Privacy notice

Version 1.0 · effective 19 August 2026. We keep these policies under review and post material changes here.

In plain English

Seek TCG uses the account, card, photograph, marketplace and subscription information needed to provide the features you choose. We do not sell personal information, use it for third-party advertising or use your card photographs to train AI models. Automated card and condition results are estimates for you to review; they do not make legal or similarly significant decisions about people.

1. Controller and contact

The controller is Benjamin McCarthy-Jones trading as Seek TCG, 2 Ashcombe Road, Merstham, Redhill, RH1 3BY, United Kingdom.

• Privacy and rights requests: hello@seektcg.com
• ICO registration: ZC196591

If the business incorporates, the new company will not be described as controller until the legal transfer, supplier accounts and ICO position have been completed and this notice has been updated.

For account, waitlist, product and service-operation processing, we decide why and how information is used and act as controller. If a business seller instructs us to handle its marketplace buyer’s information solely to provide the service, we act as its processor under the Business Data Processing Schedule.

The ICO fee register currently lists Benjamin McCarthy-Jones as Data Protection Officer, and he is the operational privacy lead. Whether Article 37 legally requires a formal DPO appointment for the processing remains under review; the contact and independence/resources of the role must be kept accurate as the service grows.

2. Information we process

Depending on your use, we process:

• Waitlist, marketing and support: email, preferences, messages, support history and evidence of consent or objection.
• Account and profile: email, account identifier, authentication/security information, seller type and settings. We do not receive your full payment-card details.
• Inventory and financial records: card identifiers, quantity, visible condition, photographs, notes, cost basis, valuations, price, marketplace fees, sales and profit/loss.
• Address and marketplace: dispatch/home address, marketplace account identifiers, OAuth access and refresh tokens, listings, seller/business policies and limited order data where the selected feature requires it.
• Subscription and transaction: plan, billing channel, purchase/renewal status, invoice and tax/location evidence, credits and AI usage. Stripe or Apple handles payment credentials.
• Device, use and security: IP address, device/browser information, timestamps, consent choice, security and audit events, error diagnostics and the limited analytics in our Cookies and Storage Notice.
• Photograph contents: a card image might accidentally include a person, address, reflection or location metadata. Keep unrelated information out of frame. We strip EXIF/location metadata before long-term storage or AI transmission.

We receive information from you and your device; providers you choose to connect, including eBay and CardTrader; payment providers; and security, hosting and analytics providers. Where we receive a marketplace buyer’s information indirectly, access is restricted to the seller’s instruction and the marketplace’s data-protection rules.

3. Why we use information and lawful bases

Where information is required to make an account, provide a selected feature, carry out a confirmed action or bill a plan, not providing it may mean that feature cannot be supplied.

We document a legitimate-interest assessment before relying on legitimate interests. You may object to that processing; we will stop unless we show compelling legitimate grounds or need the information for legal claims.

4. AI-assisted processing

When you request identification or visible-condition analysis, we send the relevant image and minimum card context to the OpenAI API. By default, OpenAI does not use API inputs/outputs to train its models unless the customer opts in; Seek TCG does not opt in. We set supported requests not to persist application state and seek enhanced retention controls where available. Default abuse-monitoring logs may retain customer content for up to 30 days unless a different approved control applies.

Results can be wrong and require your review before use or marketplace publication. Seek TCG does not make a decision based solely on automated processing that has legal or similarly significant effects on an individual. We do not use account content or photographs to train Seek TCG or a third-party model.

5. Who receives information

We disclose only what is needed for the relevant purpose:

• Supabase — database, authentication and private image storage (processor).
• Vercel — hosting and, if enabled under the stated controls, aggregate analytics/performance (processor on a contract/plan covered by its DPA).
• OpenAI — requested card-image identification and visible-condition analysis (processor for API business data).
• Resend — transactional, support and consented email delivery (processor).
• Sentry — security/error diagnostics with request bodies, cookies, query strings and non-allowlisted headers removed; session replay is disabled (processor).
• Stripe — web payment, subscription, fraud and tax administration; processor and/or independent controller depending on the activity.
• Apple — iOS purchase, subscription, storefront tax, fraud and platform administration; role depends on the activity and territory.
• eBay and CardTrader — marketplaces you deliberately connect; each acts under its own terms and may act as an independent controller, while particular buyer-data handling may be governed by a marketplace DPA.
• Catalogue, market-data and grading providers — only a card identifier and minimum technical request data where the feature requires it; no account content unless the register expressly states otherwise.
• Professional advisers, insurers, courts, regulators, law enforcement or a purchaser of the business where lawful and necessary.

Current supplier, role, location, transfer and subprocessor details are maintained in our supplier register. Ask hello@seektcg.com for information relevant to a particular transfer.

6. International transfers

Some recipients and subprocessors are in or can access information from the United States and other countries outside the UK. Before a restricted transfer, we identify the actual recipient and location and use:

• UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework only where the exact US entity and data are in scope; or
• the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with the required data protection test and any supplementary measures.

We review the mechanism, subprocessors, security, deletion and legal-access risk and keep a copy of the applicable safeguard. You may request information about it from hello@seektcg.com.

7. Retention

We may keep a narrowly limited record longer where required by law or to establish, exercise or defend a claim. Account deletion does not erase records we must retain and does not by itself cancel Apple or web billing; the service handles both actions separately.

8. Your rights

Subject to legal conditions and exceptions, you may ask us to:

• give you access to your personal information and information about its use;
• correct inaccurate or incomplete information;
• erase information;
• restrict processing;
• provide information you supplied in a portable format; or
• stop processing based on legitimate interests.

You may object at any time to direct marketing. If processing is based on consent, you may withdraw consent at any time without affecting earlier lawful processing.

Use in-app export/deletion controls or email hello@seektcg.com. We may request proportionate identity evidence. We normally respond within one month, subject to lawful extensions. We pass valid requests to relevant processors and explain any lawful refusal, retention or backup limitation.

You may complain to us first using the same email. You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. If EU GDPR applies, you may complain to your local supervisory authority.

9. Security

We use proportionate measures including encryption in transit and at rest, private-by-account access, least privilege, token encryption, secrets management, audit logging, backups, vulnerability/incident processes and processor due diligence. Marketplace passwords are not collected; connections use marketplace OAuth and can be revoked. No system is completely secure.

10. Children

Seek TCG is for adults aged 18 or over. We do not knowingly provide accounts to children. Contact us if you believe a child supplied information.

11. Cookies and device storage

See the Cookies and Storage Notice. Non-exempt technology does not run until valid consent. Consent can be withdrawn as easily as it was given. Where we rely on the UK statistical-purpose exception, we provide clear information and a simple free objection.

12. EU/EEA users

The current service is UK-first. Before deliberately offering paid services to people in the EEA, we assess EU GDPR territorial scope and Article 27. If a representative is required, we appoint one and publish its details before that offering begins. An England-and-Wales law clause does not remove mandatory local consumer or data-protection rights.

13. Changes

We publish material changes before they take effect and notify account holders where appropriate. A new incompatible purpose requires a valid basis and any required choice before it begins.