Privacy Policy

GoSwapCards is a marketplace and transaction facilitation platform for trading cards and related collectibles. The platform is operated by GoSwapCards B.V., trading as GoSwapCards.

GoSwapCards B.V. is the controller for the personal data described in this policy, unless this policy states that another party acts as an independent controller for a specific processing activity.

This Privacy Policy explains what personal data we process when you visit the website, create an account, list cards, make or accept offers, buy, sell, or trade, use SecureSwap or the Authentication Service, receive payouts, ship or receive items, provide transaction evidence, or contact support.

This policy forms part of the agreement between you and GoSwapCards together with the Terms of Service, the Shipping Policy, and the Cookie Policy.

Contact details for privacy matters are listed at the end of this policy.

Account and identity data: email address, username, password credentials (stored in hashed form by our authentication provider), account settings, and optional profile information you add yourself.

Sign-in with Google: if you use Google to sign in, we receive your email address and basic profile details (such as your name and profile picture reference) from Google in order to create and secure your account. The platform shows your chosen GoSwapCards username publicly, not your Google name. Section 14 explains how we access, use, share, protect, keep, and delete the data we receive from Google.

Address and contact data: shipping and billing addresses, phone number where required for delivery, and address snapshots that the platform records at specific transaction stages for shipping integrity, fraud prevention, and dispute handling.

Listing and collection data: the cards, binders, listings, prices, condition descriptions, and images you add to the platform. Content you choose to publish (for example a public binder or a marketplace listing) is visible to other users and to visitors without an account. Card images are treated as product images: the image files you upload are served from public storage and are technically retrievable by anyone holding their link, including images of cards you have not published. Your account details, addresses, transactions, and messages are never public, and your e-mail address is never shown to other users. A card you publish appears on the platform under your GoSwapCards username. A card you have not published is not displayed to other users anywhere on the platform, and its image is not linked to your username or profile.

Transaction data: offers, accepted deals, orders, deal type (sale, swap, hybrid, SecureSwap, Authentication Service), amounts, fees, cash-difference components, statuses, timestamps, and cancellation or refund history.

Payment and payout data: payment status, payout status, refund and dispute status, and seller verification (KYC) status. Card numbers and full payment credentials are processed by our payment provider Stripe and are not stored on GoSwapCards servers. For sellers, Stripe collects identity-verification information (such as identity documents and bank details) directly; GoSwapCards receives the resulting verification status and the limited data needed to operate payouts.

Shipping and tracking data: selected shipping method, shipping labels, carrier, tracking numbers, tracking events, delivery confirmations, and hub receipt records, processed through our shipping provider Sendcloud and the carriers it connects to.

Evidence you provide through support: photos, video, packaging information, proof of posting, or other files you voluntarily provide or that support asks you to provide for a specific transaction review. Evidence actually received by GoSwapCards is treated separately from public listing or binder images.

Locally retained shipment evidence: GoSwapCards strongly recommends keeping clear original card and sealed-package photos and one continuous, unedited packing video yourself. GoSwapCards does not process those local files unless you later provide them through support, for example during a loss, damage, mismatch, authenticity, or packaging review. No upload is required during the normal shipping process.

SecureSwap and Authentication Service hub records: when items pass through the GoSwapCards process, we record intake, inspection, and dispatch events, and we may capture package or card photos, scan records, tracking records, admin notes, and outbound-packaging records for authenticity support, damage documentation, dispute handling, operational handling, and support.

Support, dispute, and enforcement data: messages with our support team, problem reports, refund requests, evidence you or your counterparty submit, and records of policy-enforcement decisions.

Communications data: in-platform messages between users related to deals, and email notifications we send you about your account and transactions.

Technical data: IP address, browser and device information, log data, and security events, used to keep the platform available and secure.

To provide the platform and perform our contract with you (Article 6(1)(b) GDPR): creating and managing your account, showing your collection and listings, facilitating offers and deals, processing payments and payouts, generating shipping labels, operating SecureSwap and Authentication Service flows, handling evidence needed for the applicable transaction, and handling cancellations, refunds, and receipt confirmations.

To comply with legal obligations (Article 6(1)(c) GDPR): tax and accounting record-keeping, responding to lawful requests from competent authorities, and supporting the identity-verification and anti-money-laundering checks that our payment provider is required to perform for sellers receiving payouts.

For our legitimate interests (Article 6(1)(f) GDPR): preventing fraud, abuse, and counterfeit trading; verifying shipments and hub intake; documenting item condition and packaging with photos, scans, and evidence actually provided through support; assessing possible packaging failure, carrier damage, hub handling, or outbound transport; resolving disputes between users; securing the platform; and establishing, exercising, or defending legal claims. Where we rely on legitimate interests, we balance them against your rights and process only what is reasonably necessary.

With your consent (Article 6(1)(a) GDPR): only where we ask for it explicitly, for example for optional communications or any future non-essential cookies. You can withdraw consent at any time; withdrawal does not affect processing that happened before withdrawal.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects for you or similarly significantly affect you. Automated checks such as fraud signals, rate limits, and payment-deadline rules can pause or flag activity, but decisions such as account restriction, refund outcomes, and dispute outcomes are made with human review.

We do not sell your personal data, and we do not use your personal data for third-party advertising.

Payments and payouts on GoSwapCards are processed by Stripe (Stripe Payments Europe, Ltd. and affiliated Stripe entities) through Stripe Connect.

When you pay, Stripe processes your payment details directly. GoSwapCards receives payment status, amounts, and the references needed to connect a payment to a deal; we do not store full card numbers.

Sellers who want to receive payouts complete Stripe identity verification (KYC). Stripe collects identity documents, date of birth, and bank account details directly and acts as an independent controller for its own regulatory obligations. GoSwapCards receives the verification outcome (for example verified or action-required) and the seller-type classification needed to operate the marketplace.

Stripe's own privacy policy applies to the data Stripe collects: https://stripe.com/privacy.

To create shipping labels and track shipments, we share the sender and recipient name, address, and shipment details with our shipping provider Sendcloud and the carrier that transports the package (for example PostNL or DHL).

Your transaction counterparty sees the information needed to complete the deal. In direct shipping flows this includes the recipient name and shipping address on the label. In SecureSwap and Authentication Service flows, items are shipped through the designated GoSwapCards intake process, which limits the address data exchanged directly between users.

The address shown in an order or shipping flow is the designated GoSwapCards intake address. GoSwapCards manages the applicable intake, review, and forwarding process. Internal handling and security details are not published.

Before shipping cards, GoSwapCards strongly recommends that users retain clear photos of the card front, card back, and sealed shipment-ready package, plus one continuous, unedited video showing card condition, protective materials, packaging, and final sealing. Users should keep the original files until the transaction and any related support or dispute review have fully ended. GoSwapCards does not process those local files unless they are later provided through support.

When items pass through the GoSwapCards process, authorised staff may photograph or scan items and packaging and record receipt, review, tracking, and dispatch events. These records may cover a closed package, visible transport damage, card fronts and backs, relevant detail images, outbound packaging, and tracking or scan events.

Evidence is used for operational handling, authenticity support, fraud prevention, damage assessment, dispute resolution, support, chargeback handling, and legal claims. It can help compare condition across stages, but it may not establish every cause or responsible party with certainty.

Transaction evidence actually received or created by GoSwapCards is private. A counterparty does not automatically receive access to support evidence, hub photos, or scans. Access is limited to authorised GoSwapCards staff and relevant service providers where access is necessary for hosting, security, shipping, support, investigation, or legal compliance.

Address snapshots recorded at transaction stages are used to keep shipping honest and auditable: they document where an item was supposed to go at the moment a deal or shipment was confirmed.

Service providers (processors) that help us run the platform: Supabase (database, authentication, and file storage), Cloudflare (website delivery and edge security), Stripe (payments, payouts, and seller verification, partly as independent controller), Sendcloud together with its connected carriers (shipping labels and tracking), Resend (delivery of account and notification emails), and Microsoft (support email and mailbox services).

Authorised personnel and relevant service providers: evidence actually received or created by GoSwapCards may be accessed only by authorised GoSwapCards staff and by a provider where access is necessary to host, secure, transmit, investigate, support, or legally process it. Access is limited to what is reasonably required for the task.

Other users: your username and any content you publish (public binders, marketplace listings, reviews) are visible to other users and visitors. Your transaction counterparty sees the deal details and, where required for direct shipping, the name and address on the shipping label. Support evidence and hub evidence are not automatically shared with the counterparty, although a relevant part may be used or disclosed where reasonably necessary to explain or resolve a case and permitted by law.

Authorities and legal claims: we may disclose personal data where required by law, to comply with a valid legal request, or where reasonably necessary to establish, exercise, or defend legal claims, prevent fraud, or protect the safety of users and the platform.

Business transfers: if GoSwapCards is involved in a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of that transaction, subject to this policy or a successor policy with equivalent protection.

We work with processors under data-processing agreements as required by Article 28 GDPR.

We aim to store and process personal data within the European Economic Area (EEA) where reasonably possible.

Some of our providers (or their sub-processors) may process data outside the EEA, for example in the United States. Where that happens, transfers rely on an adequacy decision (such as the EU-US Data Privacy Framework where the provider is certified) or on Standard Contractual Clauses with additional safeguards.

You can contact us using the details below for more information about the safeguards that apply to a specific provider.

Account data: kept while your account is active. If you want your account deleted, you can request this via the contact details below; we then remove or de-identify the personal data that we no longer need, subject to the retention duties below.

Transaction, payment, and payout records: kept for as long as they are needed for the transaction and for as long as we are required to be able to produce them under tax and accounting law. In the Netherlands the standard administrative retention period for that administration is seven years. That period describes the administration we must be able to produce; it is not a promise that every individual record stays stored in the platform itself for seven years. Records that are no longer needed for an active transaction, a dispute, a claim, or a retention duty may be removed or de-identified from the platform sooner.

Shipping, tracking, hub, photo, scan, and evidence files actually provided to or created by GoSwapCards: kept for as long as needed to complete the transaction, investigate authenticity, loss, damage, fraud, or packaging issues, handle refunds, disputes, chargebacks, support, and legal claims, and meet any administrative retention duties that apply to the underlying transaction.

Locally retained packing videos remain under the user's control unless and until the user submits the file to GoSwapCards. Once submitted, the file is handled as private transaction evidence under this policy.

Support and dispute records: kept for as long as needed to resolve the matter and to defend against legal claims, and then deleted or de-identified.

Technical logs and security data: kept for a limited period appropriate to security monitoring and then deleted or aggregated.

Where an exact period cannot be stated in advance, we determine retention based on the purpose of the processing, applicable legal requirements, transaction and dispute status, chargeback periods, and the limitation periods for legal claims.

Under the GDPR you have the right to access your personal data, to have inaccurate data corrected, to have data erased where the conditions for erasure are met, to restrict processing, to object to processing based on legitimate interests, and to receive the data you provided to us in a portable format.

Where processing is based on consent, you can withdraw that consent at any time.

You can manage much of your data yourself in your account settings, including profile details, addresses, and the visibility of your binders and listings.

To exercise any of these rights, contact us at goswapcards@outlook.com. We may ask you to verify your identity before acting on a request, and we respond within the periods required by the GDPR (in principle within one month).

Some data cannot be deleted immediately on request, for example transaction records we must keep for tax law or records needed to handle an open dispute. In that case we will tell you what we must keep and why, and delete it when the retention duty ends.

You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority in your EU country of residence.

We apply technical and organizational measures appropriate to the risk, including encrypted connections (HTTPS), access controls and row-level security on our database, hashed password storage through our authentication provider, separation between public content and account-only data, and restricted access to private transaction evidence.

Payment credentials are handled by Stripe under PCI-DSS; they do not touch GoSwapCards servers.

Evidence actually received by GoSwapCards is not treated as public listing media, and access is restricted according to its operational, support, or legal purpose. No online platform can guarantee absolute security.

If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the Autoriteit Persoonsgegevens and, where required, the affected users, in line with our GDPR obligations.

Marketplace listings, public binders, public profile pages, and reviews are visible to anyone, including visitors without an account and search engines.

You control what you publish: binders and cards are private by default until you make them public or list them for sale or trade.

Card images you upload to public listings or public binders are served from public storage so listing pages can display them. Do not include personal information in card photos or listing descriptions that you do not want to be public.

Evidence you provide through support, hub intake photos, scans, and other operational evidence are not public listing content and are not automatically visible to your counterparty.

The transactional features of GoSwapCards are intended for users who are at least 18 years old, as set out in the Terms of Service.

We do not knowingly collect personal data from children. If you believe a minor has created an account without a permitted basis, contact us and we will take appropriate action.

GoSwapCards currently uses only strictly necessary cookies, mainly to keep you signed in and to protect payment pages against fraud.

We do not use analytics or marketing cookies at this time. If that changes, we will ask for consent where the law requires it and update the Cookie Policy first.

See the Cookie Policy at /cookies for the full explanation.

This section applies when you sign in to GoSwapCards with your Google account. It explains which Google user data we access and how we use, share, protect, keep, and delete it. It adds to the rest of this policy and does not replace it.

What we access: when you choose Sign in with Google, Google shares your email address and basic profile details (your name and profile picture reference) with us, together with the identifier Google uses for your account. We request only Google's basic sign-in scopes for your email address and profile. We do not access your Gmail, contacts, calendar, files, or any other Google service.

How we use it: we use this data only to create your GoSwapCards account, to let you sign in, to keep your account secure, and to send you the account and transaction emails described in Section 2. Other users see your chosen GoSwapCards username, never your Google name or your email address.

Who we share it with: we do not sell Google user data and we do not use it for advertising. We share it only with the service providers that run GoSwapCards for us, and only for that purpose: Supabase stores it as part of our authentication and database service, Cloudflare delivers the website and your account pages, and Resend delivers our emails to your email address. Section 6 lists these providers. We may also disclose it where the law requires it, as described in Section 6.

We do not use Google user data to develop, improve, or train artificial intelligence or machine learning models, and we do not transfer it to anyone for that purpose.

How we protect it: Google user data is covered by the measures in Section 10, including encrypted connections (HTTPS) and access controls and row-level security on our database.

How long we keep it and how to delete it: we keep Google user data for as long as your GoSwapCards account exists. You can ask us to delete your account at any time via the contact details in Section 16; we then delete or de-identify this data, except for records that Section 8 requires us to keep. You can also remove GoSwapCards' access to your Google account at any time at https://myaccount.google.com/permissions. That stops future sign-ins with Google, but it does not delete your GoSwapCards account or the data we already hold; to have that deleted, contact us.

GoSwapCards' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

We may update this Privacy Policy from time to time, for example when we add features or providers.

If we make material changes, we will publish the updated version on the platform, update the date above, and provide any notice required by applicable law.

Controller: GoSwapCards B.V., trading as GoSwapCards.

Operator: Vincent Wiechers.

Registered address: Schaapherderweg 1-B, 2988 CK Rotterdam, the Netherlands.

Chamber of Commerce number: 99453355.

VAT number: NL868998576B01.

Privacy and support email: goswapcards@outlook.com.

For any privacy question or request, email us with the subject line "Privacy request" so we can route it quickly.