Legal
Privacy Policy
The short version
- We use your information to run Pop Collect, keep it secure and make it better.
- We never sell your personal data.
- We build a database of card information from the inventory people enter in Pop Collect. Before anything goes into it, we remove everything that could identify you or your store and combine it with other sellers' figures. We may license that database to other businesses. Data we receive from eBay, Shopify, Discord or Slack never goes into it, and you can opt out.
- You can see, export, correct or delete your data at any time.
1. Who we are
Pop Collect is owned and operated by SWOP Holdings Inc., a Delaware corporation ("SWOP", "we", "us"). This policy covers the Pop Collect website, the Pop Collect dashboard and its connections to eBay, Shopify, Discord, Slack and Google (together, the "Service").
SWOP is the controller of your personal data for the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR.
- Address: [SWOP Holdings Inc. registered address]
- Email: contact@swop.trade
- EU representative (GDPR Article 27): [name and address]
- UK representative (UK GDPR Article 27): [name and address]
2. Information we collect
Information you give us
- Account details: your name, email address, phone number, password (stored only as a secure hash by our sign-in provider), whether you registered as an individual or a business, and your business name.
- Store profile: the store name and logo you add.
- Inventory: the cards and sealed products you add or import, including name, set, number, grading company and grade, condition, quantity, what you paid, your asking price, where it is listed, notes, and sales you record.
- Messages: what you send through our contact form or by email, including your name and email address.
- Payment details: when you subscribe, our payment processor collects your card details. We receive only the card type, last four digits, expiry date, billing country and payment status, never the full card number.
Information from services you connect
We only receive this when you choose to connect a service, and you can disconnect at any time.
- Google sign-in: your name, email address and Google account ID.
- Shopify: your store's name and domain, your products and variants (titles, SKUs, prices and inventory levels) and an access token. We ask Shopify for permission to read products and inventory and to update products, so we can change a price when you ask us to. We do not access your customers or orders.
- eBay market data: recent sold and current listings for the cards in your inventory (title, price, date and a link to the listing), retrieved through eBay's APIs. We do not collect or store information about eBay buyers or sellers.
- Your eBay seller account: if you connect it, your eBay user ID, access tokens and your own listings, so we can change a listing's price when you ask us to.
- Discord: when you use "Add to Discord", the webhook for the channel you choose and the names of that server and channel. Our integration only posts your alerts to that channel. It does not read messages or member lists.
- Slack: the webhook address you give us, used only to post your alerts.
Information collected automatically
- Log data: IP address, browser and device type, pages and features used, dates and times, and error reports, recorded by our hosting providers and our servers.
- Approximate location: once per session we work out your country, region and city from your IP address, either from our hosting provider's network or by sending the IP address alone to ipapi.co. We store the approximate location, not the IP address.
- Browser storage: the dashboard keeps you signed in using your browser's local storage, and the website's arcade saves your best scores there. These stay on your device. We do not use advertising cookies or third-party tracking.
- Fonts: our website loads fonts from Google Fonts, so Google receives your IP address when you visit.
3. How we use your information
Under the GDPR we need a legal basis for each use. The table below sets out what we do, with what, and on what basis.
| What we do | Information used | Legal basis |
|---|---|---|
| Run the Service: your account, inventory, market prices, alerts and repricing | Account, inventory, connected services | Performing our contract with you |
| Bill you for your plan | Account, payment details | Contract; legal obligation for tax records |
| Send service emails such as alerts, security notices and receipts | Email address | Contract |
| Keep the Service secure, prevent fraud and abuse, and fix errors | Log data, account | Legitimate interests |
| Improve the Service and develop new features, including how we match cards to market data and how people use each feature | Inventory, log data, approximate location | Legitimate interests |
| Build the card database described in section 4 | Inventory you enter, anonymised | Legitimate interests (you can object) |
| Send product news and offers | Email address | Consent, which you can withdraw at any time |
| Answer your messages | Messages, name, email address | Legitimate interests |
| Meet legal obligations and enforce our Terms | As needed | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have weighed our interests against your rights, and you can object at any time (see section 9).
4. The Pop Collect card database
Pop Collect builds a database of trading card market information from the inventory people enter in the Service. We use it to improve Pop Collect, and we may sell or license it to other businesses, such as card marketplaces, grading companies, data providers and researchers.
What goes into it
Card-level figures only: which card it is (game or sport, set, number, variant, grading company and grade) together with combined figures such as price ranges for cost, asking and sold prices, quantities held and how long items stay listed.
How we protect you
- Before any information goes into the database we remove names, email and other contact details, store names and logos, account and store identifiers, notes and anything else that could identify you or your store.
- We only include figures combined from several sellers, so no figure can be traced back to a single seller.
- We do not try to re-identify anyone, and we require anyone we license the database to not to try either.
Because the database contains no personal data, licensing it is not a sale of personal data.
What never goes into it
- Any data we receive from eBay, including sold prices and listings.
- Any data we receive from Shopify, including inventory imported from your Shopify store.
- Any data we receive from Discord or Slack.
- Your personal data.
Opting out
To keep your inventory out of the database, email contact@swop.trade from your account's email address. We will leave your inventory out of every update after we receive your request. Figures that were already anonymised and combined can't be traced back to you, so they can't be removed.
5. eBay, Shopify, Discord, Slack and Google
- eBay: data we receive from eBay's APIs is shown only to you, as pricing guidance for your own inventory. We never sell or republish it, combine it into the card database, or use it to train artificial intelligence models. We delete item-level sold listing data after 90 days and keep only per-card statistics such as averages and sale counts. We act on eBay's Marketplace Account Deletion notifications.
- Shopify: data from your Shopify store is used only to provide Pop Collect's features to that store. It is never sold, and is shared only with the service providers in section 6 that help us run Pop Collect. We delete it within 30 days of you uninstalling the app, and we respond to the data requests Shopify passes on to us.
- Discord and Slack: used only to post your alerts. We never sell this data, and we remove the connection when you disconnect it.
- Google: information from Google sign-in is used only to sign you in. Our use follows the Google API Services User Data Policy, including its Limited Use requirements.
Each of these services also handles your data under its own privacy policy.
6. Who we share information with
We do not sell your personal data, and we do not share it for targeted advertising. We share it only with:
- Service providers who process it for us under contract and only on our instructions: Supabase (database and sign-in), Render (application servers), Vercel (website and app hosting), Resend (email delivery), ipapi.co (approximate location from IP address), FormSubmit (our website's contact form), Google (sign-in and website fonts), Stripe (payments) and card catalogue and grading data providers, who receive card details only.
- Services you connect, such as Shopify or eBay, when you ask us to change a price.
- Authorities or others when the law requires it, or to protect the rights, safety or property of our users, SWOP or others.
- A buyer or successor if SWOP is involved in a merger, acquisition or sale of assets. This policy will continue to apply to your data.
- Anyone else only with your consent.
7. International transfers
SWOP is based in the United States, and so are several of our service providers. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, or on the European Commission's Standard Contractual Clauses and the UK Addendum. You can ask us for a copy of these safeguards.
8. How long we keep information
| Information | How long |
|---|---|
| Account and inventory | While your account is open. Deleted within 30 days of you closing it, and from backups within 90 days. |
| Shopify data | Deleted within 30 days of you uninstalling the app. |
| eBay item-level sold listings | 90 days. |
| Connected service tokens and webhooks | Until you disconnect the service or close your account. |
| Log data | Up to 90 days, unless needed to investigate a security issue. |
| Billing records | As long as tax and accounting law requires, usually up to 7 years. |
| Messages to us | Up to 2 years after we last hear from you. |
| The anonymised card database | Indefinitely. It contains no personal data. |
9. Your rights
If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to:
- access the personal data we hold about you and get a copy of it;
- have it corrected if it is wrong;
- have it deleted;
- restrict how we use it;
- receive it in a portable format, or have it sent to another service;
- object to our use of it based on legitimate interests, including for the card database and for product development;
- withdraw consent at any time, where we rely on consent;
- complain to your local data protection authority. We would appreciate the chance to resolve your concern first.
If you live in a US state with a consumer privacy law, such as California, you have the right to know what personal information we collect and how we use it, and to access, correct and delete it. We do not sell personal information or share it for cross-context behavioural advertising, and we will not treat you differently for using your rights.
You can delete your account from the dashboard's settings. For anything else, email contact@swop.trade. We will answer within one month, and may need to confirm your identity first.
10. Security
We encrypt data in transit, encrypt the access tokens for services you connect, and limit who at SWOP can access personal data. No system is perfectly secure, but if a breach affects your personal data we will tell you and the relevant authorities as the law requires.
11. Children
Pop Collect is for people aged 18 and over. We do not knowingly collect personal data from anyone younger. If you think a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We will post any changes on this page and update the date at the top. If a change is significant, we will tell you by email or in the dashboard before it takes effect.
13. Contact
Questions or requests about your privacy: contact@swop.trade, or write to SWOP Holdings Inc., [registered address].