Privacy

Who looks after your data

POLYXMEDIA LTD (trading as PokeVerse, company number 15901994, registered office 66 Paul Street, London, EC2A 4NA) is the data controller for the personal data described here. Questions or requests go to hello@polyxmedia.com.

What we collect

• When you buy: your name, email, delivery address and phone number if you give one, and what you ordered.
• If you create an account: your name, email and password (stored only as a secure hash), your portfolio and wishlist, and anything you add to your account details.
• What you collect, if you tell us: the Pokémon, types, illustrators, sets, eras and collections you pick on your interests page.
• Photos you send us: for example, pictures of a card you're reporting a problem with.
• Card photos you scan: if you use the scanner, the photo is sent to an AI model to read the card. We keep the photo and what was read with your scan, so you can review it.
• Usage statistics: only if you agree to analytics cookies. Which pages were visited, roughly where from, and on what kind of device.
• Payment details: handled entirely by Stripe. We see the last four digits and the card type, never the full number.
• Basic technical data: IP address and browser details in our server logs, kept for security and fraud prevention.

Your account details

Apart from your name and email, everything on your account page is optional, and you can change or delete it at any time. A profile picture is stored as a small square copy and deleted when you remove it or close your account. Your phone number is used only if a delivery needs it. For your birthday we keep the day and month, never the year, so we never know your age. We don't use it for anything yet, and we'll ask you before we do. Saved addresses are there to fill in checkout for you. Card details never reach us: Stripe takes them when you pay, and if you choose Link, Stripe's saved-card service, Stripe keeps them for you.

Why we use it

• To take payment, post your order, and handle returns and problems. This is needed to fulfil our contract with you.
• To keep records the law requires, such as sales records for tax.
• To prevent fraud and protect buyers and sellers, including checking returned cards against their listing photos. This is our legitimate interest.
• To email you about your orders, and when a card on your wishlist is listed within the limits you set. We tell you once, and again only if that copy goes before you buy it and another is listed. Switch wishlist emails off on your wishlist page or with the link in any of those emails. Taking a card off your wishlist also stops its emails.
• To pick cards for your For you page from what you collect. If you switch on the morning email about new cards that match, we send it based on your consent: switch it off on your interests page or with the link in any of those emails.
• To understand how the shop is used and improve it, through Google Analytics. This is based on your consent, which you can withdraw at any time with Cookie settings in the footer.

Who we share it with

Only the services that help us run the shop, each bound to protect your data:

• Stripe, for payments and fraud checks.
• Royal Mail, to deliver your order.
• Vercel, which hosts the website and stores photos, and Neon, which hosts our database in London.
• Resend, to send order and account emails.
• Vercel AI Gateway and Google (Gemini), to read card photos when you use the scanner.
• Vercel AI Gateway and Black Forest Labs (FLUX), to draw scenery for empty binder pockets when you ask for it.
• Google, for sign-in if you choose Continue with Google, and for Google Analytics if you agree to it.

Some of these companies are based in the United States. Where data leaves the UK, it's protected by the UK International Data Transfer Agreement or an equivalent safeguard.

How long we keep it

• Order records: six years, because tax law requires it.
• Listing and packing photos: kept with the order, as evidence if there's ever a dispute.
• Your account, portfolio, wishlists and interests: until you delete your account.
• Server logs: up to 30 days.

Cookies

These cookies are needed for the site to work, so they're always on:

• pv_basket remembers what's in your basket, for up to 30 days.
• pv_basket_id links your basket to the cards we hold for you for an hour, for up to 30 days.
• pv_saved remembers cards you've saved for later, for up to 30 days.
• pv_checkout remembers an unfinished checkout for a day, so its cards can be released if you start again.
• A sign-in cookie keeps you logged in, if you have an account.
• pv_consent remembers your cookie choice, for a year.

These are optional and only set if you choose "That's fine" when we ask. You can change your mind at any time with Cookie settings at the bottom of every page:

• _ga and _ga_* are Google Analytics cookies that tell visits apart, for up to two years.

Two settings are kept in your browser's own storage and never sent to us. They stay until you clear them:

• pv-theme remembers whether you picked Light or Dark. Auto, the default, saves nothing.
• pv_binder_v1 keeps the pages you lay out in the Binder planner, so they're there next time.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask for it in a portable format. Email us and we'll respond within a month. If you're not happy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.