Privacy policy

Who is responsible

ArtBind, a non-professional site run by a private individual (see the legal notice). Contact: [email protected]

What we collect

• Account — display name, email address, a hashed password (never stored in clear), and the version and server-recorded time of your terms and age confirmation. With Google sign-in: your Google account identifier, name, email and profile picture address. The service also stores OAuth tokens and granted scopes for the connected Google account; these tokens are encrypted in the database.
• Sign-in sessions — a session identifier, the IP address and browser description (user agent) used to sign in, and the session dates.
• Your collection — the cards you record as owned and the binders you plan.
• Preferences — your colour theme, default card languages and time zone, if you set them.
• Feedback — if you send feedback: your message, its type, the page you sent it from (without its query), your browser description and language, and either your account or the reply address you chose to give. No IP address is kept with it.
• Administration — for administrators only: a record of the catalog changes they make, with their account identifier.

Browsing the catalog without an account does not require any personal data. We do not use analytics, advertising or tracking tools, and we do not sell data.

Why, and on what basis

• Running your account, collection and binders — performance of our terms of service.
• Protecting accounts and preventing abuse (session IP address and browser) — our legitimate interest in keeping the service secure.
• Finding and fixing errors: when a page fails, a report with the page address (without its query), the browser name and your account identifier, never your IP address or email, is kept for 90 days on our own server — our legitimate interest in a working service.
• Reading and answering your feedback to improve the service during the beta — our legitimate interest in a service that works for its users.
• Keeping an audit trail of catalog changes by administrators — our legitimate interest in accurate, traceable data.

How long we keep it

Account and collection data are kept until you close your account, then deleted. Sessions end when you sign out or expire. Feedback is kept for at most two years, and is deleted with the account that sent it. Administration records are kept as long as the catalog changes they document; when an account is deleted, the ones it made are credited to “Deleted account” instead of its name.

Who receives it

• Our hosting provider, which stores the service: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France — +33 9 72 10 10 07
• Cloudflare (Cloudflare, Inc., United States), which carries traffic to artbind.app and protects it from attacks: it sees your IP address and browser information on every visit, and may process them outside the European Union under the safeguards described in its own privacy policy.
• Brevo (Sendinblue SAS, France), which sends account emails such as address confirmations and password resets, and receives your email address for that purpose only.
• Google, only if you choose to sign in with Google, under its own privacy policy; Google may process data outside the European Union.
• Some card images are loaded directly from the source websites (such as publishers or card databases). As with any web request, those sites receive your IP address and browser information.

Cookies

The site uses a sign-in session cookie and a cookie that remembers your language. During Google sign-in, temporary cookies may also be used to protect and complete the authorization flow; they expire or are cleared when the flow ends. No advertising or measurement cookies are used.

Your rights

From your account settings you can download your data (a JSON file) and delete your account yourself.

You can access, correct, delete or export your data, restrict or object to its processing, and close your account, by writing to [email protected]. We answer within one month. You can also complain to the French data protection authority, the CNIL (www.cnil.fr).

Accounts are for people aged 15 or over.