Privacy Policy
S&T Card Manager (“the app”, at app.stcardmanager.com) is a subscription inventory, ledger and marketplace-sync service for sports-card and trading-card collectors and dealers, made by BKCards71, LLC (“we”, “us”). This policy says, in plain words, what we collect, who processes it on our behalf, what we do with data that comes from eBay and other services you connect, and how to have your data deleted.
1 · What we collect
Account data
- Your company — company name, plan, subscription state, add-ons, and settings you choose.
- Your people — for each login: name, e-mail address, role, and sign-in records. Passwords are handled by our sign-in provider and stored only as one-way hashes; we never see them.
- Billing — when paid plans are enabled, payment is taken by Stripe. We receive a customer id, subscription state and invoice records. We never see or store card numbers.
Your inventory data
- Cards and books — everything you enter or import: card details, costs, sale prices, fees, locations, notes, ledger entries, and files you upload (spreadsheets, receipts, screenshots).
- Pictures — card photos you upload or that we fetch for you (from PSA by certificate number, or from your own eBay listings). Card pictures are stored in a publicly readable image bucket so they load fast; they contain no personal data. We are adding removal of location and device metadata (EXIF) from uploads.
Data from services you connect
- eBay — see section 4.
- Card Dealer Pro / CollX imports — listing and sale rows you import. Our screenshot reader returns the order, card and money fields only — never the buyer.
Technical data
- Server logs (IP address, browser type, time, the page or door requested) kept by our hosting provider for a short period for security and troubleshooting. We do not use tracking cookies or advertising trackers. The app uses browser storage only to keep you signed in and to remember your own screen preferences.
2 · What we use it for
- To run the service you subscribed to: your Ledger, Collection, Financials, Accounting, Intelligence and marketplace sync.
- To fill in card details and values for you when you ask (by certificate number, by name, or from a picture) using the vendors in section 3.
- To bill you, send you the e-mails the service needs (sign-in, invites, receipts, trial and payment notices, a sale alert), and answer support requests.
- To keep the platform healthy and secure: usage metering per company, error logs, abuse prevention.
We do not sell personal data, do not share it with advertisers, and do not use your inventory to train any model. Aggregate, non-identifying numbers (how many companies, how many calls a vendor answered) are used to run the platform.
3 · Who processes data for us (our subprocessors)
Each of these companies sees only what its job needs. We have no other subprocessors; if we add one, this page changes first.
| Processor | What it does for us | What it sees |
|---|---|---|
| Supabase | Database, sign-in, file storage (USA) | Everything in your account, encrypted at rest; passwords as hashes only. Every company's rows are isolated by database-enforced row-level security. |
| Vercel | Hosts the app, the site and our server functions | Requests in transit and short-lived server logs (IP, time, path). Our vendor keys live only here, on the server. |
| Stripe | Payments and subscriptions (when paid plans are on) | Your billing name, e-mail, payment card and invoices. We never see the card. |
| eBay | The marketplace you connect: listings, orders, notifications | Your eBay seller account, through a token you grant us. eBay sends us your listings and orders (section 4). |
| Card Hedge (cardhedger.com) | Market values, sold comps, card matching | The card's name, set, number, grade or a picture of the card — never who you are or what you paid. |
| PSA (Collectors Universe) | Certificate lookups and slab images | The certificate number you sync. Nothing else. |
| Anthropic | The AI reader (receipts, screenshots, card pictures, listing text) | The picture or text you submit for reading, for that request only. Not used to train their models under our API terms. |
| Resend | Sends our e-mail | Recipient address, subject and the message. |
| Cloudflare | DNS and inbound e-mail routing for stcardmanager.com | Domain traffic metadata; mail addressed to us. |
4 · eBay data
When you connect eBay you grant the app a token for your seller account. We use it only for the things you turn on:
- Listings — we read your active listings to link them to your cards, and, when you list from the app, we create, revise and end listings you tell us to.
- Orders — we read your orders so a sale can be booked against the card that sold. eBay's order record can include the buyer's name and shipping address; we do not display, use or share buyer details, and we remove them from our copy. We keep the order number, item, price, fees and dates — what the books need.
- Notifications — with your permission eBay pushes order events to us so a sale lands within minutes. Every message is signature-checked.
- Pictures — where a card has no picture in the app and your listing does, we copy the listing's picture onto your card, only when you say yes.
Storage and retention. The eBay token is encrypted at rest (AES-256-GCM) and is never shown to anyone, including us. Listing and order records stay as long as your company's account exists, because they are part of your books. Every call we make to eBay is logged (what call, when, whether it succeeded) so we can prove to eBay and to you that we ask only for what the feature needs, once where possible.
Disconnecting. Platform Connect › Manage connection › Disconnect revokes our token at once. eBay account deletion. We subscribe to eBay's marketplace account-deletion notifications; when eBay tells us a user has closed their eBay account, we delete the eBay data we hold for that user within 30 days and record that we did.
5 · How long we keep things
- While your account is open — everything, because it is your inventory and your books.
- If your subscription ends — your account becomes read-only. Nothing is deleted; you can still export everything.
- Closed accounts — kept read-only for 12 months so you can come back or export, then deleted. You can ask for deletion sooner (section 7).
- Logs — server and vendor-call logs are kept for a limited period for security and accounting, then dropped.
6 · Security
Every company's records are isolated by row-level security enforced inside the database on every query — a bug in a screen cannot show another company's data. Every server door checks who is asking, which company they belong to, and what their role allows before it reads or writes. Vendor keys live only on the server; the browser holds a session, never a key. Marketplace tokens are encrypted at rest. All traffic is HTTPS. Every administrative action on our side is written to an audit trail. Full details: stcardmanager.com › Security.
7 · Your choices and rights
- See and export — every screen exports to CSV or Excel; your pictures export too.
- Correct — you edit your own data in the app at any time.
- Delete — e-mail admin@stcardmanager.com from your company's admin address; we confirm identity, then delete your company's data within 30 days and confirm in writing. Records we must keep for tax or legal reasons (our own invoices to you) are kept only as long as the law requires.
- Disconnect a marketplace at any time from Platform Connect.
- Residents of California, the EU/UK and other places with privacy laws have additional rights (access, portability, restriction, objection, complaint to a supervisory authority). Write to us; we honor them regardless of where you live.
Please don't type card numbers, bank account numbers or government ID numbers into any free-text field. Those fields are yours; if you enter such data there, you are responsible for removing it.
8 · Children
The service is for businesses and adult collectors. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.
9 · Where data lives, and changes to this policy
Data is stored and processed in the United States. If we change this policy in a way that matters, we post the new version here with a new version number and date, and every login is asked to read and accept it at their next sign-in.
10 · Contact
BKCards71, LLC · Monroe, Connecticut, USA · admin@stcardmanager.com · stcardmanager.com