Privacy Policy

1. Information We Collect

Personal Information

We collect information that you voluntarily provide to us when you register on the site, subscribe to a premium plan, or communicate with us. This may include:

• Name and username
• Email address
• Profile information (bio, avatar, location)
• Payment and billing information: When you subscribe to a premium plan (“Join the Club”), payment and billing information is collected. This information is provided directly to our third-party payment processor (such as Stripe), and we do not store your full credit card details on our servers. We may retain limited payment information such as the last four digits of your card and billing address for record-keeping purposes.
• Communication preferences

Important Note: The Canopy Club facilitates user-to-user transactions through marketplace listings, but we do not process, handle, or store any payment information related to transactions between users. All user-to-user payments are conducted outside of our platform, and we are not a party to those transactions.

Collection Information

When you add cards to your collection or create listings, we collect:

• Card details (condition, grade, acquisition information)
• Listing information (price, description, photos)
• Transaction history

Automatically Collected Information

When you access our site, we automatically collect certain information:

• IP address and browser type
• Device information and operating system
• Pages visited and time spent on pages
• Referring website addresses
• Cookies and similar tracking technologies

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our services
• Process your transactions and manage your collection
• Send you important updates and notifications
• Respond to your inquiries and provide customer support
• Improve and personalize your experience
• Detect, prevent, and address technical issues and fraudulent activity
• Analyze usage patterns to improve our services
• Send promotional communications (with your consent)

3. Sharing Your Information

We do not sell your personal information. We may share your information in the following circumstances:

• Service Providers: With third-party vendors who perform services on our behalf (payment processing, hosting, analytics)
• Business Transfers: In connection with a merger, sale, or acquisition of all or part of our business
• Legal Requirements: When required by law or to protect our rights, property, or safety
• With Your Consent: With your explicit consent for specific purposes

4. Data Security

We implement appropriate technical and organizational security measures to protect your personal information. However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

Our security measures include encryption, secure servers, regular security audits, and restricted access to personal data.

5. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request access to your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data
• Portability: Request a copy of your data in a portable format
• Objection: Object to certain processing of your data
• Withdrawal: Withdraw consent for data processing

To exercise these rights, please contact us using the information provided below.

6. Your Rights Under GDPR (European Privacy Rights)

If you are a resident of the European Economic Area (EEA), United Kingdom, or Switzerland, you have certain data protection rights under the General Data Protection Regulation (GDPR). We are committed to respecting these rights.

Your GDPR rights include:

• Right to Access: You have the right to request a copy of the personal data we hold about you and information about how we process it.
• Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to Erasure (Right to be Forgotten): You have the right to request that we delete your personal data in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
• Right to Data Portability: You have the right to request that we transfer your personal data to another organization or directly to you in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to our processing of your personal data in certain circumstances, such as for direct marketing purposes or when processing is based on legitimate interests.
• Rights Related to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
• Right to Withdraw Consent: Where we process your personal data based on your consent, you have the right to withdraw that consent at any time.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority if you believe we have not handled your personal data in accordance with the GDPR.

To exercise any of these rights, please contact us using the information provided at the end of this policy. We will respond to your request within one month, as required by GDPR. In certain circumstances, we may need to verify your identity before processing your request.

7. Your Canadian Privacy Rights (PIPEDA)

As a Canadian company operating under the Personal Information Protection and Electronic Documents Act (PIPEDA), we are committed to protecting the privacy of individuals in Canada. PIPEDA establishes ground rules for how private sector organizations collect, use, and disclose personal information in the course of commercial activities.

Under PIPEDA, you have the right to:

• Know why we collect, use, or disclose your personal information
• Expect us to collect, use, or disclose your personal information reasonably and appropriately
• Know who in our organization is responsible for protecting your personal information
• Expect us to protect your personal information with appropriate safeguards
• Expect us to keep your personal information accurate, complete, and up-to-date
• Access your personal information and challenge its accuracy
• Withdraw consent for the collection, use, or disclosure of your personal information (subject to legal or contractual restrictions)
• File a complaint with the Office of the Privacy Commissioner of Canada if you believe we have not complied with PIPEDA

To exercise any of these rights or for questions about our privacy practices under PIPEDA, please contact us using the information provided at the end of this policy.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on our site and hold certain information. Cookies are files with small amounts of data that are stored on your device. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

We use cookies for:

• Authentication and security
• Preferences and settings
• Analytics and performance monitoring
• Personalization of content

9. Third-Party Services

Our site may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing them with any personal information.

10. Children's Privacy

Our services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us, and we will take steps to delete such information.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. By using our services, you consent to such transfers.

12. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this privacy policy, unless a longer retention period is required by law. When we no longer need your information, we will securely delete or anonymize it.

13. Changes to This Privacy Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page and updating the “Last updated” date. You are advised to review this privacy policy periodically for any changes.