Privacy Policy

What we collect, why we collect it, who else sees it, and what you can require us to do about it. The short version: we collect what an account and a payment need, we never receive your card number, and we share a small amount of activity with the advertising platforms we buy from — you can switch that off below, and we honour Global Privacy Control automatically. The long version follows, including your rights under California law.

1. Who is responsible

Cardhouse Ventures LLC is the business responsible for personal information collected through cardhouse.live. Contact: support@cardhouse.live, California, United States.

2. What we collect

Identifiers — your email address, an account identifier, and the display name you choose. If you ask us to ship a card, your name and postal address.

Commercial information — tokens purchased, packs opened, cards allocated to you, cards sold back, and shipments requested.

Payment information — handled by our payment processor. We receive a confirmation, the last four digits, the card brand, and the result of any authentication step. We never receive or store your full card number.

Age and identity information — your declared date of birth, and any document you provide if we ask you to verify age, identity or address.

Technical information — IP address, browser user-agent and timestamps, recorded for security, fraud prevention and rate limiting.

Approximate location — the city and region your IP address points to, looked up on our own server from a built-in database, so your address is never sent anywhere to do it. We use it to run and protect the site; it is shown only to the cardhouse team and is not stored.

Where you arrived from — if you reach us by following a link, the campaign tags on that link, the site that referred you, and the page you landed on. We keep the referring site's name only, never the full address, because a full referrer can carry the search you typed or the discussion you were reading and neither is needed to answer "which advert worked".

We do not collect precise geolocation, biometric data, or information about your health, religion, politics, sex life or union membership. We do not ask for a Social Security number.

3. Why we use it, and the legal basis

To create and secure your account; to take payment and prevent fraud; to allocate, price and ship cards; to meet legal and tax obligations; to answer you when you write to us; and to detect abuse of the Service.

And to measure our own advertising — which campaign brought an account, and whether that account went on to make a deposit. That is how we find out which adverts are worth running. We do not use anything about your collection for this. What you pulled, what you own, what you sold back and what you spent on any individual pack are never sent to an advertising platform and are never used to target you.

We use it for those purposes and no others.

4. Who else sees it

We use a small number of processors, each for one job, each bound to use the information only to provide their service to us:

Clerk — sign-in and identity. Stripe — payment processing and fraud checks. Neon — the database that stores your account. Render — the hosting that runs the site. PriceCharting — market price data (they receive no personal information about you).

TikTok and Meta — advertising measurement. Their code runs in your browser on this site and tells them that a visit, a new account or a deposit happened on a device they recognise, together with the deposit amount. They do not receive your name, your email address, your date of birth, your card details, or anything about which cards you own or pulled. They are able to recognise the device because you are, or have been, signed in to their own services — which is the mechanism, and it is why the law treats this as sharing rather than as a processor arrangement.

This is "sharing for cross-context behavioural advertising" as California defines it, and you can switch it off. Use the control at the end of this section, or turn on Global Privacy Control in your browser and we will honour it without you asking. If it is off, no request is made to either company at all — the code is not loaded and then silenced, it is never fetched.

We also disclose information where we are legally required to, where necessary to establish or defend a legal claim, or to a carrier in order to deliver a shipment you requested.

We do not sell personal information for money, and never have.

To stop advertising sharing, use Do Not Sell or Share My Personal Information at the foot of any page in the cardhouse app, or turn on Global Privacy Control in your browser — it is honoured automatically, with nothing else to do.

5. Your California privacy rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the rights set out below. We will not discriminate against you for exercising any of them — your access, prices and service will not change.

Right to know — what categories of personal information we have collected about you, the sources, the purpose, the categories of third parties it was disclosed to, and the specific pieces of information we hold.

Right to delete — to require deletion of personal information we hold about you, subject to exceptions where we must keep records (for example, completed transactions, tax and anti-fraud records). Where you arrived from is not one of those exceptions: it is deleted with your account and is not kept.

Right to correct — to have inaccurate personal information corrected.

Right to opt out of sharing — you can stop the advertising measurement described in section 4 at any time, using the control there or in the site footer. It takes effect immediately in this browser and needs no account and no email to us. We also treat a Global Privacy Control signal as a valid opt-out request, automatically, on every visit. We do not sell personal information for money, so there is nothing further to opt out of.

A limit worth stating plainly. Your choice is remembered in this browser's own storage, which means it applies to this browser on this device. It does not follow you to your phone, and clearing your site data clears it. That is the honest description of the mechanism; we would rather say so than imply an account-wide setting we have not built.

Right to limit use of sensitive personal information — we do not collect sensitive personal information as defined by the CPRA.

How to exercise them — write to support@cardhouse.live from the address on your account. We will verify your identity through that account and respond within 45 days, extending once by a further 45 days where necessary and telling you if we do. An authorised agent may act for you with written permission.

Shine the Light (Civil Code § 1798.83): we do not disclose personal information to third parties for their own direct marketing purposes.

6. How long we keep it

Account and transaction records are kept for as long as your account is open and afterwards for as long as we are required to keep them for tax, accounting and anti-fraud purposes — generally seven years for financial records.

Technical logs are kept for a short period for security purposes and then discarded.

Closing your account does not delete records we are legally required to retain, and does not erase the record that a transaction happened.

7. Security

Payments are handled by a PCI-compliant processor. Sign-in is handled by a dedicated identity provider with two-factor authentication available. Data is encrypted in transit. Access to production data is limited to those who need it.

No system is perfectly secure. If a breach affecting your personal information occurs, we will notify you as required by California Civil Code § 1798.82.

8. Children

The Service is for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided information, write to support@cardhouse.live and we will delete the account and its data.

9. Cookies and tracking

We use cookies and equivalent local storage that are necessary for the Service to work — keeping you signed in, holding your session, protecting against abuse, and remembering the privacy choice you made in section 4.

We also allow TikTok's and Meta's advertising code to set their own cookies, for the measurement described in section 4 and for nothing else. Switch that off in section 4, or send a Global Privacy Control signal, and none of it loads.

We honour Global Privacy Control and "Do Not Track" as opt-out requests. Neither requires you to tell us anything.

10. Changes and contact

We will post changes here with a new effective date. Material changes affecting how we use information already collected will be notified to you.

Privacy questions and rights requests: support@cardhouse.live.

Questions about anything on this page: support@cardhouse.live