CardWorld — Privacy Policy

Version 1 · effective 21 September 2026

This policy explains what personal data CardWorld (UEN [UEN to be provided], "CardWorld", "we") collects when you use cardworld.io, why, who we share it with, how long we keep it, and the rights you have. We comply with Singapore's Personal Data Protection Act 2012 (PDPA).

Data Protection Officer: hello@cardworld.io · [address to be provided], Singapore.

1. What we collect

When you create an account: your email address, a display name, your country, and a password (stored only as a one-way hash — we cannot read it). The codes we email you to confirm sign-ups and sign-ins.

When you buy or sell: delivery name and address; the items you bid on, buy, list or consign; offers between buyer and seller; photographs you upload; tracking numbers; your CardWorld balance and withdrawal requests, including the bank account or PayNow details you give us for payouts; and, for larger withdrawals, identity documents you provide when we ask to verify you.

When you pay: payments are taken by our payment provider, Stripe. Your card number goes directly to Stripe and is never seen or stored by CardWorld. We receive a confirmation, the last four digits and the card type.

Automatically: the IP address, browser and time of each sign-in and of important actions (bids, purchases, listings, withdrawals), kept as a security log; the cookies described in section 6; and the country your connection appears to come from, used only to choose the currency prices are first shown in.

We do not use advertising trackers, analytics pixels or social-media plug-ins, and we do not collect data from your contacts, camera or location.

2. Why we use it (our purposes)

• To run the marketplace: create your account, show items, take bids and orders, inspect and ship items, pay sellers and refund buyers.
• To keep accounts safe: sign-in codes, security logs, lockouts after repeated failures, holds on withdrawals after password or account changes.
• To prevent fraud and meet legal duties: verifying identity before large payouts, keeping transaction and tax records, and answering lawful requests from authorities.
• To contact you about your account and orders: codes, receipts, shipping updates, outbid notices, offers, and notices about changes to our terms. These are service messages, not marketing.
• Marketing: only if you ask for it. Every marketing email will carry an unsubscribe link, and you can withdraw consent at any time.

By creating an account you consent to these uses. Withdrawing consent for a use that we need in order to complete a sale, hold your money safely or meet a legal duty may mean we can no longer provide that service.

3. Who we share it with

We share personal data only with the services needed to run CardWorld, each bound by contract to use it only for that purpose and to protect it to a standard comparable to the PDPA:

Buyers and sellers see each other only as far as the sale requires: a seller sees the buyer's display name; a buyer sees the seller's display name; the delivery address is used by CardWorld to ship and is not shown to the seller. Bidders see each other only as aliases ("Bidder 3").

We do not sell personal data, and we disclose it to authorities only where the law requires or permits.

4. Where it is kept and for how long

Our systems run in Singapore. Some service providers above process data outside Singapore, under contracts requiring protection comparable to the PDPA (transfer limitation obligation).

• Account data: while your account is open, then deleted or anonymised within 90 days of closure, except as below.
• Records of transactions, payments, inspections, disputes and payouts: 5 years from the end of the financial year in which they happened, as required by Singapore tax and accounting law, or longer while a dispute or legal requirement is open.
• Security logs: 12 months.
• Identity documents collected for a withdrawal check: deleted once the check is complete unless we are required to keep them.

5. Your rights

You can ask us at any time to:

• see the personal data we hold about you and how it has been used or disclosed in the past year;
• correct it;
• receive a copy of the data you gave us in a common machine-readable format;
• withdraw consent to a use that is not needed to complete a sale or meet a legal duty (for example, marketing);
• close your account.

Write to hello@cardworld.io. We respond within 30 days. If you are not satisfied, you may complain to Singapore's Personal Data Protection Commission (pdpc.gov.sg).

6. Cookies

We use only strictly necessary cookies: one that keeps you signed in (removed when you sign out, and in any case after 30 days), and two that remember the currency you chose to view prices in. There are no advertising or tracking cookies.

7. Security, and if something goes wrong

Passwords are hashed; every sign-in needs a code from your email; every connection is encrypted; card details never touch our servers; access to our systems is limited to staff who need it; and important actions are logged. If a data breach is likely to cause you significant harm, or affects a large number of members, we will notify the affected members and the Personal Data Protection Commission as the PDPA requires — the Commission within three calendar days of establishing that the breach is notifiable. No system is perfectly secure: please use a strong, unique password and tell us at once if you think your account has been compromised.

8. Children

CardWorld is for adults (18 and over). We do not knowingly collect data from anyone under 18; if we learn that we have, we delete it.

9. Changes

We will announce material changes to this policy on the site and by email before they take effect.

CardWorld (UEN [UEN to be provided]) · [address to be provided], Singapore · hello@cardworld.io