Your information, explained clearly.

1. Who we are

CardQuay is a registered Australian business name held and operated in New South Wales by WANG, LIYUAN, an individual sole trader (ABN 66 120 438 006). This policy is intended to reflect the Australian Privacy Principles where they apply and our commitment to transparent handling even where an exemption may be available.

2. Information we collect

Depending on how you use CardQuay, we may collect:

• account details, including email address, username, password-related authentication records, full name, phone number and postal address;
• seller verification information, including identity, age, address, ABN or business details, verification results and security-deposit records;
• profile, listing and card information, including images, ownership declarations, grading and certification details;
• messages, offers, trade proposals, reports, complaints and customer-support correspondence;
• future transaction information such as order totals, payment status, refunds, disputes, shipping and tracking details; and
• technical information such as IP address, device and browser details, timestamps, security events, cookies and similar identifiers.

When integrated payments launch, Stripe will collect and process payment credentials. CardQuay does not intend to store complete payment-card numbers.

3. How we collect information

We collect information directly from you through forms, uploads and communications; automatically when you use the service; from another user when needed for an order, trade or report; and from service providers used for identity, payments, fraud prevention and delivery.

4. Why we use it

We use personal information to create and secure accounts, verify seller eligibility, display public profiles and listings, support purchases and trades, deliver notifications, prevent fraud, investigate reports, resolve disputes, improve service reliability, meet legal duties and communicate essential policy or account changes.

5. What is public

Your username, display name, public profile information, listings, card images and marketplace activity you choose to publish may be visible to others. Your full name, email, phone number, identity documents and postal address are not displayed publicly by default. Information needed to complete a transaction may be shared with the other party at the appropriate stage.

6. Sharing and service providers

We may share information with the buyer or seller involved in a transaction; payment, identity, email, hosting, database, security, analytics and delivery providers; professional advisers; regulators, courts and law enforcement where required; and a successor if the business is restructured or sold. Providers currently or prospectively used include Supabase for authentication, Cloudflare for hosting and storage, Resend for account email, and Stripe for future payments and seller onboarding.

We do not sell personal information. We do not share it for unrelated third-party marketing without permission.

7. Overseas processing

Technology providers may process or store information outside Australia, including in Singapore, Japan, the United States and other locations where they or their subcontractors operate. We take reasonable steps to select reputable providers and use contractual, technical and access controls appropriate to the information.

8. Storage, security and retention

We use role-based access, encrypted connections, managed authentication, access logging and other reasonable safeguards. No online system can be guaranteed completely secure. We retain information while your account is active and as reasonably needed for transactions, fraud prevention, disputes, taxation, legal compliance and enforcement. We then delete or de-identify it where lawful and practical.

9. Access and correction

You can update certain profile details in your account. You may also ask us for access to, or correction of, personal information we hold. We may need to verify your identity and may refuse or limit a request where the law permits, explaining the reason where required.

10. Deletion and account closure

You may request account closure or deletion. We may retain limited records connected with completed or disputed transactions, safety reports, fraud prevention, tax or legal obligations. Public content will be removed or de-identified where appropriate, subject to those needs.

11. Children

CardQuay is for users aged 18 or older. We do not knowingly create accounts for children. Contact us if you believe a person under 18 has provided personal information.

12. Complaints and changes

Send a privacy complaint to the contact above with enough detail for us to investigate. If you are not satisfied, you may be able to contact the Office of the Australian Information Commissioner. We may update this policy and will post the new date and give reasonable notice of material changes.