Privacy Policy

Information we collect and how we collect it

Account and contact information may include your name, email address, phone number, billing and return addresses, account and authentication identifiers, communication history, notification preferences and the details of anyone authorised to act for you.

Submission information may include card descriptions, sets, certification numbers, declared or estimated values, condition notes, photographs and video, requested treatments, approvals, quotes, invoices, payment status, grading choices and results, tracking details, messages, complaints and an audit history of important actions.

We receive payment status and transaction identifiers from Stripe, but CardRevive does not receive or store your full payment-card number or security code.

When you use our websites, portal or emails, we and our providers may collect IP address, browser and device information, approximate location, referring page, pages and features used, cookie or analytics identifiers, error and performance logs, and email delivery or subscription records.

We collect information directly from you or an authorised person, automatically from the services you use, and from providers involved in your submission such as payment providers, carriers and grading companies.

How we use your information

We use information to create and secure accounts; assess, quote, approve, restore and track submissions; process payments; communicate service updates; arrange return shipping and third-party grading; generate requested reports; provide support; investigate disputes or claims; prevent fraud and misuse; maintain business and tax records; and comply with law.

We also use aggregated or appropriately de-identified information to understand demand, improve our services and operate the Lab. We do not sell customer lists or personal information.

Card images, AI reports and promotional use

We photograph or video cards for assessment, condition records, treatment, quality control, packing, claims and dispute handling. These records may be shown to staff and providers who need them to perform the service.

If you request an AI grade report, we send short-lived links to the relevant front and back card images, together with card and report metadata, to the CardRevive grading application and its AI provider. The current grading workflow uses OpenAI to analyse processed card images. The AI request does not need your name, email address or postal address. AI results are estimates, are stored with the card record and are not a grading-company decision.

We may use card-only imagery after removing customer identifiers. If an image or its context could reasonably identify you, we will obtain separate permission before using it in advertising, testimonials or customer spotlights. Making an image visible through a private or share link is not consent to use it in marketing.

Who we disclose information to

Providers used to operate our services include Vercel for hosting, Supabase for database, authentication and private file storage, Stripe for payments and invoices, and Resend for email. Where enabled, we may also use Twilio for SMS and Sentry for error and performance monitoring. Our marketing site uses Google Analytics, Vercel Analytics and Vercel Speed Insights.

We disclose the minimum information reasonably needed to Australia Post or another carrier, grading companies you select, the CardRevive grading application and its service providers, and market-data providers used to identify or value cards. We may also disclose information to our insurer, professional advisers, fraud-prevention providers, regulators, courts or law enforcement where reasonably necessary or required by law.

Third-party services operate under their own terms and privacy policies. We do not authorise them to use CardRevive customer information for their own unrelated marketing.

Overseas processing

Some providers process or store information outside Australia, including in the United States and other countries in which their infrastructure or support teams operate. If you choose a grading company outside Australia, submission information and the physical cards will also be sent to that company in its country of operation.

Privacy protections in another country may differ from Australian law. Where applicable, we take reasonable steps to use reputable providers and appropriate contractual or technical safeguards. You may contact us for current information about the providers used for your submission.

Cookies, analytics and electronic messages

Our marketing site uses server logs to operate securely. Google Analytics and Vercel Analytics are enabled by default to measure visits and site use; Vercel Speed Insights is enabled by default to measure page performance. You can opt out through Privacy choices at any time; doing so stops future analytics and clears optional Google Analytics cookies. Third-party video content in the /ourwork Shorts gallery is not loaded until you choose to open it. Dedicated video watch pages load an embedded YouTube player when you visit them; YouTube may process information under its own terms.

Transactional email or SMS is used to operate your account and submission. If you subscribe to CardRevive Weekly, we store your email address, subscription time and status with our email provider. Account creation alone is not treated as consent to an unrelated newsletter.

Every commercial electronic message will identify CardRevive and provide a working way to opt out. Use an unsubscribe link where one is provided, reply with "unsubscribe", update portal notification preferences, or email info@cardrevive.com.au. We action unsubscribe requests within five business days and may retain a minimal suppression record so we do not contact you again by mistake.

Retention, security and data incidents

We retain account, submission, image, message, billing and audit records for as long as reasonably needed to deliver the service, preserve an accurate treatment history, handle rework or disputes, meet tax and legal obligations, and protect customers and CardRevive. Newsletter information is retained until you unsubscribe; a suppression record may remain after that. When information is no longer reasonably required, we delete or de-identify it where practicable, subject to legal holds and limited backup retention.

We use measures such as access controls, private storage, short-lived file links, authenticated sessions, audit records and provider security controls. No system is completely secure. If a data incident occurs, we will contain and assess it and notify affected people and regulators where the law requires.

Access, correction, deletion and complaints

You may ask to access or correct your personal information, close your account, or request deletion of information that is no longer required by emailing info@cardrevive.com.au. We may need to verify your identity. Some financial, audit, legal or dispute records cannot be deleted immediately. We aim to respond within 30 days and will explain any refusal.

Send a privacy complaint to info@cardrevive.com.au with enough detail for us to investigate. We aim to acknowledge it promptly and provide a substantive response within 30 days. If the Privacy Act applies to the matter and you are not satisfied, you may be able to complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We may update this policy when our systems, providers or legal obligations change. The current version is published at cardrevive.com.au/privacy with its effective date. Material changes apply prospectively and will be highlighted where reasonably practicable.