Privacy Policy

This is a non-binding translation; the German version is legally authoritative.

1. Controller

The party responsible for data processing on this website is:
[PLACEHOLDER: Name/company] · [PLACEHOLDER: physical address] · Email: support@lumex-tcg.de

2. What data we process

Account & tenant: When registering, we process your email address and a (hashed) password (Art. 6 para. 1 lit. b GDPR). Lumex Pro is tenant-separated (Row-Level Security) — every merchant account only ever sees its own data.

Card scans: When uploading a scan batch, we process the card photos you upload to recognize them automatically (server-side hash matching against our card database — no transmission to an external AI provider). Images are stored tenant-isolated and are automatically deleted no later than 30 days after upload, regardless of account status (Art. 5 para. 1 lit. c/e GDPR); recognized card/pricing data is not affected.

Staging & pricing data: We process recognized cards, condition, language, and the derived listing/pricing data to provide you with the export workflow (Art. 6 para. 1 lit. b GDPR – performance of a contract).

Server logs: When you access the page, technically necessary data (IP address, timestamp, user agent) is processed by our hosting provider (Art. 6 para. 1 lit. f GDPR – legitimate interest in operation and security).

3. Processors / Hosting

Vercel: The web app is hosted via Vercel (eu-west-1 region). A data processing agreement is in place with Vercel.

Supabase: Authentication, database, and storage for uploaded scan images run via Supabase (EU region, eu-west-1). A data processing agreement is in place with Supabase, Row-Level Security restricts access to your own tenant.

Upstash: IP-based rate limiting against abuse (Redis). Your IP address serves as the counter key, expiring after seconds to minutes (Art. 6 para. 1 lit. f GDPR).

4. Cookies

We only use technically necessary cookies to manage your login session. There is no tracking and no advertising.

5. Storage duration

Account data and staging/export data are stored until you delete your account. Scan photos are automatically deleted no later than 30 days after upload, regardless of account status (see section 2). Deletion on request to support@lumex-tcg.de.

6. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20), as well as a right to object (Art. 21 GDPR) and a right to lodge a complaint with a supervisory authority (Art. 77 GDPR). Please contact support@lumex-tcg.de.

7. External card content

Card images and reference data for matching originate, among others, from Scryfall. In the process, your IP address may be transmitted to this provider (Art. 6 para. 1 lit. f GDPR).