Who looks after your data
PokeVerse is the data controller for the personal data described here. Questions or requests go to hello@pokeverse.net.
What we collect
- When you buy: your name, email, delivery address and phone number if you give one, and what you ordered.
- If you create an account: your name, email and password (stored only as a secure hash), and your portfolio and wishlist.
- Photos you send us: for example, pictures of a card you're reporting a problem with.
- Payment details: handled entirely by Stripe. We see the last four digits and the card type, never the full number.
- Basic technical data: IP address and browser details in our server logs, kept for security and fraud prevention.
Why we use it
- To take payment, post your order, and handle returns and problems. This is needed to fulfil our contract with you.
- To keep records the law requires, such as sales records for tax.
- To prevent fraud and protect buyers and sellers, including checking returned cards against their listing photos. This is our legitimate interest.
- To email you about your orders, and about wishlist cards when they're listed if you've asked us to. You can turn wishlist emails off at any time.
Who we share it with
Only the services that help us run the shop, each bound to protect your data:
- Stripe, for payments and fraud checks.
- Royal Mail, to deliver your order.
- Vercel, which hosts the website, and Neon, which hosts our database in London.
- Our email provider, to send order and account emails.
Some of these companies are based in the United States. Where data leaves the UK, it's protected by the UK International Data Transfer Agreement or an equivalent safeguard.
How long we keep it
- Order records: six years, because tax law requires it.
- Listing and packing photos: kept with the order, as evidence if there's ever a dispute.
- Your account and portfolio: until you delete your account.
- Server logs: up to 30 days.
Cookies
We only use cookies the site needs to work, so there's no cookie banner:
- pv_basket remembers what's in your basket, for up to 30 days.
- pv_checkout remembers an unfinished checkout for a day, so its cards can be released if you start again.
- A sign-in cookie keeps you logged in, if you have an account.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask for it in a portable format. Email us and we'll respond within a month. If you're not happy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.