This Privacy Policy describes how Leumas Card Craze LLC ("we", "us", "our") collects, uses, stores, and shares personal data when you use the service available at inventory.leumascc.com (the "Service") or visit our website at leumascc.com. It applies to all visitors, waitlist subscribers, and registered users.
We are the data controller for the personal data described in this Policy. For privacy questions or to exercise your rights, contact support@leumascc.com.
| Category | Examples | Source |
|---|---|---|
| Account identity | Email address, display name, password hash | You, at registration |
| Profile | Return shipping address, ship-from address, eBay seller username | You, in Account Settings |
| eBay account data | OAuth refresh token (encrypted), seller ID, internal eBay user ID, listing data, order data, fees | eBay APIs after you Connect |
| TCGplayer data | Order data (manually uploaded), pricing CSV exports | You, via Import / Sync |
| Business data | Inventory, combine lists, lot tracking, expenses, picklist, audit logs | You, via the Service |
| Operational telemetry | Session timestamps, last login, last token refresh, error logs (no PII content) | Automatically |
| Usage analytics | Anonymized page views and in-app actions (no names, emails, card titles, or dollar amounts) | Google Analytics (GA4) — only after you accept analytics cookies |
| Waitlist | Email address only | You, at landing-page signup |
We do not sell your personal data. We do not share Your Data with other tenants. We do not use Your Data to train AI models.
For users in the EU/UK, we process personal data under the following legal bases:
We share personal data only with the following categories of recipients:
All third-party processors operate under data-processing agreements that restrict their use of Your Data to providing services to us.
pgcrypto with a master key stored in Supabase Vault (pgsodium-backed).user_id = auth.uid()) at the database layer. Application code cannot bypass tenant isolation; the database refuses cross-tenant access regardless of bugs.| Data | Retention |
|---|---|
| Active account data | Retained while your account is active. |
| Account terminated | 30 days after termination, then permanently deleted. |
| Waitlist email | Retained until public registration opens or you unsubscribe. |
| Operational logs | 90 days, then aggregated/anonymized. |
| Backups | Up to 90 days following deletion, then purged. |
| Records required by law | As required by applicable law (typically 7 years for financial records). |
California residents have additional rights to know what categories of personal data we collect, sources, business purposes, and recipients (all disclosed above). California residents may also opt out of "sale" or "sharing" of personal data — though we do not sell or share personal data for cross-context behavioral advertising.
Email support@leumascc.com with the request and the email address on your account. We will respond within 30 days. We may require identity verification before fulfilling deletion or export requests.
Our infrastructure is located in the United States. If you access the Service from outside the U.S., your data will be transferred to and processed in the U.S. We rely on Standard Contractual Clauses (or equivalent transfer mechanisms) for EU/UK data transfers.
The Service uses session storage (sessionStorage) and local storage (localStorage) in your browser to store your auth token, user preferences (e.g., onboarding state, feature flags), and OAuth state. These are essential for the Service to function and are not used for tracking.
We also use Google Analytics (GA4) to understand aggregate, anonymized usage. Analytics runs with Google Consent Mode set to DENIED by default — nothing is sent to Google until you click Accept on our cookie banner. You can decline, change your choice at any time via the "Cookie settings" link, or block cookies in your browser. We do not send personal data (names, emails, card titles, or dollar amounts) to our analytics provider, and we do not use advertising or cross-site behavioral cookies.
The Service is not directed to children under 18. We do not knowingly collect personal data from minors. If you believe a child has provided personal data, contact us at support@leumascc.com and we will delete the data promptly.
If we become aware of a breach of personal data that creates a high risk to your rights and freedoms, we will notify affected users without undue delay (and within 72 hours where required by law) by email and via in-Service notification. Notifications will describe the nature of the breach, likely consequences, mitigations taken, and contact information for further questions.
We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users at least 14 days before taking effect. The "Last updated" date above reflects the most recent revision.
Privacy questions, requests, or complaints: support@leumascc.com.
EU/UK residents may also lodge a complaint with their national data protection authority.
Mailing address available upon request.
Leumas Card Craze LLC · Sioux Falls, South Dakota, United States
← Back to home