Privacy policy

Draft: replace the details in [square brackets] before going live (src/lib/legal.ts).

1. Controller

Sebastian Matthies, c/o IP-Management #12890, Ludwig-Erhard-Str. 18, 20459 Hamburg, Germany, e-mail: kontakt@binderatlas.com

2. What data we process

Account: e-mail address, password (stored only as a hash), optionally a display name, your chosen language, time of sign-up.
Content: your binders, pages, cards, sleeves and uploaded pictures. Anything you share via a link can be seen by anyone with that link.
Subscription: status, plan and term of your subscription; payment data is processed by Stripe only.
Cancellations and withdrawals: name, e-mail address, content of the declaration and time of receipt.
Technical: IP address and browser data when you open the site (server logs).
Audience measurement: page visited, referring site (domain only), device type and a code that changes daily (see section 4).

Legal bases: performance of a contract (Art. 6(1)(b) GDPR) for account, content and subscription; legal obligation (Art. 6(1)(c)) for invoices and for confirming cancellations and withdrawals; legitimate interest (Art. 6(1)(f)) for secure operation and as proof of declarations.

3. Service providers

Supabase (database, sign-in, picture storage), region: [EU-Region deines Supabase-Projekts], data processing agreement under Art. 28 GDPR.
Stripe Payments Europe Ltd., Ireland (payment processing). Stripe is itself responsible for payment data.
[Hoster, z. B. Hetzner Online GmbH, Serverstandort] (hosting the website), data processing agreement under Art. 28 GDPR.
[Mail-Dienst, Sitz] (sending confirmations, password and contract e-mails), data processing agreement under Art. 28 GDPR.
TCGdex (card data and card images): card images and data are loaded directly from TCGdex servers. This transmits your IP address to TCGdex (Art. 6(1)(f) GDPR, interest in displaying the cards).

Transfers to providers outside the EU are based on standard contractual clauses or the EU-US Data Privacy Framework.

4. Cookie-free audience measurement

To see how many people use the site and which content gets read, we count page views with our own simple counter. It sets no cookies and stores or reads nothing in your browser except the page you came from. On our server, we create a code (hash) from your IP address, your browser and the date, which changes every day. This lets us count the visitors of one day without recognizing you across several days. We do not store the IP address itself. We store the page visited, the domain of the referring page (e.g. google.com), the device type (phone, tablet, computer), the time and the code. The data is kept at Supabase, not passed on to third parties and deleted after 13 months. The legal basis is our legitimate interest in designing the website according to demand (Art. 6(1)(f) GDPR). You can object at any time, for example by e-mail to kontakt@binderatlas.com.

5. Storage in your browser

We store technically necessary data in your browser (local storage): your sign-in, the chosen theme, the card search language, cached prices and colors and, in demo mode, your demo binder (§ 25 (2) TDDDG). There are no tracking cookies, no advertising and no scripts from advertising or analytics services. The share buttons in the blog are plain links: data only goes to the respective network when you click them.

6. Retention

We keep your account and content until you delete your account, which you can do at any time in your profile. Server logs are deleted after a short time, audience measurement data after 13 months. We keep cancellations and withdrawals as proof for three years from the end of the year of receipt. We and Stripe keep invoice data for up to 10 years because of legal obligations.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a data protection supervisory authority. Write to us at kontakt@binderatlas.com. You must be at least 16 years old to use Binder Atlas.