Privacy policy

We collect account details you provide, such as your name, email address, workspace information, and support messages. We also process API request metadata, usage totals, authentication events, device and browser information, and security logs needed to operate the service.

When you purchase a paid plan, payment and billing information is handled by our payment processor. Premium Vault does not store complete payment card numbers.

We use information to provide and secure the API, authenticate accounts, meter usage, process subscriptions, respond to support requests, prevent abuse, improve reliability, and communicate important service or account updates.

We do not sell personal information. Sharing with service providers, other third parties, and processors in other countries is described in the sections below.

The dashboard may use cookies or similar browser storage for authentication, security, preferences, and session continuity. Essential authentication and security storage is required to use account features.

If you accept analytics cookies, we set a first-party anonymous visit id and keep a short log of page paths, referrer or campaign parameters, sign-up, checkout start or return, and checkout completion on this site so we can improve it. Rejecting analytics leaves no visit id and no event log of that kind. You can change this later from Cookie preferences in the footer. The event log is deleted after 30 days. Separately, we count sign-up completions, checkout starts, and checkout returns as anonymous totals. That count does not use a cookie, a visit id, or an account identifier, and it does not depend on the analytics choice.

Our content delivery network records standard access logs for each request to this website: the date and time, the requested host and page path, the response status and size, the referring page, the browser user-agent string, the edge location, and the IP address. These logs do not use cookies or any storage on your device. We use them to count visits, see which pages are used, keep the site reliable, and detect abuse. They are stored in the Asia Pacific (Tokyo) region and deleted after 90 days.

If you accept analytics cookies, Google receives visitor data from this website for advertising measurement and conversion tracking. That includes the pages you view, whether you create an account, and whether you complete checkout, including the amount and currency of a completed checkout. Rejecting analytics cookies means we do not load Google's tag. You can change this later from Cookie preferences in the footer.

We retain account, billing, usage, and security records for as long as reasonably needed to provide the service, meet legal obligations, resolve disputes, and prevent abuse. We use administrative and technical safeguards designed to protect information, but no online service can guarantee absolute security.

You may request access, correction, export, or deletion of personal information associated with your account, subject to legal and security requirements. You may also cancel a subscription and close your account through the dashboard or by contacting us.

To ask for disclosure, correction, addition, or deletion of retained personal data, or for cessation of its use, cessation of third-party provision, or disclosure of records of third-party provision, email the contact below from the address on your account. We may ask for information needed to confirm that the request is from you or your agent. We respond without undue delay. We may decline a request where the law allows, including where disclosure would harm the life, body, property, or other rights or interests of you or another person. We do not currently charge a fee for these requests.

Complaints about our handling of personal information can be sent to the same contact.

The business that handles personal information for Trading Card Studio is Premium Vault GK (プレミアムヴォールト合同会社). Its address is published on the Specified Commercial Transactions Act page (/legal/tokushoho, and /ja/legal/tokushoho in Japanese) and is not repeated in this policy. The representative member (代表社員) is Tarriq Bird (バード タリック).

Questions and complaints about personal information can be sent to support@tradingcardstudio.com.

We do not sell personal information. We do not provide personal data to a third party for that party's own purposes without your consent. Entrusting a service provider that handles personal data only on our instructions, and only to help us operate the product, is not third-party provision. Provision to processors in other countries is described in the next section.

We may disclose personal data where the law permits or requires it: when a statute requires disclosure; when it is necessary to protect a person's life, body, or property and it is difficult to obtain consent; when it is specially necessary to improve public health or to promote the sound upbringing of a child and it is difficult to obtain consent; and when it is necessary to cooperate with a national or local government body, or a person entrusted by one, in performing duties prescribed by law, and obtaining consent would impede those duties.

We do not jointly use personal data with other businesses. If the business is transferred by merger or another succession, personal data may pass to the successor as the law allows.

We entrust personal data to the following businesses in a foreign country. They may use it only to perform the entrusted work.

Stripe, Inc. (United States) processes subscription payments through Stripe Checkout and the Stripe customer portal. We do not store complete payment card numbers.

Amazon Web Services, Inc. (United States) provides Amazon Cognito, which this site uses for account authentication. The identity-provider endpoint this site calls is in the Asia Pacific (Tokyo) region (ap-northeast-1). This website and the API are also hosted on that provider's infrastructure. Personnel of a United States business may access personal data from outside Japan.

Google LLC (United States) receives visitor data for advertising measurement and conversion tracking when you accept analytics cookies, as described under Cookies and authentication. Personnel of that business may access the data from outside Japan.

The United States does not have a single federal statute equivalent to Japan's Act on the Protection of Personal Information. State and sector laws may apply, and public authorities may have legal powers to seek data. Where a transfer relies on the processor maintaining safeguards consistent with that Act, rather than a separate consent for each transfer, further detail of those safeguards is disclosed without delay upon request.

Organizational measures limit access to personal data to people who need it to operate the service. Human measures limit that access to the work itself. Physical measures keep personal data with the infrastructure provider named above. Technical measures include HTTPS for the site and the API, authentication for accounts, not storing complete payment card numbers, and showing an API key in full only once, when it is created. This is an outline. Further detail is disclosed on request to the extent that disclosure does not weaken those measures.