Privacy policy
Effective 12 August 2026 · Version 1.0. We keep these policies under review and will post material changes here.
In plain English
The current website is a pre-launch marketing site. If you join the waitlist or contact us, we use your details to respond and, where you ask us to, tell you about launch. When the product opens, it will use the account, card, photograph, marketplace and subscription information needed to provide the features you choose. We do not sell personal data or use it for third-party advertising. The detailed notice below explains what we do, why, who receives information, how long it is kept and your rights.
1. Controller and contact details
Seek TCG is operated by Seek TCG Systems Ltd (company registration pending), registered in England and Wales, with registered office and contact address at 2 Ashcombe Road, Merstham, Surrey, RH1 3BY, United Kingdom (“Seek TCG”, “we”, “us”). We are the controller for the account, product, waitlist and service-operation processing described in this notice.
Privacy enquiries and rights requests: hello@seektcg.com. ICO registration number: ZC196591. An EU representative is not required for the current processing; if that changes we will appoint one and update this notice.
When we process a marketplace buyer’s personal data solely on the instructions of a business seller, we may instead act as that seller’s processor. The applicable business data-processing terms will govern that activity.
2. Information we process
Depending on the features you use, we may process:
- Waitlist, marketing and support data: email address, marketing preference, messages, support history and records of consent or objection.
- Account and profile data: email, account identifier, authentication and security information, seller type and preferences. Authentication providers process credentials under their own role and terms; Seek TCG does not store payment-card details.
- Inventory and financial records: card identifiers, condition, quantity, photographs, notes, cost basis, valuations, prices, marketplace fees, sales and profit/loss information.
- Address and marketplace data: dispatch or home address, marketplace account identifiers, OAuth access and refresh tokens, listings, business policies and, where a feature needs it, limited order data (the exact fields are being finalised with each marketplace).
- Subscription and transaction data: plan, billing channel, purchase and renewal status, invoices, tax/location evidence, credits and AI usage. Stripe or Apple receives and processes payment information.
- Device, usage and security data: IP address, device/browser information, timestamps, security and audit logs, diagnostics and the limited analytics described in the Cookies & storage notice.
- Information in photographs: a card image may incidentally include a person, address, reflection or location metadata. Keep these out of frame where you can; our handling of image location metadata is being finalised with our providers.
We obtain information from you, your device, the providers you choose to connect (including eBay and CardTrader), payment providers, and service-security or analytics providers. If marketplace buyer data is received indirectly, the product provides appropriate just-in-time information and follows the marketplace’s data-protection terms.
3. Purposes and lawful bases
| Purpose | Information used | UK GDPR basis |
|---|---|---|
| Run the waitlist and send requested launch updates | Email, preference and consent record | Consent for electronic marketing; legitimate interests may apply to handling a direct enquiry |
| Answer support or legal enquiries | Contact and support records | Legitimate interests in responding and operating the service; contract where the request concerns an account |
| Create and secure an account | Account, authentication, device and security data | Contract; legitimate interests in service security and fraud prevention |
| Identify, assess and manage cards | Inventory, photographs and settings | Contract |
| Provide estimates, records and user-requested recommendations | Inventory, price, fee and profit data | Contract |
| Connect a marketplace and perform a confirmed action | OAuth tokens, listing, address and relevant marketplace data | Contract; OAuth permission authorises access but is not relied on as GDPR consent |
| Administer subscriptions, credits, invoices and tax records | Account, purchase, usage and location/tax evidence | Contract and legal obligation |
| Diagnose faults, prevent abuse and maintain audit records | Device, usage, security and action logs | Legitimate interests in reliable and secure operation; legal obligation where applicable |
| Produce aggregate service-improvement statistics | Limited usage/device data | Legitimate interests or consent under UK GDPR, with a separate PECR/storage-access assessment |
| Establish or defend legal claims and comply with regulators | Relevant account, transaction and log data | Legitimate interests and legal obligation |
Where information is required to create an account, provide a selected feature, take a confirmed marketplace action or bill a plan, failing to provide it may mean that feature cannot be supplied.
Before relying on legitimate interests, we document the interest, necessity and balancing assessment. We will not use card photographs or account content to train Seek TCG or a third-party model unless that use has first been separately assessed and communicated and, where required, you have given a genuinely optional, specific consent.
4. AI-assisted processing
When you ask Seek TCG to identify a card or assess visible condition evidence, relevant photographs and card details are sent to our AI provider, OpenAI, L.L.C.. Results are automated estimates and may be wrong. You must review them before relying on them or publishing a listing.
Seek TCG does not make a decision based solely on automated processing that produces legal or similarly significant effects about an individual.
5. Recipients and data-protection roles
We disclose only the information needed for the relevant purpose. Our providers include:
- Supabase — database, authentication and storage (processor).
- Vercel — application hosting and privacy-friendly analytics (processor).
- Resend — transactional and waitlist email delivery (processor).
- OpenAI, L.L.C. — card identification and condition assessment, at launch (processor).
- Stripe and Apple — subscription, payment, fraud, tax and platform administration.
- eBay, CardTrader and any other marketplace you deliberately connect.
- Catalogue, market-data and grading providers where a feature requires a card identifier or other limited query.
- Professional advisers, insurers, courts, regulators, law enforcement or a buyer of the business where disclosure is lawful and necessary.
Stripe, Apple, eBay, CardTrader and similar providers may act as independent controllers for some payment, fraud, compliance or marketplace activities; their own privacy notices apply to those activities. The complete, named list with each provider’s role and processing location is being finalised and will be published here.
6. International transfers
Some recipients may process information outside the UK and, if applicable, the EEA. Before making a restricted transfer, we identify the contracting recipient and location and use an applicable UK adequacy regulation (including a valid data-bridge certification where in scope) or an appropriate safeguard such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, completing the required transfer assessment. Contact hello@seektcg.com for information about the safeguard relevant to a specific recipient.
7. Retention
We keep information only for as long as needed for the stated purpose, including legal, accounting, security and dispute requirements:
| Category | Period or criterion |
|---|---|
| Waitlist and launch-marketing record | Until the launch campaign ends or consent is withdrawn; retain a minimal suppression record where needed to honour an objection |
| Support records | 24 months after closure, unless a dispute or legal duty requires longer |
| Account, inventory and unpublished photographs | While the account is active; production deletion within 30 days of a valid deletion request or account closure |
| Marketplace OAuth tokens | Until disconnect or account closure, then revoke and delete promptly |
| Security and access logs | 90 days, unless preserved for an active incident or legal claim |
| Invoices, tax and accounting records | Six years, or the applicable statutory period |
| Contract acceptance, consent and cancellation evidence | The relevant limitation/compliance period |
| Backups | A fixed rolling backup window (being confirmed), after which deleted data ages out |
| AI provider inputs and outputs | The contracted provider retention period (being confirmed) |
| Marketplace and API data | The shortest period permitted by the relevant provider agreement; eBay-specific deletion and freshness rules take priority |
An account deletion request does not automatically cancel an Apple or web subscription and does not permit deletion of records that must be retained by law. The product explains and handles both actions.
8. Your rights
Subject to the conditions and exceptions in data-protection law, you may ask us to:
- give you access to your personal data and information about its use;
- correct inaccurate or incomplete data;
- erase data;
- restrict processing;
- provide data you supplied in a portable format; or
- stop processing based on legitimate interests.
You have the right to object at any time to direct marketing. Where processing is based on consent, you may withdraw that consent at any time without affecting earlier lawful processing.
Contact hello@seektcg.com. We may need reasonable proof of identity. We normally respond within one month, subject to lawful extensions. You may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. If EU law applies, you may also complain to your local supervisory authority.
9. Security
We use proportionate technical and organisational safeguards, including encryption in transit and at rest, least-privilege access, token encryption, secrets management, audit logging, backups, and incident response. No system is completely secure. Marketplace passwords are never collected; connections use marketplace-controlled OAuth and are revocable from account settings.
10. Children
Seek TCG is intended for users aged 18 or over. We do not knowingly provide accounts to children. If you believe a child has provided personal data, contact us.
11. Cookies and device storage
See the Cookies & storage notice. Where a non-exempt technology requires consent, it will not run until consent is given, and consent can be withdrawn as easily as it was given.
12. Changes
We will publish material changes before they take effect and notify account holders where appropriate. If a new purpose is incompatible with the purpose originally communicated, we will identify a valid legal basis and provide any required choice before starting it.
Seek TCG is an independent inventory and listing tool. It is not affiliated with, sponsored by, approved by, or endorsed by The Pokémon Company, Nintendo, Wizards of the Coast, Hasbro, Konami, Bandai, Disney, Ravensburger, eBay, CardTrader, or any grading company (including PSA, Beckett/BGS, and CGC). Product and company names are used only to identify compatibility. All trade marks belong to their respective owners.