Privacy Policy

What we collect

• Account data: your email address and authentication identifiers, managed through Amazon Cognito.
• Billing data: handled by Stripe. Your card number never touches our servers; we store only your Stripe customer/subscription IDs and plan status.
• Product data you give us: portfolio holdings, price alerts, and newsletter subscription preferences.
• Usage data: pages viewed and product events, via Google Analytics and our own event pipeline (IP-derived approximate location, browser/device info, and a session identifier stored in your browser), and session recordings and heatmaps via Microsoft Clarity: how pages are scrolled, clicked and navigated. Email fields, forms and signed-in pages are masked, so what you type and your account contents are never recorded.
• Request logs: our content delivery network keeps a standard log of each request (IP address, browser, page requested and time) for 30 days. We use it to spot bots, abuse and faked clicks, then it is deleted.

How we use it

To operate and improve the Service: authenticate you, sync your subscription tier, evaluate your alerts, send emails you asked for (alerts, reports, account notices), understand which features are used, and prevent abuse. We do not sell your personal information.

Who we share it with

Only service providers that run the product: Amazon Web Services (hosting, authentication, email delivery), Stripe (payments), Google (analytics), and Microsoft (Clarity session recordings and heatmaps). Each processes data under its own terms as our processor. We may also disclose information if required by law.

Haggle

If you join Haggle, our card trading pilot, we also keep: your handle, the spares and wants you list, your agent's settings and collector profile, your chats with your agent, your swaps (cards, decisions, tracking numbers and any problem reports, and the packing photos you add), the messages you send in a swap's chat, feedback you give and get, any profile photo, and the mailing address you add. If you save a card for swap holds, Stripe keeps the card itself; we keep only its brand, last four digits, whether it is debit or credit, Stripe's references to it, and the holds placed on it. So a card can be on only one account, we keep a one-way hash of each saved card until you remove it or delete your account. To stop banned members coming back, we keep a one-way hash of a banned member's email, address and card. You confirm you are 18 or older and accept the trade rules when you join, and we record when.

Your mailing address is shown only to the collector who ships cards to you, and only once everyone has accepted the swap and it is their turn to ship. Other collectors see your handle, never your email. A collector with an open offer with you can see your other listed spares, so they can ask for one in a counter-offer. Anyone in Haggle can see your record (swaps, late shipments and the feedback partners leave you, with their handles); a profile photo you add is shown only to you for now. Your chats, listings and offers are sent to Anthropic's Claude models on Amazon Bedrock so your agent can answer you and read offers; Bedrock does not use them to train models. A swap's chat is seen only by that swap's collectors, by your agent when you ask it about a swap (so it goes to Bedrock too), and by The Lab TCG when a message is reported or a problem is looked into. If you turn on auto-accept, your agent accepts swaps for you inside the limits you set, and you can turn it off at any time. If you or a partner report a problem, The Lab TCG sees both sides' email addresses, mailing addresses and tracking to sort it out.

Your agent learns from chats, for everyone. When you rate one of its replies (thumbs up or down, with an optional note), or a reply hits an error, we keep that message, the reply and your note with names, handles, emails, addresses, links and long numbers removed, for up to 30 days. Once a week Claude on Amazon Bedrock turns these into short general lessons, such as how to handle a kind of question, that every collector's agent reads. Lessons never name or quote a collector, and The Lab TCG can read them and the signals behind them. This is on unless you turn off "Help your agent learn" in your agent's settings, which deletes the signals kept from your chats; lessons already learned stay, as they hold nothing about you. Nothing is used to train an AI model.

Chats with your agent are kept for 30 days and your activity log for 90 days. Delete your Haggle account from your agent's settings at any time. Your listings, chats and address are deleted straight away; finished swaps are kept with your handle removed, and your handle is held for 90 days so nobody can take it over. Finished swaps are deleted within a year. Swap chat messages and packing photos are kept for 400 days, so a problem can still be checked later; if you delete your account, the messages you sent are removed.

If you live in the UK. The Lab TCG is run from the US. Haggle data, including your address, is stored with Amazon Web Services in the United States, and your agent runs there too. Where UK law requires a safeguard for transfers out of the UK, we rely on the UK's adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified) or on the International Data Transfer Addendum in our provider contracts. We use your data to run the swaps you sign up for (contract); to keep members safe and stop fraud, such as banned-member checks and scam warnings in chat (legitimate interests); to help every agent learn from rated replies, which you can turn off in your agent's settings (legitimate interests); and to send the swap emails you need. We send newsletters only if you tick the box to get them (consent). UK data protection law lets you ask for a copy of your data, correct it, delete it or object to how we use it: email thelabtcg@gmail.com. You can also complain to the Information Commissioner's Office at ico.org.uk.

Partners and sponsors

If you ask about advertising with us or become a partner, we keep your name, business, website, email, what you told us, the ads we agree and your approvals, and the invoices and payments for them. We use them to answer your inquiry (legitimate interests) and to run, bill and account for the deal you sign up to (contract). Card and bank details go straight to Stripe, which takes payment on its own checkout page; we never see them. We share your name, business and email with Stripe so it can make your invoice and email you the receipt and invoice, and everything is stored with Amazon Web Services in the United States. Deal and invoice records are kept for six years after the deal ends, for tax and accounting. An inquiry that does not become a deal is deleted within two years.

If you are in the UK. Your data is sent to the United States. Stripe and Amazon Web Services take part in the UK Extension to the EU-US Data Privacy Framework, and where that does not apply we rely on the UK International Data Transfer Addendum to the standard contractual clauses. You can ask for a copy of your data, correct it, delete it or object to how we use it by emailing thelabtcg@gmail.com, and you can complain to the Information Commissioner's Office.

Cookies & local storage

We use browser storage for sign-in sessions and product preferences, and Google Analytics and Microsoft Clarity cookies for usage measurement. Clarity sets no cookies for visitors in the EEA, the UK and Switzerland unless they accept analytics cookies in our cookie banner. Until then Google Analytics sends only cookieless measurement pings for them, and either answer can be changed at any time. You can block cookies in your browser; sign-in and some features may stop working.

One security cookie, lab_c (1 day), is set for every visitor: it holds only the value 1 and shows our bot protection that your browser loaded a real page. Five measurement cookies record how you found us: lab_src (7 days), lab_utm (7 days), lab_ft (90 days), lab_lt (30 days) and labtcg_session_id (30 days). In the EEA, the UK and Switzerland, or while we can't yet tell which country you are in, we do not set them until you tap Accept. Until then the same values stay in this browser tab and are cleared when you close it. If you have not chosen, or you say no, those five are not stored. Saying no later deletes any of them already set. lab_c stays. Visitors we know are outside those countries get the five measurement cookies as usual. A buy click before Accept still records the channel from the link and referrer on that page, without writing those cookies.

Email choices

Every marketing or report email includes an unsubscribe link. Transactional messages (billing, account security) are sent as long as you have an account.

Retention & deletion

We keep account data while your account is active. To delete your account and associated personal data, email thelabtcg@gmail.com from your account address. We will confirm and complete deletion within 30 days, except records we must keep for legal or billing reasons.

Your rights

Depending on where you live (including the EEA/UK under GDPR and California under CCPA/CPRA), you may have rights to access, correct, delete, or export your personal information, and to opt out of certain processing. Exercise any of these by emailing us; we will respond within the legally required window. We do not discriminate against you for exercising privacy rights.

Children

The Service is not directed to children under 13 and we do not knowingly collect their data. If you believe a child provided us data, contact us and we will delete it.

Changes

We will post any changes to this policy here with an updated date, and for material changes we will notify account holders by email.