Privacy Policy

Last updated: May 9, 2026 · Effective: May 9, 2026

X3 Collectibles LLC ("we", "CardPrepAI") respects your privacy. This policy explains what we collect, why, and your rights.

1. What we collect

• Account data: email, hashed password (if you create an account), Stripe customer ID for billing
• Audit-trail at signup: consent text, consent timestamp, IP address, user-agent — to demonstrate informed consent under TCPA, CCPA, and GDPR
• Card images you upload: processed for grade prediction; stored encrypted; deleted on account closure
• Usage data: pages visited, predictions run, errors encountered — for product improvement
• Payment data: processed by Stripe; we do not store card numbers

2. Why we collect it

To provide the service · to bill you · to comply with anti-fraud and tax law · to improve the AI · to communicate product updates if you opted in.

3. How we use AI

Card photographs are processed by AI models (Anthropic Claude and Cloudflare Workers AI) to extract identification and condition data. Photos are not used to train shared third-party models without your consent. Aggregated, de-identified data may be used to improve our internal predictors.

4. Sharing

We share data only with:

• Stripe (payment processing)
• Anthropic and Cloudflare (AI inference; processed under their privacy terms)
• Resend (email delivery)
• Law enforcement, when legally required

We do not sell your personal data. Ever.

5. Your rights

You have the right to access, correct, delete, or export your data. CCPA, CPRA, GDPR, Texas TDPSA, Colorado, Connecticut, and Virginia residents have additional rights. To exercise: [email protected].

6. Cookies

We use minimal cookies — only what's necessary for login, cart, and basic analytics. We do not run third-party advertising trackers. You can disable cookies in your browser; some features may not work without them.

7. Children

The service is not directed at children under 13. We do not knowingly collect data from children under 13.

8. Retention

Account data is kept as long as your account is active. Card images are deleted within 30 days of account closure. Aggregated, de-identified usage data may be retained indefinitely for AI improvement.

9. Security

We use Cloudflare TLS 1.2+ encryption in transit, encrypted-at-rest storage, and minimum-privilege access controls. No system is perfectly secure; we will notify you of any material breach affecting your data within 72 hours.

10. Changes

We will notify you of material changes via email at least 14 days before they take effect.

11. Contact

X3 Collectibles LLC · Privacy questions: [email protected] · Howell, Michigan, USA