Privacy Policy
This is a non-binding translation; the German version is legally authoritative.
1. Controller
The party responsible for data processing on this website is:
Andreas Härtel · Rheinstrasse 2, 64319 Pfungstadt · Email: support@lumex-tcg.de
2. What data we process
Account & tenant: When registering, we process your email address and a (hashed) password (Art. 6 para. 1 lit. b GDPR). Lumex Pro is tenant-separated (Row-Level Security) — every merchant account only ever sees its own data.
Card scans: When uploading a scan batch, we process the card photos you upload to recognize them automatically (server-side hash matching against our card database — no transmission to an external AI provider). We store both your original photo and a compressed preview copy generated from it for the review screen; both are tenant-isolated. A daily automated run checks whether a photo has been stored for more than 28 days and deletes it on its next pass — regardless of account status, and regardless of whether you have already deleted the associated scan batch in the meantime. In normal operation, this means both copies are deleted no later than 30 days after upload (Art. 5 para. 1 lit. c/e GDPR); recognized card/pricing data is not affected.
Staging & pricing data: We process recognized cards, condition, language, and the derived listing/pricing data to provide you with the export workflow (Art. 6 para. 1 lit. b GDPR – performance of a contract).
Server logs: When you access the page, technically necessary data (IP address, timestamp, user agent) is processed by our hosting provider (Art. 6 para. 1 lit. f GDPR – legitimate interest in operation and security).
3. Processors / Hosting
Vercel: The web app is hosted via Vercel (eu-west-1 region). A data processing agreement is in place with Vercel. Vercel Inc. is headquartered in the USA; control-plane and support data may be processed there. The transfer is safeguarded via the EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses.
Vercel Web Analytics & Speed Insights: Collects aggregated, cookie-less visit and performance data (e.g. pages viewed, load times) without cross-site user tracking; inactive during local development. Covered by the same data processing agreement with Vercel as for hosting (Art. 6 para. 1 lit. f GDPR – legitimate interest in operational optimization).
Supabase: Authentication, database, and storage for uploaded scan images run via Supabase (EU region, eu-west-1). A data processing agreement is in place with Supabase, Row-Level Security restricts access to your own tenant.
Upstash: IP-based rate limiting against abuse (Redis). Your IP address serves as the counter key, expiring after seconds to minutes (Art. 6 para. 1 lit. f GDPR).
Cloudflare: Bot protection (Turnstile) for the public demo (section 8). This transmits technical data, including your IP address, to Cloudflare, Inc. (USA); Cloudflare is certified under the EU-U.S. Data Privacy Framework, and EU Standard Contractual Clauses and a data processing agreement are additionally in place.
4. Cookies
We only use technically necessary cookies to manage your login session. There is no tracking and no advertising.
5. Storage duration
Account data and staging/export data are stored until you delete your account. Scan photos (original and preview copy) are automatically deleted regardless of account status once they have been stored for more than 28 days — the daily check ensures this has happened no later than 30 days after upload (see section 2). Deletion on request to support@lumex-tcg.de.
6. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20), as well as a right to object (Art. 21 GDPR) and a right to lodge a complaint with a supervisory authority (Art. 77 GDPR). Please contact support@lumex-tcg.de.
7. External card content
Card images and reference data for matching originate, among others, from Scryfall. In the process, your IP address may be transmitted to this provider (Art. 6 para. 1 lit. f GDPR).
8. Public demo (/demo)
At /demo we offer a free, time-limited trial of Lumex Pro without registration. In addition to sections 2–6, the following applies.
Bot protection (Cloudflare Turnstile): Before starting a demo, we use Cloudflare Turnstile to verify that a human is accessing the page. This transmits technical data, including your IP address and device/browser information, to Cloudflare, Inc. (USA). Cloudflare is certified under the EU-U.S. Data Privacy Framework, and EU Standard Contractual Clauses and a data processing agreement are additionally in place. The legal basis is our legitimate interest in an abuse-resistant demo (Art. 6(1)(f) GDPR). We also limit how many demo sessions can be started from the same IP address (also Art. 6(1)(f) GDPR).
Your card photos in the demo: If you upload your own photos, we process them the same way as in the real product (section 2): automatic, server-side image matching against our card catalogue, no transmission to an external AI provider, no routine manual review. Your uploads are visible only within your own, isolated demo session. The legal basis is our legitimate interest in letting you try the real product (Art. 6(1)(f) GDPR). Please only upload photos you took yourself that show only the card.
Demo retention period: All data from a demo session — uploaded photos, recognized cards, staging and listing data, and the temporary demo identifier — is automatically and fully deleted no later than 24 hours after the demo starts (the demo runs for 23 hours; an hourly cleanup process removes every session whose 23-hour window has elapsed).