Draft — pending legal review. This document is a working draft and has not yet been reviewed by a qualified legal professional. It is not final and may change before Vaultly TCG launches publicly.

Privacy Policy

This policy explains how Vaultly TCG ("Vaultly", "we") handles personal data when you use our website, apps, live shows and related services. Vaultly is the controller of the personal data described here, except where a seller acts as an independent controller for the order data they receive to fulfil your purchase.

Data we collect

Category	Examples	Source
Account	Name, username, email, country, password hash, preferences	You
Security	Two-factor settings, sign-in history, device and IP information, session identifiers	You and your device
Transactions	Orders, bids, offers, payment status, payouts, refunds, disputes	You, other users, our payment provider
Delivery	Delivery addresses, phone number for carriers, tracking events	You, sellers, carriers
Seller verification	Legal name, business details, VAT number, identity and bank verification status	You, our payment provider
Content	Listings, photos, messages, reviews, chat messages, reports	You
Live shows	Viewing activity, chat, bids during streams; video and audio if you broadcast	You
Technical	Browser, app version, crash logs, essential cookies	Your device

We do not receive or store your full card number; card details go directly to our payment provider.

Why we use your data

• To provide the Services (contract): creating your account, listings, checkout, delivery, payouts, messaging and live shows.
• To keep the marketplace safe (legitimate interests and legal obligation): fraud prevention, counterfeit detection, shill-bidding detection, account security alerts, enforcing our policies and responding to reports.
• To meet legal obligations (legal obligation): tax and VAT reporting, accounting records, responding to lawful requests and marketplace reporting rules.
• To improve Vaultly (legitimate interests): aggregated analytics, service quality and search relevance. Optional analytics cookies are used only with your consent.
• To contact you (contract or consent): service messages, and marketing only where you have opted in.

Sharing

We share personal data only as needed:

• With other users — sellers receive the buyer's name and delivery address for orders they fulfil; your public profile shows your username, display name and country. We hide email addresses and phone numbers in messaging.
• With service providers — payment processing, identity verification, hosting, email delivery, carriers and label providers, livestream infrastructure and customer support tools, under contracts that require them to protect your data.
• For legal reasons — with regulators, tax authorities, law enforcement or courts where required by law, or to protect users from fraud or harm.
• Business transfers — if Vaultly is reorganised or acquired, your data may transfer subject to this policy.

International transfers

Vaultly operates internationally. Where personal data is transferred outside the UK or EEA we use appropriate safeguards, such as adequacy regulations or standard contractual clauses.

How long we keep data

We keep account data while your account is open. After closure we keep transaction, tax and payout records for up to 7 years for legal and accounting purposes, security logs for up to 2 years, and moderation records for as long as needed to enforce bans and handle appeals. Livestream replays are kept only if the seller enables replays and for the retention period shown.

Your rights

Depending on where you live you may have the right to access, correct, delete, restrict or object to our use of your data, to data portability, and to withdraw consent. You can:

• download a copy of your data from Account → Privacy & data;
• request deletion of your account from the same page;
• change marketing and notification preferences in Notification settings.

You can also complain to your data protection authority. In the UK this is the Information Commissioner's Office.

Security

We protect data with encryption in transit, encryption of sensitive secrets at rest, short-lived access tokens, rotating refresh tokens, two-factor authentication and staff access controls with audit logging. No system is perfectly secure; please use a unique password and enable two-factor authentication.

Children

Vaultly is not intended for anyone under 18 and we do not knowingly collect data from children.

Contact

Contact our privacy team through Account → Privacy & data or the Help Centre. We aim to respond to rights requests within one month.