Privacy Policy

1. Information we process

• Account: username, email address, required country, account status, verification and authentication records, and the version and time of your acceptance of account terms. Firebase Authentication manages passwords; our collector database does not store plaintext passwords.
• Collector profile: optional location, biography and profile image, plus your Public or Private setting. New accounts start Public. Other signed-in collectors can see a public account's username, country, card inventory and optional details you provide. Your email is not displayed there. You can switch to Private in Profile & settings.
• Card registry: card identifiers, registrations, current ownership, supported transfers and related history. A person opening a card's QR link can see artwork and registration status, but not the owner's private account details.
• Orders: contact, order, delivery and payment-status information needed to fulfil a purchase. Shopify and the payment providers available there handle checkout. Our collector application does not store full payment card numbers or card security codes.
• Messages: address, content, action links and delivery information for verification, password-reset and other service emails. Marketing contact details are used only where you separately subscribe.
• Newsletter: email address, consent text/version/time, confirmation and unsubscribe records, and confirmation-email delivery state. Signup uses Firebase storage and Resend email delivery. You receive news only after explicitly confirming by email, and can unsubscribe using the link in our emails. Unconfirmed signups are marked for deletion after 30 days; confirmation links expire after seven days.
• Technical records: site and provider request or security logs, which may include IP address, device and browser information, requested page and time.

Please do not add sensitive personal information to optional profile fields.

2. Purposes and legal bases

We use account and profile information to create accounts, authenticate collectors, apply visibility settings and provide collection features. The card registry verifies and records claims, prevents duplicate registrations and maintains ownership records. We use order data to fulfil purchases, service-email information to send necessary account messages, and technical logs to operate, secure and troubleshoot the service.

Depending on the processing, the legal basis is performance of a contract, compliance with a legal obligation, our legitimate interests in operating and protecting the service, or consent where required. Optional marketing and website analytics are separate from acceptance of account terms. Optional analytics is based on your consent.

3. Visibility and choices

A Public profile is visible to other signed-in collectors, not anonymous visitors. You can switch your profile to Private and edit optional details in Profile & settings. A Private profile and its collection are hidden from other collectors, while authorised staff and service providers may still process records necessary to operate the service. Public card pages can still show artwork and registration status without displaying your private account identity.

4. Providers and transfers

Google Firebase provides authentication, Firestore account and card records, and Cloud Storage for uploaded images. Hostinger hosts the website and application and generates associated logs. Resend delivers account emails. Shopify and its configured payment providers process checkout and orders. Fulfilment and delivery providers receive the details needed to deliver an order.

Where you allow optional website analytics, Google Analytics processes visit and device information for website measurement. See how Google uses information from sites that use its services.

Some providers may process information outside the European Economic Area. Where required, applicable data-protection transfer rules apply. Contact us for information about the safeguards relevant to your information.

5. Retention

We keep account information while an account is active and for any further period needed for legal obligations, disputes or security. Purchase and financial records are kept for periods required by applicable law. We retain card registration and transfer records as needed for an accurate registry, assessing deletion or anonymisation when personal identification is no longer necessary, subject to legal duties. Marketing details are kept until withdrawal or unsubscribe, apart from any necessary suppression record. Technical logs and backups follow applicable provider and security schedules.

6. Your rights

You may request access, correction, erasure, restriction, portability or object to processing where those rights apply. You may withdraw consent without affecting earlier lawful processing. Email contact@ridi-artcards.com. We respond without undue delay and normally within one month; if the law permits an extension, we will explain it within that first month. You can complain to the Slovenian Information Commissioner.

7. Cookies, measurement and security

The collector application uses authentication cookies and browser storage needed for account access and security. Shopify checkout may use its own cookies and technologies under its configuration and notice. Ordinary requests may appear in hosting and security logs. Clearing necessary browser storage may sign you out.

On our public marketing website, optional Google Analytics loads only after you choose Allow analytics. It measures public page visits and basic browser and device information using analytics cookies. Before that choice, or if you reject analytics, we do not load the Google Analytics tag. Your choice is stored in this browser for up to 180 days; analytics cookies are configured to expire after 180 days. Google Analytics event-data retention is controlled separately in our Analytics property.

Our integration excludes collector and administrator pages, card-claim links, verification links and preview pages. We send public page addresses without query strings or fragments and do not attach account identifiers, email addresses, names or card identifiers. Advertising storage and personalisation are disabled in this integration.

You can change your choice using Analytics preferences in the website footer or below. Rejecting analytics after allowing it stops collection, removes this integration's analytics cookies and reloads the page. This does not delete data already collected. Necessary account functions continue independently of your analytics choice.

We use HTTPS, access controls and provider security features, although no online system can guarantee absolute security. Personal-data incidents will be handled under applicable notification requirements.

8. Contact

LINESCAPES s.p., Rimska cesta 7A, 1000 Ljubljana, Slovenia. Email contact@ridi-artcards.com.