🔐 Privacy Policy

1. Who we are (Data Controller)

PJG Grading is operated by PJG Grading Co., Ltd. (company registration no. [to be confirmed before public launch]), registered in Thailand at [registered address — to be confirmed before public launch].

For any privacy request or question, contact privacy@pjgcard.com. Our Data Protection Officer can be reached at the same address [dedicated DPO contact to be confirmed before public launch].

2. Personal data we collect

• Account: name, email, password (hashed), and any username you set.

• Social login: your Google, Apple, or LINE account identifiers, if you use them.

• Contact and shipping: shipping and billing addresses, phone number.

• Card and order data: images of cards you submit, grading and order history, listings, bids, and offers.

• Payment: handled by our payment processor (Stripe); we store only limited transaction records, never full card numbers.

• Technical: IP address, approximate country (from IP), device and browser information, and device push tokens if you enable notifications.

3. How and why we use your data (legal basis)

We process your data to: provide grading and marketplace services and fulfil orders (performance of a contract); process payments and prevent fraud (contract or legitimate interest); send transactional notifications (contract); send marketing only where you have opted in (consent — you may withdraw at any time); and comply with legal, tax, and accounting obligations (legal obligation).

4. Sharing and international transfers

We share data only with service providers who help us operate, and only as needed:

• Stripe — payment processing (United States)

• Ximilar — AI card analysis (European Union); Google Gemini — AI analysis (United States): card images you submit are sent for grading

• Cloudflare — hosting and data storage (global)

• Resend — transactional email (United States)

• Google Firebase — push notifications (United States)

• LINE — notifications, if you link your account

• eBay — cross-listing, if you connect an eBay account (United States)

• Analytics and advertising partners, only if you accept analytics cookies: Google (Google Analytics and Google Ads; United States), Meta (United States), TikTok (Singapore / United States), and LINE (Japan) — they receive usage and device data via cookies to measure and improve our site and ads; they do not receive your card images, password, or payment details.

Some providers are outside Thailand, so your data may be transferred abroad. We rely on adequate safeguards from these recipients and process transfers as permitted under the PDPA. We do not sell your personal data.

5. How long we keep your data

• Grading results, certificates, AI overlays, serial numbers, and the population registry are kept permanently as a public authenticity record (like other grading companies) — your AI grade is never deleted.

• We keep the original multi-KB raw data returned by the AI provider only for 180 days, and only after the overlay and polygon data have been saved — the computed grade and overlay remain. System logs are kept 90 to 365 days; uploaded images that are never attached to a card are removed after 30 days.

• Account and order data are kept while your account is active and as required for tax and accounting; when you delete your account we anonymise your personal data (see your rights below).

6. Your rights

Under the PDPA you may: access a copy of your data; correct it; erase it; restrict or object to processing; withdraw consent; and receive your data in a portable format. You can export your data or delete your account at any time from Settings → Account. For other requests, email privacy@pjgcard.com and we respond within the timeframe required by law. You also have the right to lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand.

7. Cookies

We use essential cookies needed to run the site (login session and your theme and currency preferences). With your consent, we also use analytics and advertising cookies from Google (Google Analytics and Google Ads), Meta, TikTok, and LINE; these are off by default and load only after you accept them. See our Cookie Policy for details.

8. Security, children, and changes

We protect your data with encryption in transit and at rest and restrict access to authorised staff. Our services are not directed to children under 13, and we do not knowingly collect their data. We may update this policy; material changes will be posted here with a new last-updated date. Questions? Email privacy@pjgcard.com.