Privacy statement
Accounts and paid scans are coming soon. These terms apply once they are available; until then we are testing with a small group.
Last updated: 21 October 2026
On CardGrade you upload photos of a Pokémon card and get an estimate of your chances at grading. This page explains which data is involved, what we do with it and how long we keep it.
The short version: we don't store your photos. For your account we only keep what we need: your email address, your credits and your purchases. We use no trackers, no advertising cookies and no analytics tools, and we don't sell anything on.
Who we are#
CardGrade (cardgrade.nl) is a service of Loch Consultancy, sole proprietorship (eenmanszaak), registered with the Dutch Chamber of Commerce (KVK) under number 82496501. VAT ID: NL003691431B82.
We are the controller for the processing described here. Questions, or want to see, correct or delete something? Email info@cardgrade.nl. We don't have a data protection officer; you'll be talking to the owner directly.
Overview#
Your card photos
- What for
- Running the scan
- Legal basis (Art. 6(1) GDPR)
- (b) contract
- How long
- Not stored; only in working memory during the scan. At OpenAI normally up to 30 days (see below)
Account: email address (as entered and in normalised form), account ID, language, date of sign-up and last sign-in
- What for
- Your account and signing in
- Legal basis (Art. 6(1) GDPR)
- (b)
- How long
- As long as your account exists
Google ID (only if you sign in with Google)
- What for
- Signing in with Google
- Legal basis (Art. 6(1) GDPR)
- (b)
- How long
- As long as your account exists
Login codes (only as an encrypted code)
- What for
- Signing in by email
- Legal basis (Art. 6(1) GDPR)
- (b)
- How long
- Valid for 10 minutes; deleted after use, after 5 wrong tries and within 24 hours at most
Login session (only as an encrypted code)
- What for
- Staying signed in
- Legal basis (Art. 6(1) GDPR)
- (b)
- How long
- 30 days after your last visit, at most 90 days after signing in, or until you sign out
Counters against login abuse (encrypted code of your email address or network)
- What for
- Stopping too many sign-in attempts
- Legal basis (Art. 6(1) GDPR)
- (f) legitimate interest
- How long
- Until the counter's period ends, 24 hours at most
Credit balance and credit use (date, level, amount, reason)
- What for
- Keeping track of how many scans you have left
- Legal basis (Art. 6(1) GDPR)
- (b)
- How long
- As long as your account exists; rows of bought packs 7 years without a link to you
Which scans you made with your account (an encrypted code of the report number, the level and the date)
- What for
- Checking that a reported grade belongs to a scan of yours, for the bonus
- Legal basis (Art. 6(1) GDPR)
- (b)
- How long
- As long as your account exists
Reported real grades (report number, grader, grade, optional certificate number)
- What for
- Giving bonus scans and measuring our accuracy
- Legal basis (Art. 6(1) GDPR)
- (b) bonus and (f) accuracy
- How long
- As long as your account exists; an anonymous copy stays with the record
Purchases (pack, amount, VAT, currency, country, payment method, Mollie payment ID, status, time you chose to start straight away)
- What for
- Delivery, refunds, bookkeeping
- Legal basis (Art. 6(1) GDPR)
- (b) and (c) legal obligation
- How long
- 7 years (Dutch tax retention); 10 years for sales under the OSS scheme
Account block (yes/no and the reason)
- What for
- Preventing abuse and fraud
- Legal basis (Art. 6(1) GDPR)
- (f)
- How long
- As long as your account exists
After you delete your account: an encrypted code of your email address, with only "welcome scan given", "free scans used this month" and possibly "blocked after a chargeback"
- What for
- Preventing someone from starting over with the same address to get free scans or escape a block
- Legal basis (Art. 6(1) GDPR)
- (f) fraud prevention
- How long
- Free scans: until the end of that month. Welcome scan: 24 months. Block: until resolved, at most 24 months
Derived IP code (not the IP address itself)
- What for
- Preventing abuse, daily limit per network
- Legal basis (Art. 6(1) GDPR)
- (f)
- How long
- 48 hours at most
Emails we send you (login code, purchase confirmation)
- What for
- Providing the service
- Legal basis (Art. 6(1) GDPR)
- (b)
- How long
- Copy at our email provider: 30 days
Your emails to us
- What for
- Answering your question
- Legal basis (Art. 6(1) GDPR)
- (f) (and (b) if it's about a purchase)
- How long
- 12 months after it's dealt with; emails about a purchase 7 years
Technical logs
- What for
- Fixing errors, security
- Legal basis (Art. 6(1) GDPR)
- (f)
- How long
- Up to 14 days
Scan record (no name, email, account or IP)
- What for
- Measuring accuracy
- Legal basis (Art. 6(1) GDPR)
- (f)
- How long
- As long as the service exists, at most 5 years
The sections below explain each part.
Your account#
You need an account to scan, so we can keep track of your free monthly scans and the credits you buy.
- Signing in with an email code. You enter your email address and receive a 6-digit code by email, from noreply@cardgrade.nl. We only store the code encrypted. It works once, for 10 minutes; after 5 wrong tries it expires. Your account is only created when you enter the code correctly.
- Signing in with Google. If you choose this, we only ask Google for your email address and a fixed user ID. We don't store your name or profile picture. Google can see that you sign in to CardGrade; Google's own privacy terms apply to that. We use a plain redirect to Google, not a Google script on our own pages.
- To prevent abuse (one person creating new free accounts over and over), we compare email addresses in a normalised form (for example without dots or "+something" in Gmail addresses), refuse known disposable addresses and limit the number of sign-in attempts per email address and per network. When you sign in, your browser may solve a short computing puzzle (a "proof of work") to show it isn't a bot. That check runs on our own server, without any other party, and we store nothing from it.
- We only send you emails that belong to the service: login codes, purchase confirmations, a reminder before credits expire, and important changes. No newsletter or advertising.
Why we're allowed to do this: the account is needed to provide the service you use (Art. 6(1)(b) GDPR). Preventing abuse is our legitimate interest (Art. 6(1)(f)): every scan costs us money, and login codes must not be guessable.
Credits and payments#
- For each account we keep track of how many credits you have, when you received or bought them, when they expire and when you used one or got one back (date, level, amount, reason).
- Payment is handled by Mollie B.V. (Amsterdam), with iDEAL. You pay on Mollie's payment page. We don't see or store your bank account or card number. We give Mollie the amount, a description ("CardGrade Level III – 25 scans"), our order number and our internal account number; not your email address. Mollie tells us whether the payment was made or refunded, the amount, the payment method, Mollie's payment ID and the country (needed for VAT).
- Retention. We must keep our books for 7 years (Art. 52 Dutch General Tax Act). So we keep data about purchases and refunds for 7 years, even if you delete your account, but then without a link to your account. If we sell to customers in other EU countries under the OSS scheme, 10 years applies to that data (Art. 369k EU VAT Directive). We then only use it for bookkeeping and the Dutch tax authorities.
Why we're allowed to do this: delivery and refunds: the contract (b). Bookkeeping: a legal obligation (c).
What happens when you scan a card#
Your photos#
- Your browser downsizes your photos and sends them encrypted (HTTPS) to our server. The centering is already measured in your browser too.
- On the server we find the card in the photo, straighten it and crop it. This happens in working memory only. We don't write your photos anywhere and we don't keep them, not in your account either.
- Cropping removes your photo's metadata, such as location, date and phone model. None of that goes to our AI provider.
- To assess corners, edges and surface, we send the cropped card images to OpenAI, without your email address, account ID or IP address.
- The report, with your straightened photos, goes back to your browser and is only kept in that tab (
sessionStorage). Close the tab and it's gone. To keep it, print it or save it as a PDF.
A photo of a card usually isn't personal data. Sometimes something personal is in it anyway, like your hand or something in the background. Cropping leaves mostly the card itself.
Why we're allowed to do this: we need your photos to perform the scan you ask for (b).
The record of the result#
We keep a record of each scan so we can check how accurate we are. It contains a random report number, the time, the language, the level, the version of our software and of the AI model, which card we recognised, the measured centering, the defects found, the chances and the summary.
It contains no photos, no email address, no account ID and no IP address. We do keep, with your account, which scans you made with it, as an encrypted code of the report number. That lets us check later whether a grade you report belongs to a scan of yours. Only with our secret key can that code be matched to a record, and we only do that for the bonus. If you delete your account, those codes are gone and no record can be linked to you any more.
Why we're allowed to do this: measuring our accuracy is our legitimate interest (f): we want to be able to show honestly how often we get it right. The link with your account is part of the bonus in the contract (b).
Reporting your real grade#
Below your report you can tell us whether the result seems right, and later which grade your card actually got, optionally with the certificate number. If you report the real grade of a scan you made with your account, you get 3 extra Level I scans, if you report the grade at least 14 days after the scan, the scan itself wasn't paid for with bonus scans, and you haven't had 3 bonuses yet this month (see the terms, article 4). That's why we store the report with your account, together with the report number. We may check a certificate number in the grader's public database.
The certificate number is optional. If you delete your account, we erase the report from your account. The anonymous copy with the record stays. If you report a grade without signing in, we only keep it anonymously and you get no bonus.
Why we're allowed to do this: the bonus is part of the contract (b). We use the anonymous copy to measure our accuracy (f).
Preventing abuse: the daily limit per network#
On top of the limit of 25 scans per day per account, we keep a daily counter per internet connection, as a second brake against abuse (for example someone with dozens of accounts). For this we do not store your IP address, but a code we derive from it with a secret key. That key isn't stored with the counters and changes every day, so codes from different days can't be linked. For IPv6 we only use the first part of the address (the /64 block, and also the larger /48 block).
- The code only has two counters (attempts and scans), no times and no account.
- Retention: the counters run per day (in UTC, so from 01:00 or 02:00 Dutch time) and are overwritten within an hour after that day ends. They're gone no later than 48 hours after your scan.
- Why we're allowed to do this: legitimate interest (f): without this brake one person could make the free scans unaffordable for everyone. You can object (see "Your rights").
If you email us#
If you email us, we use your email address and what you write to answer you ((f), and (b) if it's about a purchase). We keep the email for up to 12 months after your question has been dealt with. If it's about a purchase, withdrawal or complaint, we keep it with our books (7 years).
Technical logs#
Our server keeps error messages so we can fix problems. We deliberately don't put IP addresses, email addresses or login codes in them, and our web server keeps no visitor log. A rare error message may still contain some technical information. We keep these logs for up to 14 days (f).
Cookies and browser storage#
We use no tracking or advertising cookies and no analytics tools, and we don't load scripts from other parties.
Cookie
__Host-session- What for
- Keeps you signed in. Holds a random code; we only store an encrypted version of it.
- How long
- 30 days after your last visit, at most 90 days after signing in, or until you sign out
Cookie
__Host-oauth- What for
- Only while signing in with Google: secures the return from Google to our site.
- How long
- 10 minutes; then deleted
Cookie
lang- What for
- Remembers whether you want the site in Dutch or English. Only when you click NL or EN yourself.
- How long
- 1 year, or until you clear it
sessionStorage(not a cookie)- What for
- Keeps your latest report in the tab
- How long
- Until you close the tab
This storage is needed for something you asked for yourself (signing in, a language choice, your own report). Under the Dutch Telecommunications Act (Art. 11.7a(3)(b)) that doesn't require consent. That's why there's no cookie banner. On Mollie's payment page, Mollie's cookies apply.
Who receives your data#
We don't sell your data and don't share it for advertising. These parties work for us as processors, under a data processing agreement:
- OpenAI (contracting party: OpenAI Ireland Ltd, Dublin) assesses the cropped card images for wear. OpenAI only receives the card images and our fixed instructions, no account, email or IP data. Processing takes place (also) in the United States. OpenAI does not use these images to train models, and we have configured OpenAI not to store the requests (
store: false). OpenAI does keep API traffic normally for up to 30 days to detect abuse, unless the law requires longer retention. If an image is flagged by the automated abuse check, OpenAI may keep it longer for manual review. See OpenAI: Your data. - Hetzner Online GmbH (Gunzenhausen, Germany) hosts our server, in a data centre in Nuremberg (Germany). Your account data, credits, purchases, the records and the logs live there.
- Proton AG (Geneva, Switzerland) sends our emails (login codes and purchase confirmations) from noreply@cardgrade.nl. Proton receives your email address and the content of the email, and keeps a copy in our sent mail. We delete it after 30 days.
Mollie B.V. (Amsterdam) processes your payment as an independent controller, not as our processor. Mollie is a payment institution supervised by De Nederlandsche Bank and decides for itself how it processes payment data, including for the payment, fraud checks and the legal anti-money-laundering checks. Mollie's privacy statement applies to that.
Google (Google Ireland Ltd, Dublin) is an independent controller if you choose to sign in with Google, under Google's own privacy terms.
Beyond that, we only hand over data when the law requires it, for example to the Dutch tax authorities or by court order.
Transfers outside the EU#
- OpenAI. The card images go to the United States. Under OpenAI's data processing addendum (version 1 January 2026), that transfer is based on the European Commission's standard contractual clauses or an adequacy decision.
- Proton. Proton is based in Switzerland. The European Commission has found that Switzerland protects personal data adequately (adequacy decision 2000/518/EC, confirmed again by the Commission in January 2024). So no extra safeguards are needed.
- Google. Google may process data in the US. Google does so on the basis of the EU-US Data Privacy Framework (adequacy decision (EU) 2023/1543) and/or standard contractual clauses.
Email us if you'd like to know more.
No automated decisions about you#
The result is an estimate about a card, not about you. It has no consequences for you as a person, so there's no automated decision-making within the meaning of Art. 22 GDPR. Our abuse rules (such as refusing disposable addresses or a daily limit) run automatically. We only block an account for abuse or a payment chargeback. If you think you've been blocked wrongly, email us and a person will look at it.
How we protect your data#
The connection is always encrypted (HTTPS). We store login codes and sessions only encrypted. The database lives only on our own server, which only we can access, using keys instead of passwords. We keep as little as possible and delete it as soon as we can. If something does go wrong with personal data, we report it to the Dutch Data Protection Authority within 72 hours where required and, if it affects you, to you as well.
Deleting your account#
You can delete your account by emailing us. If you ask by email, we do it within 30 days.
- We erase: your account, email address and Google ID, your sessions and login codes, the history of your free and bonus scans, the codes of the scans you made with your account, and your reported grades with your account.
- We keep, without a link to you: your purchases and the rows of the bought packs in the credit ledger, for 7 years for our books. The anonymous scan records and the anonymous copies of reported grades also stay.
- We remember, without your email address: an encrypted code of your email address with only whether you already got the welcome scan, whether you already used this month's free scans, and whether your account was blocked after a payment chargeback. That way nobody can delete an account and start again straight away to get new free scans or escape a block. We make the code with a secret key; without that key it can't be turned back into your email address. We do recognise it if someone later signs up with the same address, so it is still personal data. Legal basis: our legitimate interest in preventing fraud and abuse of the free scans (Art. 6(1)(f) GDPR). Retention: the monthly counter until the end of that month, the welcome scan 24 months, a block until it's resolved and at most 24 months. You can object to this (see "Your rights").
- It disappears from backups after 35 days at most.
Please note: if you delete your account while you still have paid credits, they lapse. You'll see how many first. Would you rather have them refunded? Email us within the withdrawal period, or see the terms for when you're entitled to a refund.
Inactive accounts. If you haven't signed in for 24 months and have no valid paid credits left, we'll email you. If you don't sign in within 30 days after that, we delete your account.
Your rights#
You have the right to access your data, to have it corrected or deleted, to have its processing restricted, and to object to processing based on our legitimate interest. For data you provided yourself (your account, your reports) you also have the right to data portability.
For anything else, email info@cardgrade.nl from your account's email address. We'll respond within a month. We can't find anything for the IP code: we don't know which code is yours, and it's erased after a day.
Not happy with how we handle your data? Let us know first. You can always file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) (autoriteitpersoonsgegevens.nl), or with the authority in your own EU country.
Children and young people#
You can create an account from age 16. If you're younger, you may only do so with the permission of a parent or guardian. If you're under 18, you may only buy credits with the permission of a parent or guardian. We don't ask for your name or age. Parents or guardians can email us with questions or to have an account deleted.
Changes#
If anything changes in how we handle data, we'll update this statement before the change takes effect. For important changes we'll email you. The date of the latest version is at the top.