> For the complete documentation index, see [llms.txt](https://cardsiq.gitbook.io/cardsiq-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cardsiq.gitbook.io/cardsiq-docs/terms-and-policies/privacy-policy.md). # Privacy Policy How CardsIQ collects, uses, shares, and protects your personal information. This policy is designed to comply with GDPR, CCPA, and other applicable data protection regulations. **Last Updated:** July 21, 2026 ## 1. Introduction CardsIQ, LLC ("CardsIQ," "we," "our," or "us") respects your privacy and is committed to handling personal information responsibly. This Privacy Policy explains how CardsIQ collects, uses, discloses, retains, and protects personal information when you visit or use the CardsIQ website, partner portal, seller experience, software, dashboards, wallet interfaces, verification workflows, inventory tools, repack curation tools, payment and settlement features, and related services (collectively, the **"Platform"**). It also explains the privacy choices and rights that may be available to you. By accessing or using the Platform, you acknowledge that you have read and understand this Privacy Policy. If you do not agree with this Privacy Policy, you should not use the Platform. This Privacy Policy should be read together with the CardsIQ Terms of Service, Cookie Policy, Risk Disclosure Statement, and any additional privacy or product-specific notices presented through the Platform. ## 2. Scope of This Privacy Policy This Privacy Policy applies to personal information CardsIQ processes in connection with: * visitors to CardsIQ websites and documentation; * individuals who create or use Seller accounts; * business customers approved to use the partner portal ("Partners"); * owners, officers, employees, contractors, and authorized users of Partners; * individuals who communicate with CardsIQ; * individuals whose information is submitted for transaction, verification, fraud-prevention, payment, settlement, inventory, or compliance purposes; and * prospective Partners and other business contacts. For purposes of this Privacy Policy, **"personal information"** or **"personal data"** means information that identifies, relates to, describes, is reasonably capable of being associated with, or can reasonably be linked to an individual or household, as defined by applicable law. This Privacy Policy does not apply to information that is lawfully made public, aggregated, de-identified, or otherwise excluded from the definition of personal information under applicable law. ### Partner-Controlled Information In certain situations, a Partner determines why and how personal information is processed through the Platform. For example, a Partner may determine which Sellers it serves, what transaction information it requests, which buyback transactions it approves, or how it uses customer information for its own business operations. In those situations, the Partner may act as an independent controller or business under applicable privacy law, and CardsIQ may process information on the Partner's behalf as a service provider or processor. Questions about a Partner's independent use of personal information should be directed to that Partner. CardsIQ is not responsible for a Partner's privacy practices outside the Platform. ### Third-Party Services The Platform may link to, connect with, or rely on third-party services, including payment processors, identity-verification providers, authentication providers, wallet providers, blockchain networks, market-data providers, marketplaces, and analytics services. Those third parties maintain their own privacy practices. This Privacy Policy does not replace or modify their privacy policies. ## 3. Personal Information We Collect The information we collect depends on how you interact with the Platform, the type of account you use, the features enabled for your account, and the legal or compliance requirements associated with a transaction. ### Account and Contact Information We may collect: * full name; * preferred name; * email address; * telephone number; * mailing or residential address; * username; * account identifier; * profile image; * communication preferences; * account status; * authentication methods; * linked social or login accounts; and * information used for account recovery. ### Partner and Business Information When a Partner applies for or uses the Platform, we may collect information about the business and its representatives, including: * legal business name; * trade name or doing-business-as name; * business address; * website and social-media accounts; * entity type and jurisdiction of formation; * formation documents; * employer identification number or other tax identifiers; * business licenses; * ownership and control information; * beneficial owners; * directors, officers, and authorized representatives; * expected transaction volume; * business model and product categories; * funding source and settlement information; * contract, billing, and subscription information; * team-member roles and permissions; * operational contacts; and * records relating to Partner onboarding, review, approval, restrictions, and termination. ### Identity, KYC, and Compliance Information CardsIQ or a third-party provider may collect information needed to verify identity, verify a business, prevent fraud, satisfy know-your-customer requirements, conduct anti-money-laundering review, screen sanctions, or comply with law. This information may include: * legal name; * date of birth; * nationality; * country of residence; * residential address; * government-issued identification; * identification-document number; * document image; * facial image, selfie, or liveness information; * Social Security number; * taxpayer identification number; * employer identification number; * beneficial-ownership information; * source-of-funds or source-of-wealth information; * bank-account ownership information; * sanctions and watchlist screening results; * identity-verification status; * fraud and risk indicators; * device and network information used for verification; * compliance-review notes; and * supporting documents requested during enhanced due diligence. Some of this information may qualify as sensitive personal information under applicable law. Payment providers and identity-verification providers may collect this information directly from you. CardsIQ may receive verification results, risk signals, status information, limited identity data, or other information needed to operate and secure the Platform. ### Seller and Transaction Information When a Seller submits or completes a buyback transaction, we may collect: * Partner associated with the transaction; * transaction identifier; * collectible description; * grading company; * certification number; * grade; * product category; * images or supporting documentation; * submission time; * offer amount; * estimated market value; * transaction status; * acceptance, approval, rejection, or cancellation history; * verification records; * transaction notes; * settlement amount and status; * payout destination; * associated wallet address; * marketplace username; * live-sale, break, or purchase information; * ownership information; * invoices, receipts, or proof of purchase; * dispute and support records; and * information about suspected duplicate submissions, fraud, counterfeit activity, or account abuse. ### Marketplace Account Information The Platform may allow a Seller to connect or verify an account maintained with a third-party live-shopping, marketplace, social-commerce, breaking, or collectibles platform. Depending on the verification method, we may collect: * marketplace name; * username or handle; * profile URL; * account identifier; * exact capitalization and formatting of the username; * verification code; * screenshot or profile evidence; * account-connection status; * date and method of verification; * information returned through a supported integration; * public profile information; * transaction or purchase history supplied by the Seller or Partner; and * records of manual review. Marketplace-account verification does not give CardsIQ access to a third-party account password unless a provider expressly requires and processes authentication through its own interface. You should never send your third-party password to CardsIQ by email, direct message, or support chat. ### Payment, Settlement, and Financial Information When you use payment or settlement features, CardsIQ and its payment providers may collect or process: * bank-account information; * routing information; * payment-card information; * payment token; * billing address; * transaction amount; * currency; * deposit information; * payout information; * withdrawal information; * settlement status; * fees; * refunds; * reversals; * chargebacks; * reserves; * payment-provider account identifiers; * payment risk information; * tax information; * wallet address; and * blockchain transaction identifiers. CardsIQ generally does not directly store complete payment-card numbers when they are collected and processed by a payment provider. The payment provider's privacy policy applies to information it collects directly. ### Wallet and Blockchain Information The Platform may create, connect, administer, or display digital wallets through third-party wallet infrastructure. We may collect or process: * public wallet address; * wallet identifier; * wallet type; * wallet ownership or association; * supported blockchain network; * token balances displayed through the Platform; * transaction hash; * transaction instructions; * signatures or signature status; * transaction timestamps; * transaction confirmation or finality status; * smart-contract or program interactions; * associated Platform account; * wallet-risk or sanctions information; and * wallet activity needed to support settlement, reconciliation, security, or compliance. We do not need to know a private key in order to view information recorded on a public blockchain. Certain wallet infrastructure providers may use specialized key-management systems. Their privacy and security practices are governed by their own terms and policies. ### Inventory Information Partners may upload, create, or manage inventory records through the Platform. Inventory information may include: * collectible name and description; * category; * grading company; * certification number; * grade; * quantity; * acquisition source; * acquisition cost; * estimated value; * last sale; * status; * availability; * location or custody note; * image; * internal SKU or label; * repack allocation; * transaction association; * notes; * owner or authorized user responsible for the record; and * edit and activity history. Inventory information may be business information rather than personal information. It may become personal information when it is linked to an identifiable Seller, owner, employee, or transaction. ### Repack Curation Information When Partners use repack curation or product-management tools, we may collect: * product name; * product configuration; * included inventory; * value ranges; * floor and ceiling values; * product quantity; * pricing; * allocation rules; * category and grading data; * product notes; * images; * labels; * authorized users involved in curation; * creation and modification history; * marketplace or distribution information; and * related analytics. ### Market Data and Valuation Information CardsIQ may collect, license, receive, generate, or analyze: * recent sales; * historical sales; * auction results; * marketplace transactions; * asking prices; * grading population data; * certification information; * item images and metadata; * estimated market values; * price trends; * liquidity indicators; * confidence scores; * outlier flags; * comparable sales; * grade relationships; * valuation explanations; and * Partner or Platform transaction data. Market data may come from public sources, Partners, Sellers, marketplaces, grading companies, and providers such as Alt, Card Ladder, GemRate, or other data providers. ### Communications and Support Information We collect information you provide when you contact us, including: * emails; * support tickets; * chat messages; * survey responses; * feedback; * call notes; * dispute records; * attachments; * screenshots; * bug reports; * feature requests; and * information shared through social media or business communications. We may retain communications for support, quality, training, compliance, fraud prevention, dispute resolution, and legal purposes. ### Marketing and Business-Development Information For prospective Partners, vendors, and business contacts, we may collect: * name; * title; * company; * business email; * business telephone number; * professional profile; * areas of interest; * meeting information; * correspondence; * referral source; * relationship history; and * marketing preferences. ### Information About Other People You may provide information about another person, such as a beneficial owner, authorized user, employee, business representative, collectible owner, or transaction participant. You represent that you are authorized to provide that information and that you have provided any notice or obtained any consent required by law. ## 4. Information We Collect Automatically When you visit or use the Platform, we and our service providers may automatically collect information through cookies, software development kits, server logs, pixels, local storage, and similar technologies. ### Device and Network Information We may collect: * IP address; * approximate location derived from IP address; * browser type; * browser language; * device type; * device identifier; * operating system; * screen size; * referring URL; * network information; * internet-service provider; * mobile carrier; * time zone; and * device and browser settings. ### Usage and Activity Information We may collect: * pages and screens viewed; * features used; * links clicked; * searches; * navigation path; * session date and time; * session duration; * login activity; * button interactions; * errors and crashes; * performance information; * form progress; * transaction workflow activity; * inventory actions; * approval actions; * permission changes; * report and export activity; and * other interactions with the Platform. ### Security and Fraud Information We may automatically generate or collect: * authentication events; * failed login attempts; * session identifiers; * device-risk indicators; * IP reputation; * proxy or VPN indicators; * geolocation inconsistencies; * unusual activity; * duplicate-account signals; * transaction velocity; * behavioral signals; * wallet-risk indicators; * sanctions signals; * account-linking information; * fraud scores; * review outcomes; and * audit logs. ### Cookies and Similar Technologies We use cookies and similar technologies as described in the Cookies and Tracking Technologies section and our Cookie Policy. ## 5. Information We Receive from Other Sources We may combine information received from third parties with information collected directly through the Platform. ### Partners Partners may provide Seller, transaction, inventory, marketplace, verification, dispute, and business information necessary to operate their programs through the Platform. ### Payment and Compliance Providers Providers such as Coinflow may provide: * onboarding status; * identity-verification status; * business-verification status; * payment and payout status; * transaction records; * risk and fraud indicators; * chargeback or reversal information; * compliance restrictions; * account identifiers; * wallet and settlement information; and * information required to support, reconcile, or investigate transactions. ### Authentication and Wallet Providers Providers such as Privy may provide or process: * authentication identifiers; * linked login methods; * account identifiers; * wallet addresses; * wallet configuration; * login and recovery activity; * account status; * device or session information; and * information needed to support authentication or wallet functionality. ### Market-Data Providers Providers such as Alt, Card Ladder, GemRate, marketplaces, grading companies, or auction platforms may provide: * card or collectible information; * certification information; * recent and historical sales; * images; * grade information; * population data; * estimated values; * market trends; * transaction metadata; and * data-provider identifiers. ### Third-Party Marketplaces and Connected Services Where a supported connection is available and authorized, we may receive: * profile information; * username; * account identifier; * public account information; * verification status; * purchase or transaction information; * token or authorization status; and * other information permitted by the connection. ### Public Sources We may collect information from publicly available sources, including: * public marketplace profiles; * public social-media profiles; * public blockchain records; * grading-company certification lookups; * public business registrations; * sanctions and watchlists; * public auction results; * public court or regulatory records; and * other lawfully available sources. ### Fraud, Identity, and Security Providers We may receive information used to detect fraud, verify identity, assess transaction risk, prevent abuse, screen sanctions, protect accounts, and secure the Platform. ## 6. How We Use Personal Information We use personal information for the purposes described below. ### Providing and Operating the Platform We use information to: * create and administer accounts; * authenticate users; * provide Partner and Seller experiences; * support buyback transactions; * display and manage inventory; * support repack curation; * maintain ledgers and transaction records; * provide dashboards, reporting, and analytics; * operate wallets and settlement workflows; * provide account and transaction notifications; * maintain user roles and permissions; and * provide requested features and services. ### Processing Buyback Transactions We use information to: * create transaction records; * associate Sellers and Partners; * generate or display offers; * support approval and rejection workflows; * verify collectible and transaction details; * reserve or settle funds; * process payments and payouts; * track transaction status; * reconcile balances; * investigate disputes; and * correct errors, duplicates, reversals, or failed transactions. ### Identity Verification and Compliance We use information to: * verify identity; * verify businesses and beneficial owners; * complete KYC and AML review; * screen sanctions and watchlists; * assess source of funds; * satisfy tax-reporting requirements; * respond to legal process; * comply with provider requirements; * prevent prohibited transactions; and * meet legal and regulatory obligations. ### Fraud Prevention, Safety, and Security We use information to: * protect accounts; * detect unauthorized access; * identify suspicious activity; * identify duplicate submissions; * investigate counterfeit or stolen collectibles; * detect market manipulation; * identify account or wallet links; * prevent chargebacks and payment abuse; * enforce transaction limits; * monitor system security; * protect CardsIQ, Partners, Sellers, and third parties; and * enforce our agreements and policies. ### Market Data, Pricing, and Valuation Tools We use information to: * retrieve and display recent sales; * normalize data from multiple providers; * identify comparable transactions; * calculate estimated values; * analyze grade relationships; * identify outliers; * measure liquidity; * generate confidence scores; * support pricing recommendations; * improve valuation methodologies; and * help Partners make independent purchasing and inventory decisions. ### Analytics and Product Improvement We use information to: * understand Platform usage; * monitor performance; * identify errors; * improve workflows; * improve onboarding; * develop new features; * conduct research; * generate aggregated benchmarks; * improve reporting; * evaluate product adoption; and * measure operational performance. ### Artificial Intelligence and Automated Tools CardsIQ may use artificial intelligence, machine learning, statistical models, automated rules, and similar technologies to: * estimate collectible values; * identify comparable sales; * detect outliers or manipulated data; * assess liquidity; * recommend transaction review; * detect fraud; * identify duplicate submissions; * prioritize support or compliance review; * summarize or categorize operational information; * improve search and matching; * enhance reporting; and * develop or improve Platform features. Automated tools may produce incorrect or incomplete outputs. CardsIQ does not intend to make decisions producing legal or similarly significant effects solely through automated processing unless permitted by law and accompanied by appropriate safeguards. Partners remain responsible for their independent purchasing, approval, inventory, pricing, repack, and compliance decisions. ### Communications We use information to send: * account notices; * authentication messages; * security alerts; * transaction updates; * verification requests; * payment and settlement information; * service and maintenance notices; * legal and policy updates; * support responses; * administrative communications; * surveys; and * marketing communications where permitted. You may opt out of promotional emails using the unsubscribe mechanism in the email. You may continue to receive transactional, legal, security, and service communications. ### Billing and Contract Administration For Partners, we use information to: * administer Partner agreements; * invoice fees; * process payments; * apply credits; * collect amounts due; * maintain subscription records; * manage minimum commitments or balance requirements; and * communicate about the commercial relationship. ### Legal Claims and Enforcement We use information to: * enforce our agreements; * investigate violations; * resolve disputes; * establish, exercise, or defend legal claims; * protect our rights and property; * respond to legal requests; and * cooperate with regulators, law enforcement, courts, and payment networks. ### Corporate Transactions We may use information to evaluate or complete a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar corporate transaction. ## 7. Legal Bases for Processing This section applies where a privacy law requires CardsIQ to identify a legal basis for processing personal data, including where the General Data Protection Regulation or United Kingdom data-protection law applies. Depending on the context, we process personal data based on: ### Performance of a Contract We process information when necessary to: * create and administer an account; * provide the Platform; * process transactions; * provide payment and settlement features; * provide support; * administer a Partner agreement; and * deliver requested services. ### Legitimate Interests We process information when necessary for legitimate interests that are not overridden by your rights, including: * securing the Platform; * detecting fraud; * preventing abuse; * improving products; * analyzing performance; * maintaining business records; * communicating with business contacts; * enforcing agreements; * protecting legal rights; and * developing valuation, liquidity, and analytical tools. ### Legal Obligations We process information when necessary to comply with: * KYC and AML requirements; * sanctions laws; * tax reporting; * court orders; * regulatory requests; * recordkeeping requirements; * consumer-protection requirements; and * other applicable legal obligations. ### Consent We rely on consent where required, including for certain: * marketing communications; * optional cookies; * connected-account permissions; * collection of information requiring consent under local law; and * other purposes explained at the time consent is requested. You may withdraw consent at any time, but withdrawal does not affect processing already completed and may prevent use of a feature that depends on the information. ### Protection of Vital Interests and Public Interest In limited situations, we may process information to protect a person's vital interests or perform a task in the public interest as recognized by applicable law. ## 8. How We Disclose Personal Information We may disclose personal information as described below. ### Partners We disclose information to the Partner associated with a Seller's transaction or account experience. Information shared with a Partner may include: * name and contact information; * marketplace username; * transaction information; * collectible information; * verification status; * offer acceptance; * settlement status; * support or dispute information; * fraud or risk information where appropriate; and * other information needed to complete or manage the Partner's transaction. Partners may use this information for their own business, legal, support, fraud-prevention, accounting, and compliance purposes. Their independent use is governed by their own privacy obligations. ### Payment, KYC, and Compliance Providers We disclose information to Coinflow and other providers that support: * payment processing; * deposits; * payouts; * settlement; * identity verification; * business verification; * KYC and AML compliance; * sanctions screening; * fraud prevention; * chargeback management; * tax reporting; and * financial reconciliation. ### Authentication and Wallet Providers We disclose information to Privy and other providers that support: * authentication; * account recovery; * embedded wallets; * wallet creation; * key-management infrastructure; * transaction signing; * access controls; and * wallet security. ### Market-Data Providers We may send collectible identifiers, certification numbers, grades, search information, and other query data to market-data providers to retrieve sales, valuation, population, and collectible information. ### Service Providers We disclose information to vendors that provide: * cloud hosting; * database services; * security; * fraud prevention; * identity verification; * communications; * email; * analytics; * customer support; * document storage; * error monitoring; * professional services; * billing; * accounting; and * other services needed to operate CardsIQ. Service providers are authorized to process information only for contracted purposes, subject to applicable agreements and law. ### Marketplaces and Connected Services At your direction or where necessary to verify an account or transaction, we may exchange information with supported marketplaces or connected services. ### Professional Advisors We may disclose information to lawyers, accountants, auditors, insurers, consultants, and other professional advisors. ### Legal and Regulatory Disclosures We may disclose information when we believe disclosure is reasonably necessary to: * comply with law; * respond to a subpoena, court order, warrant, or legal process; * respond to a regulator, tax authority, law-enforcement agency, or government request; * enforce our agreements; * investigate fraud or illegal conduct; * protect the rights, property, security, or safety of CardsIQ or others; * prevent financial loss; or * establish, exercise, or defend legal claims. ### Corporate Transactions If CardsIQ is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, personal information may be disclosed to counterparties, advisors, investors, lenders, or successors, subject to appropriate protections. ### With Your Direction or Consent We may disclose information when you direct us to do so or provide consent. ### Aggregated and De-Identified Information We may disclose information that has been aggregated or de-identified so that it cannot reasonably be linked to an individual, subject to applicable law. ## 9. Sale, Sharing, and Targeted Advertising CardsIQ does not sell personal information for money. CardsIQ does not knowingly sell or share personal information of individuals under sixteen years of age. Some privacy laws define "sale," "sharing," or "targeted advertising" broadly enough to include certain disclosures involving advertising cookies, cross-context behavioral advertising, or analytics providers. If CardsIQ uses technology that constitutes sale, sharing, or targeted advertising under applicable law, we will provide any legally required notice and opt-out method, which may include a **Do Not Sell or Share My Personal Information** link, cookie-preference tool, or recognition of qualifying browser-based opt-out preference signals. Our current Platform is primarily a business and transaction platform. CardsIQ does not use KYC information, government identification, complete payment credentials, or private transaction documentation for cross-context behavioral advertising. ## 10. Cookies and Tracking Technologies CardsIQ and its service providers may use cookies, pixels, local storage, software development kits, and similar technologies. ### Essential Technologies Essential technologies support: * account login; * authentication; * session management; * security; * fraud prevention; * transaction workflows; * load balancing; * preferences required for operation; and * other core Platform functionality. These technologies generally cannot be disabled through our preference tools because the Platform may not function without them. ### Functional Technologies Functional technologies remember preferences and improve convenience, such as: * language; * display settings; * prior selections; * account preferences; and * customized Platform experiences. ### Analytics and Performance Technologies Analytics technologies help us understand: * how users interact with the Platform; * which features are used; * performance and errors; * navigation patterns; * conversion and onboarding; * aggregate demographics or device types; and * how to improve the Platform. ### Advertising Technologies CardsIQ may use advertising or attribution technologies to understand the effectiveness of campaigns or show relevant information. Where required, non-essential advertising technologies will be subject to consent or opt-out rights. ### Managing Cookies You may manage cookies through: * the Platform's cookie-preference tool, where available; * your browser settings; * device settings; or * an applicable opt-out mechanism. Blocking cookies may affect Platform functionality. For more information, review the CardsIQ Cookie Policy. ### Global Privacy Control Where required by applicable law, CardsIQ will process a supported Global Privacy Control signal or other legally recognized opt-out preference signal as a request to opt out of applicable sale, sharing, or targeted advertising for the browser or device sending the signal. ## 11. Blockchain and Wallet Privacy Blockchain networks are designed to record and make transaction information available to network participants and the public. ### Public Blockchain Records Information recorded on Solana or another public blockchain may include: * wallet address; * token balance; * transaction hash; * transferred amount; * timestamp; * program or smart-contract interaction; * transaction instructions; * fees; and * transaction status. Blockchain records may be permanently available and may be copied, indexed, analyzed, or linked to other information by third parties. ### Limits on Deletion and Correction CardsIQ does not control public blockchain networks and generally cannot delete, correct, reverse, or make private information already recorded on a blockchain. A request to delete an account or personal information may not result in deletion of blockchain records. CardsIQ may instead delete or restrict the off-chain information under its control that links an individual to a public wallet address, where legally permitted and operationally feasible. ### Wallet Addresses and Identity A wallet address may appear pseudonymous, but transaction history and other data may allow third parties to associate it with an individual or entity. You should not assume blockchain activity is anonymous. ### Blockchain Analytics CardsIQ and its providers may analyze wallet and blockchain activity for: * settlement; * reconciliation; * fraud prevention; * sanctions screening; * security; * compliance; * transaction support; and * risk management. ## 12. Artificial Intelligence, Models, and Automated Processing CardsIQ may use personal information and Platform Data to develop, operate, evaluate, and improve automated tools. ### Data Used by Models Depending on the purpose, model inputs may include: * collectible metadata; * recent and historical sales; * Partner transaction data; * inventory information; * grade information; * certification information; * liquidity indicators; * transaction patterns; * account activity; * device and network signals; * wallet information; * fraud indicators; and * support or operational information. CardsIQ seeks to minimize the use of directly identifying information when it is not needed for the model's purpose. ### Valuation and Market Models Models may be used to: * estimate fair market value; * identify comparable sales; * evaluate grade relationships; * detect outliers; * measure confidence; * estimate liquidity; * identify manipulated sales; and * support Partner pricing decisions. Valuation outputs are estimates and may be inaccurate. ### Fraud and Risk Models Automated tools may be used to: * detect unusual behavior; * identify duplicate accounts or submissions; * prioritize review; * detect transaction anomalies; * assess payment risk; * identify possible sanctions exposure; and * protect accounts. A model output may result in additional review, a request for information, a temporary hold, or a recommendation. CardsIQ or the applicable provider may make the final decision, subject to applicable law. ### Human Review and Rights Where applicable law gives you a right relating to a decision based solely on automated processing that produces legal or similarly significant effects, you may request information, human review, or another available safeguard by contacting . ## 13. Data Retention CardsIQ retains personal information for as long as reasonably necessary for the purposes described in this Privacy Policy. Retention periods depend on: * the type of information; * the relationship with the user; * the status of an account or Partner agreement; * legal and regulatory requirements; * payment-provider requirements; * tax and accounting obligations; * fraud-prevention needs; * dispute and litigation risk; * blockchain-record limitations; * security needs; and * technical backup cycles. ### General Retention Guidelines Subject to applicable law and operational requirements, CardsIQ generally applies the following guidelines: * **Account and profile information:** retained while the account is active and for a reasonable period afterward. * **Partner contracts and commercial records:** retained for the duration of the relationship and generally for at least seven years afterward. * **Transaction, payment, settlement, ledger, and tax records:** generally retained for at least seven years after the transaction or longer if required by law or a provider. * **KYC, AML, sanctions, and compliance records:** retained for the period required by applicable law, provider requirements, and risk controls, which may extend at least five years after the relationship or transaction. * **Fraud, security, and abuse records:** retained for as long as reasonably necessary to protect the Platform and prevent recurrence. * **Support and dispute records:** retained for the duration of the issue and a reasonable period afterward. * **Marketing records:** retained until consent is withdrawn, an opt-out is recorded, or the information is no longer needed. * **Cookie and analytics data:** retained according to the lifespan of the applicable cookie or provider configuration. * **Backups:** retained through ordinary backup and disaster-recovery cycles. * **Blockchain information:** may remain permanently available on the relevant public blockchain. These periods are guidelines, not guarantees that every record will be retained for a minimum period. CardsIQ may delete information earlier when it is no longer needed and may retain information longer when reasonably necessary or legally required. ### Account Closure Closing an account does not require CardsIQ to delete information needed to: * complete pending transactions; * maintain transaction records; * comply with law; * satisfy provider requirements; * prevent fraud; * resolve disputes; * enforce agreements; * protect legal rights; or * preserve blockchain and audit integrity. ## 14. Data Security CardsIQ uses administrative, technical, and organizational safeguards designed to protect personal information. Depending on the system and information, safeguards may include: * access controls; * authentication; * multifactor authentication; * encryption in transit; * encryption at rest where appropriate; * role-based permissions; * logging and monitoring; * vendor review; * security testing; * backups; * incident-response procedures; * employee confidentiality obligations; and * segregation of responsibilities. No method of transmission, storage, authentication, wallet management, or security is completely secure. CardsIQ cannot guarantee absolute security. You are responsible for protecting your credentials, devices, login methods, connected accounts, and recovery information. Report suspected unauthorized access or security incidents promptly to . ## 15. International Data Transfers CardsIQ is based in the United States. Personal information may be processed in the United States and other countries where CardsIQ or its service providers operate. Those countries may have privacy laws that differ from the laws of your country. Where required by applicable law, CardsIQ uses recognized safeguards for cross-border transfers, which may include: * adequacy decisions; * standard contractual clauses; * contractual commitments; * approved certifications; * supplementary security measures; or * another lawful transfer mechanism. You may contact for information about an applicable transfer safeguard. ## 16. Your Privacy Choices and Rights Depending on where you live and subject to applicable exceptions, you may have the right to: * know whether we process your personal information; * access personal information; * receive information about categories, sources, purposes, and recipients; * correct inaccurate information; * request deletion; * obtain a portable copy; * restrict processing; * object to processing; * opt out of sale, sharing, or targeted advertising; * limit certain uses of sensitive personal information; * withdraw consent; * opt out of certain automated decision-making; * appeal a denied request; and * lodge a complaint with a privacy regulator. These rights are not absolute. We may deny or limit a request where permitted by law, including when information is needed for legal compliance, fraud prevention, transaction records, security, tax reporting, dispute resolution, or the rights of others. ### How to Submit a Request Submit a privacy request by emailing . Please include: * your name; * the email associated with your account; * the right you want to exercise; * your state or country of residence; and * information reasonably necessary to locate your records. Do not send a Social Security number, password, private key, seed phrase, or complete payment-card number by email. ### Verification of Requests We may verify your identity before completing a request. Verification may require: * confirmation through the account email; * authentication into the account; * matching information already held by CardsIQ; * proof of authority; or * additional information reasonably necessary to prevent fraudulent requests. We will use information provided for verification only to process and document the request. ### Authorized Agents Where permitted by law, an authorized agent may submit a request on your behalf. We may require: * signed authorization; * proof the agent is registered where required; * direct identity verification; and * confirmation that you authorized the request. ### Appeals If applicable law provides a right to appeal, you may appeal a denied request by emailing and writing **Privacy Appeal** in the subject line. ### Non-Discrimination CardsIQ will not unlawfully discriminate against you for exercising a privacy right. We may offer features or pricing differences that are reasonably related to the value of data or permitted by law, subject to any required notice or consent. ### Marketing Preferences You may unsubscribe from promotional emails using the link in the email. You may still receive: * transaction messages; * account notices; * security alerts; * legal notices; * service communications; and * communications necessary to administer a Partner relationship. ### Account and Connected-Service Controls You may be able to: * update account information; * remove certain authentication methods; * disconnect supported third-party accounts; * manage Partner-authorized users; * change notification preferences; or * request account closure. Disconnecting a service does not delete information already received and retained for legitimate purposes. ## 17. California Privacy Notice This section supplements the rest of this Privacy Policy for California residents and applies only to the extent CardsIQ is subject to the California Consumer Privacy Act, as amended ("CCPA"), for the relevant processing. Terms defined by the CCPA have the same meaning in this section. ### Categories of Personal Information During the preceding twelve months, CardsIQ may have collected the following categories: | CCPA Category | Examples | | ------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Identifiers | Name, email, telephone number, address, username, IP address, account identifier, government identification, wallet address | | Customer records information | Contact information, payment information, business information, tax information | | Protected classification information | Age or date of birth, nationality, or other information collected for identity and compliance purposes | | Commercial information | Transaction history, offers, inventory, products, payment and settlement history | | Internet or electronic activity | Browsing, login, device, usage, interaction, and security logs | | Geolocation information | Approximate location based on IP address and location signals used for security or compliance | | Audio, electronic, visual, or similar information | Support communications, identification images, collectible images, screenshots | | Professional or employment information | Employer, title, business role, authorized-user status | | Inferences | Fraud indicators, risk scores, preferences, usage trends, valuation and liquidity indicators | | Sensitive personal information | Government identification, account credentials, precise financial information, Social Security or tax identifiers, and identity-verification data where collected | We collect these categories from the sources and for the purposes described throughout this Privacy Policy. ### Disclosure for Business Purposes During the preceding twelve months, CardsIQ may have disclosed the categories above to: * Partners; * payment and compliance providers; * identity and fraud providers; * authentication and wallet providers; * market-data providers; * cloud and software providers; * analytics and communications providers; * professional advisors; * regulators and government authorities; and * parties involved in a corporate transaction. Disclosures are made for the business and commercial purposes described in this Privacy Policy. ### Sale and Sharing CardsIQ does not sell personal information for money. CardsIQ does not knowingly sell or share the personal information of consumers under sixteen. If CardsIQ engages in activity considered a sale or sharing under the CCPA, California residents may opt out through any method CardsIQ makes available, including a Do Not Sell or Share link, cookie-preference tool, or recognized opt-out preference signal. ### Sensitive Personal Information CardsIQ uses sensitive personal information for purposes reasonably necessary to provide the Platform, process transactions, verify identity, prevent fraud, secure accounts, comply with law, and perform other purposes permitted without a right to limit under the CCPA. If CardsIQ uses sensitive personal information for additional purposes that trigger a right to limit, CardsIQ will provide the required notice and method. ### California Rights Subject to applicable exceptions, California residents may have the right to: * know the categories and specific pieces of personal information collected; * know the sources, purposes, and categories of recipients; * request correction; * request deletion; * opt out of sale or sharing; * limit certain uses of sensitive personal information; and * receive equal treatment for exercising rights. Requests may be submitted through the process described in Your Privacy Choices and Rights. ### California Shine the Light California Civil Code Section 1798.83 may allow California residents to request certain information regarding disclosures of personal information to third parties for their direct-marketing purposes. CardsIQ does not disclose personal information to third parties for their own direct marketing in the manner contemplated by that law without providing an applicable choice. ## 18. Privacy Rights in Other U.S. States Residents of states with comprehensive consumer privacy laws may have rights similar to those described above, including access, correction, deletion, portability, opt-out, and appeal rights. Depending on the applicable state law, you may have the right to opt out of: * targeted advertising; * sale of personal data; * certain profiling in furtherance of decisions producing legal or similarly significant effects; and * certain processing of sensitive data. CardsIQ will process verified requests as required by applicable law. ## 19. European Economic Area, United Kingdom, and Switzerland This section applies where European data-protection law applies to CardsIQ's processing. ### Controller Unless CardsIQ processes personal data solely on behalf of a Partner, CardsIQ, LLC is the controller of personal data described in this Privacy Policy. A Partner may be an independent controller of personal data associated with its business and transactions. ### Data-Subject Rights Subject to applicable law, you may have the right to: * access personal data; * correct inaccurate personal data; * request erasure; * restrict processing; * object to processing based on legitimate interests; * receive portable data; * withdraw consent; * object to direct marketing; * request safeguards relating to certain automated decisions; and * lodge a complaint with a supervisory authority. ### Objection to Direct Marketing You may object to direct marketing at any time. CardsIQ will stop using personal data for that purpose after receiving a valid objection. ### Supervisory Authority You may lodge a complaint with the supervisory authority in the country where you live, work, or believe a violation occurred. We encourage you to contact first so we can attempt to address the concern. ### Representatives and Data Protection Officer If applicable law requires CardsIQ to appoint a European or United Kingdom representative or a data protection officer, CardsIQ will publish the relevant contact information in this Privacy Policy or a supplemental notice. ## 20. Children's Privacy The Platform is intended for adults and is not directed to children under eighteen years of age. CardsIQ does not knowingly collect personal information from children under thirteen. If you believe a child has provided personal information to CardsIQ, contact . We will review the request and delete the information where required. Partners may not knowingly submit children's personal information to the Platform unless CardsIQ has expressly approved the use case and all required legal protections are in place. ## 21. Do Not Track Some browsers transmit a Do Not Track signal. There is no universally accepted standard for responding to Do Not Track signals. CardsIQ does not respond to traditional Do Not Track signals unless required by law. Where required, CardsIQ recognizes qualifying opt-out preference signals such as Global Privacy Control as described in this Privacy Policy. ## 22. Third-Party Links and Services The Platform may contain links to third-party websites, marketplaces, social-media services, documentation, payment interfaces, wallet interfaces, or other services. CardsIQ is not responsible for the privacy, security, content, or practices of third parties. You should review the third party's privacy policy before providing information or using its service. ## 23. Business-to-Business Information Where permitted by applicable law, certain information collected in a business-to-business context may be subject to different rights, exceptions, or obligations. CardsIQ uses business contact information to: * administer Partner relationships; * conduct diligence; * negotiate and perform contracts; * provide support; * send service and product information; * manage billing; * maintain security; and * develop business relationships. Business contacts may opt out of promotional communications while continuing to receive communications needed to administer the business relationship. ## 24. Changes to This Privacy Policy CardsIQ may update this Privacy Policy to reflect changes in: * the Platform; * data practices; * third-party providers; * legal requirements; * security practices; or * business operations. When we make changes, we will update the Last Updated date. For material changes, we may provide additional notice through the Platform, by email, or by another appropriate method. Unless otherwise stated, the updated Privacy Policy becomes effective when posted. ## 25. Contact Information CardsIQ, LLC is a Florida limited liability company. ### Privacy Requests and Questions ### Customer Support and General Inquiries ### Business Partnerships ### Legal Notices