site, and the page you landed on.

2.2 Business Accounts and Staff

• Business information: business name, address, phone, email, website, logo, description, hours, plan, and settings.
• Staff accounts: name, email or username, role and permissions, the business you belong to, account status, and login information such as last login, failed login attempts, and lockouts.
• Billing information: plan, billing cycle, subscription status, billing history, billing ZIP code for tax purposes, and promo codes used. Full card numbers are handled by our payment processor and are not received or stored by VaultXchange.
• In-person card payments: if enabled, transaction information such as amount, items, status, and time for payments accepted through our point-of-sale integration with Square, and the connection credentials needed to operate that integration. Card numbers, expiration dates, and security codes are handled by Square and never received or stored by VaultXchange.
• Promoter and affiliate payouts: if you accept table-fee payments or earn affiliate commissions, your payout onboarding, identity, and bank details are collected by our payment processor. We receive account status and payment records, not your bank details.
• Business records: inventory, costs, prices, purchase orders and uploaded documents, sales, trade-ins, store credit, reports, events, tournaments, broadcasts, community messages, and other records you create.

2.3 Information Businesses Enter About Other People

Businesses may enter or generate information about their customers, employees, and vendors, including:

• Customers: name, phone number, email, notes, flags and fraud-signal reviews, trade-in, purchase, sale, and redemption history, store-credit balances, and loyalty status.
• Mail-in submissions: where a business offers mail-in buying, the submitter's name, email, phone, mailing address, payout method and handle, and submitted items.
• Employees: schedules, shift history, tasks, time-off requests (including dates, the category selected, such as sick time, and notes), and discipline or incident documentation, including any acknowledgment or written response. These features do not ask for Social Security numbers, dates of birth, home addresses, banking information, or medical details, and businesses should not enter them.
• Event vendors and participants: vendor application details such as contact name, phone, email, business name, social handle, and inventory description; attendance and check-in; and tournament participant names, decks, and results.

2.4 Collector Accounts

• Account and profile: name, display name, username, email, password (stored only in hashed form by our authentication provider), phone number, profile picture, banner, bio, badges, and settings. Your phone number is verified by text message and used to secure your account and link you to businesses you have shopped with.
• Collection activity: cards, conditions, grades, certification numbers, quantities, purchase prices, notes, acquisition dates, wishlists and lists, set tracking, decks, binders, portfolio history, and alerts.
• Transactions and social activity: Sell Your Cards submissions, XChange trades and trade messages, ratings and reviews, friends, follows, direct and group messages, reports and blocks, event RSVPs and check-ins, tournament entries, and giveaway entries and winner messages (which may include a shipping address).
• Store links: balances and transaction history that a business has recorded under your verified phone number or email.
• Subscriptions and referrals: whether you have VaultXchange+, its status and renewal information from Apple, Google, and our subscription-billing provider (not your payment details), any referral code you enter, and resulting referral activity.

2.5 Card Photos, Scanning, and Centering Analysis

Card identification and pricing. When you scan a card, the photo, or a text description, is sent to card identification and pricing providers, which return matching card information and pricing. Depending on the feature, the photo may be sent from your device directly to the provider, which means the provider also receives your device's IP address. These requests do not include your name, contact information, or payment information. We do not keep scan photos; saved cards use catalog images.

Centering Analysis. Edge detection and centering measurement run on your device. Nothing is uploaded unless you tap Save, in which case we store a compressed, corrected preview image of the front and back of the card, along with the measurements, privately in your account. The full-resolution original is not kept.

Card photos are of collectible cards. Please avoid capturing people, documents, or other personal information in them.

2.6 Location

Collector features such as the shop locator and nearby shows and events use a ZIP code you type in. We convert it to an approximate area using a location lookup provider, and the ZIP code is kept on your device rather than in your account. We do not use your device's GPS location for these features, and we do not track your location.

For Business Accounts, we use your business address to place you in regional community channels, to show your shop on the shop locator if you opt in, and to match nearby events. Business addresses are converted to map coordinates using location lookup providers.

Our mobile apps request device location permission only where the in-person card reader software requires it to accept card payments for a business. That location is used by the card-payment provider to process payments, not by VaultXchange for any other purpose.

2.7 Devices, Notifications, and Text Messages

If you allow notifications in our app, we collect a device push token and platform, and we use it to send the notifications described in our Terms. Tokens are removed when you sign out or delete your account. If you provide a phone number, our text-messaging provider receives it to send verification codes. Our native app may also keep a copy of your collection on your device for offline viewing; it is stored in the app's private storage and removed when you sign out.

2.8 Support, Bug Reports, and Diagnostics

When you contact support or submit a bug report or feature request, we collect what you send, including messages, screenshots, and files. If you choose to include diagnostics, we may also collect your app version and device type, recent error details, the names of recently visited screens (not their contents), and your account and business identifiers. We use this information to investigate and respond, and it may be processed by AI service providers to help triage and investigate issues. Screenshots and files you attach may be stored where our team can access them by link, so please do not include sensitive information in them.

2.9 Information Collected Automatically

• Log and security data: IP address, browser and device type, pages and endpoints requested, timestamps, and errors. We record the IP address of login attempts in our security logs, and we use IP addresses to rate-limit requests.
• Website analytics: on our marketing website, pages viewed and actions such as button clicks and form submissions, through a product analytics provider (see Section 7).
• Attribution: campaign tags, referrer, and landing page, which may be carried from our website to the sign-up page and saved with your new account so we know which campaigns work.
• Storefront views: public storefront pages count views and item interactions using a random identifier stored in your browser, which is not linked to your identity.
• Feature usage: records of AI feature use, card-data lookups, and similar usage, so we can enforce limits and manage costs.

2.10 Information From Other Sources

• Businesses, which may create customer records about you, including automatically when you complete a Sell Your Cards submission or in-store XChange trade with them, or ask us to import their existing customer lists.
• Apple, Google, and our subscription-billing provider, about VaultXchange+ purchases and status.
• Our payment processors, about payment, payout, and account status.
• Publicly available sources, such as business listings and business websites, from which we may collect business contact information (business name, phone, address, website, and published business email) to identify shops that may be interested in VaultXchange.

3. How We Use Information

We use information to:

• provide, operate, maintain, and improve the Service;
• create and secure accounts, verify email addresses and phone numbers, and prevent unauthorized access;
• link Collectors to the businesses they shop with and show balances and history;
• run trade-ins, Sell Your Cards, XChange, storefronts, events, tournaments, giveaways, broadcasts, messaging, and other features;
• process subscriptions, fees, and payments, and calculate taxes;
• send transactional communications, notifications you have enabled, and responses to inquiries;
• respond to walkthrough requests and inquiries, review affiliate applications, and contact businesses that may be interested in VaultXchange;
• generate reports, analytics, and AI-assisted insights;
• moderate content, including automated screening of messages, and review reports;
• detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms;
• understand how our website and Service are used and measure our marketing;
• comply with law, enforce our rights, and resolve disputes; and
• create aggregated or de-identified information.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it to target ads to you.

4. What Other Users Can See

• Collector profiles: other signed-in users can see your username, display name, profile picture, banner, bio, join date, badges, rank, ratings, and trade statistics. You can turn off username search in your settings, though your profile can still be opened from a direct link. Your email address and phone number are not shown to other Collectors.
• Collections and lists: private unless you choose to make them visible to friends or to other users, or share a binder by link. Anyone with a binder link can see that binder's name, your username and display name, and the cards and prices in it.
• Businesses you deal with: when you link to, sell to, trade with, or RSVP to a business, that business can see the information needed for that relationship, such as your name, username, avatar, contact details, the cards involved, and your transaction history with it.
• Messages and reviews: visible to their recipients, group members, or the audiences the feature is designed for.
• Tournaments: participant display names, decks, standings, and results for published tournaments may be visible to other users and on public results and display pages.
• Business Accounts: storefront information, shop locator listings, vendor network stock, and community channel messages are visible as described in our Terms.
• Profile images you upload may be accessible to anyone who has their link.

5. How We Share Information

We share information with the following categories of recipients:

• Cloud hosting, database, authentication, and storage providers that run the Service and store its data.
• Payment and billing processors that process subscription fees, promoter table-fee payments, add-on purchases, and affiliate payouts, and that calculate taxes.
• Square, for businesses that use our in-person card payment integration.
• Apple, Google, and our subscription-billing provider, for VaultXchange+ purchases, using your account identifier and any referral code.
• Card identification, pricing, catalog, grading, and population data providers, which receive card photos, card descriptions, and certification numbers, but not your contact or payment information.
• AI service providers, as described in Section 6.
• Email, text-messaging, and push notification providers, which receive the email address, phone number, or device token needed to deliver a message, along with its content.
• Shipping and label providers, which receive the name, address, and phone number needed to create a shipping label for a mail-in submission.
• Location lookup and map providers, which receive ZIP codes or business addresses to convert them to approximate locations, and which may receive your IP address when map tiles load.
• Product analytics providers, for our marketing website.
• Business listing providers, which receive search terms when we look for shops that may be interested in VaultXchange.
• Software development and support tools, which may receive bug reports and diagnostics.
• Businesses and other users, as described in Section 4 and as needed to complete transactions you choose to make.
• Professional advisors, such as lawyers, accountants, and insurers.
• Legal, compliance, and safety recipients, when we believe disclosure is necessary to comply with law or legal process, protect the rights, property, or safety of VaultXchange, our users, or others, or investigate fraud or security issues.
• Successors, in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets.
• Others with your direction or consent.

Some images shown in the Service, such as card images, are loaded directly from third-party image hosts, which receive your IP address when they load. Payment links to third-party payment apps open those apps, and what you do there is governed by their privacy policies.

6. AI-Assisted Features

Some features send information to AI service providers to generate a result. Depending on the feature, this may include aggregated business metrics such as sales, inventory, and credit totals; cards, prices, and quantities in a trade; collection summaries; deck lists; the contents of invoices and purchase orders you upload, which may include supplier names and addresses; bug reports and diagnostics; and questions our own team asks about platform operations, which may draw on internal logs. We use these providers to provide the feature, not to sell your data or advertise to you. AI features do not make decisions that produce legal or similarly significant effects about you.

7. Cookies, Local Storage, and Analytics

We and our providers use cookies, local storage, and similar technologies to:

• keep you signed in and secure your session;
• remember preferences, such as display mode or a ZIP code you entered;
• remember how you arrived at our website, for attribution;
• count storefront views; and
• measure how our marketing website is used, through a product analytics provider, which may set its own identifier in your browser. Session recording is not enabled.

We do not use advertising cookies or third-party advertising trackers. You can clear or block cookies and local storage in your browser, though some features may not work. Our websites do not currently respond to "Do Not Track" signals; because we do not sell or share personal information for advertising, there is nothing for an opt-out preference signal to turn off.

8. Data Retention

We keep information for as long as your account is active and as long as reasonably necessary afterward to provide the Service, comply with legal, tax, and accounting obligations, resolve disputes, prevent fraud and abuse, maintain security and audit logs, and enforce our agreements. Retention varies by type of data. Business records, including customer and transaction records, are kept for the business while its account exists and may be kept longer where the law requires. Reports, moderation records, and security logs may be kept after an account involved in them is deleted. We may delete or de-identify information at any time, subject to legal obligations.

9. Account Deletion

Collectors can delete their account from Settings in the app or on the web. Deletion removes your profile, collection, lists, wishlists, binders, set tracking, decks, saved analyses, store links, Sell Your Cards requests, friendships, follows, blocks, and push tokens, and your sign-in account. Some information is kept with your identity removed so the Service keeps working for others, including XChange trades and trade messages, ratings and reviews, direct and group message history, bug reports, and AI usage records. Reports and moderation records are kept with your identity removed. Records that a business keeps about its own transactions with you belong to that business and are not deleted; contact the business about them. Deleting your account does not cancel VaultXchange+; cancel it with Apple or Google first.

Staff can delete their own personal account from settings. This removes the Staff login and personal account data but does not delete the business, its inventory, customers, or transaction history, where the Staff member's name may be removed from past records.

Businesses can request closure and deletion of a Business Account by contacting us. You can also deactivate an account instead of deleting it; deactivation hides it but keeps the data.

You can also request deletion by emailing support@vaultxchange.io. We may keep limited information as described in Section 8.

10. Security

We use administrative, technical, and physical safeguards designed to protect information, which may include encrypted connections, hashed passwords, access controls and role-based permissions, database-level access rules, login rate limiting and lockouts, private storage for sensitive files, audit logging, and least-privilege access for our staff. Authorized VaultXchange personnel can access account and business data when needed to operate, support, secure, and administer the Service. No method of transmission or storage is completely secure, and we do not guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify you as required by law.

11. Children's Privacy

Business Accounts are for adults. Collector accounts are for people 13 and older, and people under 18 must have a parent or guardian's consent, as described in our Terms. The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it. If you believe a child under 13 has an account, contact us at support@vaultxchange.io.

12. Your Choices and Rights

• Access and correction: you can view and update much of your information in your account settings.
• Visibility: Collectors can choose who sees their collection and lists, whether their portfolio value is shown, and whether their username is searchable.
• Blocking and reporting: Collectors can block other Collectors and report content or users.
• Notifications: you can turn off push notifications in your device settings, and some per-business controls are available in the app.
• Deletion: see Section 9.
• VaultXchange+: manage or cancel through your Apple or Google account.

Depending on where you live, you may have rights under applicable law to request access to, correction of, deletion of, or a copy of your personal information, to opt out of certain processing, and to appeal our decision on a request. We do not sell personal information, share it for cross-context behavioral advertising, or use it for profiling that produces legal or similarly significant effects. To make a request, email support@vaultxchange.io. We will verify your identity, may need more information to do so, and may decline requests where permitted by law. You may use an authorized agent where the law allows, and we may require proof of the agent's authority. We will not discriminate against you for exercising your rights. If we deny your request, you may appeal by replying to our decision.

If your information is in records a business keeps through the Service, such as its customer or employee records, please send your request to that business, because it controls those records. We will assist the business as required by law.

13. International Users

The Service is intended for users in the United States. Information is processed and stored in the United States, and may be processed in other countries where our service providers operate. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, which may have different data protection laws than your home jurisdiction.

14. Changes to This Privacy Policy

We may update this Privacy Policy at any time. We will post the updated version with a new effective date, and for material changes we may also notify you in the Service or by email. Your continued use of the Service after an update becomes effective is acceptance of the updated Privacy Policy to the extent permitted by law.

15. Contact Us