Privacy

What we keep.

The card in the photo is not a person. Your account still is. UK GDPR applies to the email, username, and photos on your account. Graid is the controller. Contact joseph@clonecentre.ai.

Graid
Email joseph@clonecentre.ai
United Kingdom

The geographic address is available from joseph@clonecentre.ai and is published here once it is set on the server.

What we collect

Account: email, username, password hash, and whether you confirmed you are 13 or older, or that a parent or guardian is setting the account up. We do not ask for a date of birth.

Scans: the photos you upload, the card name we return, the four scores, and the price estimate. We keep your copy so the binder works. Our grading partner in the EU receives a copy only to name the card and return a 1–10. They process the inference photo and do not keep it. We do not use your photos to train image models.

Shop profile, only if you turn a shop on: shop name, city, hours, website, and a short about line. Public binder choices: whether the binder is shared, a title, a cover, and an avatar.

Orders: delivery name and address for a purchase you start, payment status from Stripe, and seller reviews you choose to write. We do not store full card numbers.

Product analytics, only if you accept them: a few click names such as “grade clicked”. We do not sell data and we do not run advertising pixels.

Why

We use the account and scans to run Graid (contract). We use order records to take payment, ship, and handle disputes (contract and legal obligation). Optional analytics and product emails are consent, and you can refuse both. Fraud and abuse reports are legitimate interests, limited to what the report needs.

Who else sees it

Stripe handles web payments. Apple handles iPhone token charges. Resend sends email. Ximilar, in the EU, grades the photo. A share code you open can be stored so that person is credited. Shared cards show your username to other collectors. We do not sell personal data.

Some of those companies process data outside the UK. Stripe, Resend, and Apple use their own international transfer terms. Ximilar processing stays in the EU.

How long

Account data and scans stay until you delete the account. Order records can remain after deletion with the name removed, where tax or a dispute still needs them. Marketing email stops when you unsubscribe. Analytics events are deleted with the account.

Your rights

You can download your data or delete the account from Account. You can also ask us to access, correct, delete, or restrict data, or to object, from this form. You can complain to the ICO at ico.org.uk. Nothing here limits those rights.

Children

Children can use Graid. In the UK, someone aged 13 or over can create their own account. Under 13, a parent or guardian sets the account up. We do not ask for a date of birth. To delete a child’s account, email joseph@clonecentre.ai.

Cookies: Cookie policy. Questions: joseph@clonecentre.ai.