Privacy · CardDecoded

What we process

CardDecoded processes your Google account identifier, card photos, card details, recognition results, evidence links, plan usage, and billing status. Payment card details are handled by Stripe and never pass through CardDecoded.

Why we process it

We use this data to authenticate you, privately store your collection, identify cards, research evidence, enforce plan limits, prevent abuse, provide support, and keep the service reliable.

Card photos and AI

Front and back photos are stored in private storage and are sent to configured AI providers only to perform the recognition or valuation task you request. CardDecoded does not create public image URLs and does not sell your collection data.

Retention and deletion

Short-lived upload handoffs expire automatically. Saved card photos and history remain until you delete the card or your account, subject to limited security, billing, and legal records we must retain. Deletion jobs may continue briefly while private storage objects are removed.

Processors and international transfer

CardDecoded currently relies on Vercel for hosting, Supabase for authentication/database/storage, OpenAI for card recognition, Stripe for billing, Google for sign-in, and Cloudflare for DNS. These providers may process data in other countries under their contractual safeguards.

Your choices

Signed-in users can export structured collection data or request permanent account deletion from Account and data. You may also edit card records directly or contact us for help with access, correction, portability, or deletion.

Contact

Email support@carddecoded.com for privacy or data requests.