Privacy Notice — UK Closed Alpha

1. Account and product data

When you sign in with Google we store your Google account identifier, your email address, and the display name and avatar Google provides. Using the product stores what you put into it: the cards you mark as owned or wanted, graded-card details you enter, decks, discovery decisions, preferences, contribution and Verification Quest proposals, and push-notification subscriptions. We also keep your invitation, entitlement, accepted document-version history and each acceptance time, daily portfolio snapshots, recognition events where enabled, and the minimum operator audit needed to run, investigate and secure the alpha.

A close-friends preview link does not use Google or a password. If you choose to enter through one, we create a random internal account identifier and collector name, set the account to UK test, and store the invitation campaign, accepted document-version history and acceptance times. We do not ask for or infer your email. The one-use link key is removed from the browser address before consent is sent; only its SHA-256 digest is stored, so the database cannot reconstruct the link.

After a completed Trade or Purchase, you can optionally leave one structured private product response: how the journey felt, which part shaped that answer, and whether you would use the journey again. It contains no free text and is not a review of the other collector.

Older beta records may include a WhatsApp, Instagram or Discord handle supplied before the off-platform exchange path was retired. Current Trade and Purchase journeys do not collect, require or reveal those handles.

Product usage events.To see where the alpha works and where it gets stuck, LVLING records first-party product telemetry — product usage events — inside its own database: which product screens you open (recorded as a screen template such as “set grid”, never the full address or any search text), that a sitting started, when a card sheet is opened and which of its tabs you switch to, your Discovery decisions and card views, ownership changes you make, taps on next-step buttons, empty screens you reach, price states shown as uncertain, the short in-product prompts you are shown and the one-tap answer you give, and client-side error digests. Each event carries your account identifier, a random session key that lives only in that browser tab, the event name, a closed-vocabulary detail and a time. It carries no free text, no query string, no IP address, no device fingerprint and no location. These events are used only to improve the product and are never sold, shared with advertisers, or used to change a price, a transaction, Trade Standing or Collector Rank.

2. Circle and showcase visibility

When you mark a card as Shown, that card, and nothing else in your collection, is visible to anyone who opens your showcase until you switch it off. We keep a record of when you switched it on and off.

When you mark a card as Up for trade, other collectors see only that it is available to trade: by default only the circles and members you share with, or anyone if you choose a public showcase. They never see your address, your location, or any card you have not marked.

Joining a circle switches on, by default, circle-wide visibility of your up-for-trade cards and your name against them for that circle’s members; you can turn this off at any time on the circle’s Sharing page.

3. Transaction and fulfilment data

This covers your orders, trade legs, itemised amounts, card-authorisation facts, Stripe references, labels, carrier tracking, reports, cases, returns and their outcomes, cover claims, refunds, payouts, payments LVLING makes to you and the account details you give us to receive one (used only to make that payment), and notifications. It also covers your private Trade Standing evidence and your test-Trade records.

The other side of an order or trade sees the cards, the agreed amounts and the tracking. The parcel label shows the recipient’s name and address (the buyer’s, or the other member’s in a trade), and may show the sender’s return address; the sender sees the label when posting.

Other members do not see your orders. They may see a card’s completed sale prices and Trade values on LVLING, and a seller’s count of confirmed sales. Collector Rank does not set any of this. Test Trade Standing never sets a live limit. Test-Trade records are simulations, never proof that money, a label or a card moved.

We keep your listing photos and the photos taken for an order: cards, packaging, labels and posting receipts. Listing photos are shown with your listing. Order photos are used to review a report. Labels and receipts can show names and addresses.

4. Postal addresses

For a live order or trade LVLING collects the UK address a parcel goes to and the address it is sent from. Each is stored as an encrypted snapshot, together with:

• its country and routing jurisdiction
• its address role and verification result
• the document versions
• its creation and retirement state
• an access and action audit that holds no address details

Street, locality and postcode stay inside the encrypted snapshot. It is encrypted with a versioned key kept in LVLING’s hosting settings for the closed alpha, not in a hardware key service.

Only you and the server step that buys the label can read your stored address. Sendcloud receives it to make the label, and the label shows it as section 3 says. Ordinary product reads, notifications, logs, support cases and account exports do not reveal ciphertext, integrity keys or another member’s address, except on the parcel label and its photo. Opening a support case never gives a support operator your stored address.

An address tied to an active order or trade cannot be deleted while that order or the other member’s rights depend on it. We keep a parcel address while an order or report needs it. Removing it in Account stops it being used for new orders. To have stored copies deleted, ask in Help & Support; we check each request against what the law makes us keep. Any fixed deletion period will appear in a new version of this notice first. So will any change to how the key is held.

5. What we deliberately do not keep

No card numbers or security codes: Stripe holds payment details, not LVLING, and LVLING keeps no member balance. No private messages, because there is no messaging. No advertising trackers, device fingerprints or IP-address profiles. Seller photos are never used as catalogue images. The marketing site’s visit counter (GoatCounter) is cookieless.

6. Why we keep it

We use account and product records to provide the service you joined. We use collection, discovery and contribution records to deliver and improve those features. We use security, consent, transaction and audit records to prevent abuse, diagnose failures and keep an accurate history. We use order, payment and address data to carry out your purchase, sale or trade (contract). We keep the records the law requires, such as tax records (legal obligation). We use security and audit records to prevent fraud and abuse (legitimate interests). Any new identity, fraud, payment, carrier or relationship data needs a documented lawful basis and a privacy review before we collect it.

Product usage events are used to understand which parts of the alpha are used, where members stop, and which prompts help; they are read in aggregate by the LVLING team and are kept for the duration of the alpha and its evaluation.

Optional post-transaction feedback is used only to improve the Trade and Purchase journeys. It does not change a transaction, price, Trade Standing or Collector Rank, and it is not treated as NPS, willingness-to-pay or proof of commercial conversion.

If you ask for help, we store a case ID, structured issue category, account or exact Trade/Purchase reference, priority, status, response template and an append-only customer/operator timeline. The first-alpha case form accepts no free text or uploads. A support case cannot expose another member’s transaction, change transaction state or give a support operator access to payment credentials or addresses.

If you ask, we email you about wanted spares. Stop any time.

Your profile is private by default. Making it public is an explicit toggle, and it does not publish your email, address, payment facts, private transaction evidence or legacy contact handle.

7. Cookies

We use a session cookie that keeps you signed in and short-lived security cookies while Google sign-in or an invitation is completing. A close-friends preview uses the same strictly necessary HttpOnly session cookie after its one-use fragment is consumed; the raw fragment is not put into that cookie. A device-local preference remembers your collecting focus. There is no advertising or optional tracking cookie. The app uses browser session storage for usage measurements.

8. Where it goes

Data lives in our database (hosted on Railway/Neon in Europe) and is not sold or shared with advertisers. Market references come from configured data sources subject to source and publication gates; your member identity, collection and behavior are not sent to them. Google processes the sign-in you choose.

Stripe processes payments and card authorisations and hosts the seller’s own Stripe account. It receives the payment and identity fields that role needs, and checks sellers’ identity as its own controller. LVLING buys the Royal Mail label through Sendcloud, which receives the route and contact fields for the selected service, and Royal Mail carries the parcel; a carrier claim shares that label, its scans and the parcel’s value with them. Sendcloud’s cover partner, XCover, receives the parcel value and any claim details. When LVLING pays you under section 4 of the terms, your sort code and account number go to LVLING’s bank to make the transfer. Sign-in emails and push alerts go through our email and push providers. When automatic help answers are switched on, a question typed on the help page goes to Anthropic, which writes the answer; asked from an order, a short status summary goes too. LVLING does not keep the question or the answer. Provider references stay with the transaction record.

Stripe, Google and some other providers may process data outside the UK. Safeguard for each transfer: UK adequacy regulations where applicable, including the UK Extension to the EU–US Data Privacy Framework for covered transfers to participating US organisations, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses where adequacy does not apply.

9. Your rights and how to use them

You can ask for a copy of your data, correction, or deletion at any time through Account → Help & Support. Choose the privacy, deletion, complaint or legal category to receive an attributable case ID inside LVLING. The ordinary product data is deleted and your profile is scrubbed. We retain the minimum stable Google identifier needed to stop the erased account being silently recreated, the invitation/consent record needed to preserve the founding allocation or one-use preview record, and a minimal pseudonymous deletion audit. For a close-friends preview, the retained re-registration tombstone is the random internal preview identifier rather than a Google identifier. If an account ever has trade or payment history, deletion is paused for a reviewed legal retention decision rather than automated. Where no transaction-retention obligation applies, we remove the member link from an immutable feedback response and retain only a de-linked, pseudonymous structured product-improvement record. Its exact transaction reference and timestamp remain to preserve the record's integrity, so we do not claim that retained feedback is anonymous. You can also complain to the ICO (ico.org.uk) if you think we have handled your data badly.

You can also object to our use of your data, or ask us to limit it. You can ask for a copy to take to another service. Where we rely on your consent, you can withdraw it.

10. Invite a friend

When you join from a member’s invite link, we store who invited you, which link you used and when you joined. We use this relationship for three purposes: to run the invite and give you your invited month (attribution), to decide whether your inviter earns a month (reward), and to review abuse of the scheme (abuse review). Your inviter’s first name is shown to you once, on the page where you claim the invite. The relationship is never public; the LVLING team can see it to run and review the scheme.

If you invite friends, you see counts only: how many friends joined from your links and how many months you earned (Founding members see how many friends bought, sold or traded). You never see a friend’s name or activity.

To decide whether an invite earns a month, we check whether your friend’s first buy, sale or trade was delivered and settled, and whether the other side is linked to the inviter. The payment rail also checks the card a buyer paid with, the card each member of a trade used to pay its fee, and the bank account a seller is paid into. For each, we keep only a keyed HMAC of the payment-instrument fingerprint Stripe gives us, never the raw fingerprint and never a card or account number, and we compare them only for abuse review. We do not use device or IP fingerprinting.

Our lawful basis is contract for running the invite scheme you joined, and legitimate interests for abuse review. We keep the invite relationship while either account exists. If a friend’s account is erased, that friend disappears from what the inviter sees. The payment-instrument HMACs are deleted with the account.

11. Aggregated insights

We combine members’ wants, collections, decks and listings into statistics, for example the most-wanted card this week, the most-built leader or the most-listed card. We may show these statistics in the app and publish them on our social channels.

A published figure never includes a username or anything else that identifies a member, and we only publish a figure drawn from at least 5 members. Our lawful basis is legitimate interests: telling the community what collectors are building and hunting. You can object to your data being counted through Account → Help & Support, as section 9 describes.

12. Who can see your username

Your username is the name on your profile: the name Google provides, which you can change in Profile. If it is empty or looks like an email address, other members see “Collector” and a short code instead. Your photo is shown only if you switch it on.

• Circles: members of a circle you are in see your name on the circle’s member list, your member page, and the cards and wants you share there. When you ask to join a circle, its organiser sees your name; a circle organiser’s name is shown to anyone holding that circle’s invite link.
• Trade proposals: a matched proposal shows the other collector as “Collector” and a short code until it is accepted. A proposal inside a circle shows your name to the other member of that circle.
• Trades and orders: the other side of an order sees your first name in its notifications, and a buyer sees the seller’s name in their basket. The parcel label shows names and addresses as section 3 says.
• Listings and cards up for trade: signed-in members see a seller’s name on their listings and storefront, and an owner’s name on cards offered to the trade pool with a public trade value, including members outside your circles.
• Community contributions: a card you helped identify can show “Identified by” your name on its price page.
• Public profile and leaderboard: your profile page and your name on a challenge leaderboard are shown only if you make your profile public.
• Invites: a friend who opens your invite link sees your first name, as section 10 says, and anyone who opens an event link you host sees your first name as its host.

13. Who we are

LVLING is operated by Taskm8 Ltd (company number 16527524), the data controller for this service. Account → Help & Support is the attributable in-product contact route during the private alpha. This notice is versioned; material changes are announced, never silently substituted.

Registered office: 15 Chelsea Manor Street, London, England, SW3 5PZ. Email: info@lvling.io.