Privacy Policy
We care about the privacy and security of your data. Below we explain what information we process, for what purposes and what rights you have.
Last updated:
We support two-factor authentication (2FA) and Passkeys. We store passwords only in the form of a cryptographic hash.
Choose the sign-in method that suits you: e-mail, Google or Discord. We collect only the data needed for the Account to work.
We publish only aggregated market statistics. Your private collections and alerts are not sold.
1. Data controller
The controller of personal data is Maciej Wojtasik, carrying on business under the name MW Software - Maciej Wojtasik (the "Controller").
NIP (Polish tax identification number): 8322102928
REGON (Polish statistical business number): 544100401
Correspondence address: ul. Juliana Tuwima 48/11, 90-021 Łódź
2. Data collected and its sources
We apply the principle of data minimisation, collecting only what is necessary to provide the service. The data comes:
- directly from you (registration, forms, the contents of Collections and Binders and Shopping List data);
- from your device and browser (technical data, logs);
- from Google or Discord, if you sign in via OAuth (account identifier, name, e-mail address, avatar);
- from technical service providers, as regards logs and message delivery statuses (e.g. confirmation that an e-mail has been delivered);
- from the Payment Operator, in connection with a payment, a Subscription and its status;
- from operators of external notification channels, if you activate such a channel yourself;
- from the browser of a person using a link contained in selected PRO Alerts, as regards the technical data described below.
- E-mail address: required for signing in, password recovery and notifications.
- Username: a unique identifier on the Service.
- Password: stored only in the form of a cryptographic hash (scrypt); we do not know your password.
- Google/Discord sign-in data: account identifier, name, e-mail, avatar.
- 2FA data: an encrypted TOTP secret and the technical information needed to handle authentication, if you enable 2FA.
- Passkeys data: the credential identifier, the public key and the technical metadata necessary to handle sign-in.
- You confirm Passkeys using your device's screen lock method (e.g. fingerprint, face recognition or a PIN code). Biometric data remains on your device and is not transferred to the Service. Nor do we receive the private Passkey key.
In connection with the use of Plans, we may process: the current Plan of the Account; information on when the Plan starts and ends; information on the source of the Plan, e.g. a paid Subscription or a free grant by the Controller; the customer identifier assigned by the Payment Operator; the Subscription identifier; the selected Plan and Billing Period; the Subscription status; the end date of the current Billing Period; information on a scheduled cancellation or termination of the Subscription; payment status information; the timestamp of the request to begin providing the Premium Plan before the withdrawal period expires; the version of the Terms of Service and of the Plan Specification presented when the Subscription was concluded; the version or wording of the statement concerning the start of performance before the withdrawal period expires.
If you use a referral code when placing an order, we record with the order and the Subscription which code was used and the amount of the discount. On this basis we apply the discount and settle accounts with the creator or community from which the code originates. We do not pass your e-mail address or other Account data to the creator. The creator may receive a summary of Subscriptions concluded using their code, covering the date, the Plan and the amounts, without data that would allow you to be identified.
We currently use Stripe to handle payments for Premium Plans. The payment form depends on the payment channel indicated in the order (clause 8.12 of the Terms of Service). In the direct channel we use Stripe Elements. In the Link channel the payment is made in the Stripe Checkout form handled by Link, and the transaction is handled by Sold through Link, LLC (SMP), a company in the Stripe group. In both channels, payment instrument data is entered into components operated by Stripe and transmitted directly to Stripe. mTCG (mtcg.pl and mtcg.app) does not store the full payment card number or the card security code.
In order to create and handle payments and Subscriptions, we may transfer to Stripe in particular: the e-mail address linked to the Account; the technical identifier of the User or order; information on the selected Plan; the amount and currency of the transaction; information concerning the Subscription.
Stripe may also directly process technical data concerning the device, the browser, the payment session and interactions with the payment form to the extent needed to handle the payment and authentication, ensure security and prevent fraud.
Stripe sends the Service technical events concerning payments and Subscriptions. In order to handle payments correctly, synchronise the Subscription status, prevent the same operation from being executed more than once and for diagnostic purposes, we store the event identifier and type and its technical payload.
The payload may contain in particular: Stripe identifiers; payment status; Subscription status; amounts; the User's e-mail address; other technical information related to the given billing operation. We store raw billing events for 90 days.
If you request an invoice, we process the data you provide to the extent needed to issue the document, in particular: first name and surname; company name, where applicable; address; tax identification number or company registration number, where applicable (e.g. NIP, IČO, DIČ or IČ DPH); information concerning the relevant payment. Providing this data is voluntary, but may be necessary to issue the requested document.
- Push subscription address: if you enable push notifications, together with the User-Agent of the device on which you enabled them.
- Technical logs: IP address and User-Agent in security logs (Cloudflare, own servers).
- Error reports (Sentry): technical data about a failure (stack trace, page address without parameters). We do not include cookies, request headers, URL parameters or IP addresses in error reports.
- Settings: your price alerts, marketing preferences.
- Product list: information about cards added to a Virtual Collection or Binder.
- Transaction data (optional): purchase price, acquisition date, product condition.
- Notes and purchase information (optional): information saved by the User or created at the User's request in connection with the functions of the Service, in particular the name of the Shop, the discount code used and other information concerning the source of the purchase.
- Configuration: names of Collections and Binders, their sharing status (private/public), information on the link between a Virtual Binder and a Virtual Collection and on the selected synchronisation mode.
In connection with the use of Shopping Lists, we may process in particular:
- the name of the Shopping List;
- the Products added and their quantities;
- saved settings and filters;
- information concerning public sharing of the List;
- calculation results and technical data necessary for the purchase optimisation function to work.
Shopping List data is linked to the User's Account. If the User shares a List publicly, persons who have the public link can see the information presented on the public page of the List, in particular its items and the optimisation result.
If you voluntarily configure an external Alerts channel, we process the data needed for it to work.
- Telegram: where a Telegram connection is set up, we may store: the Telegram chat identifier in encrypted form; a technical value used to look up the correct identifier; optionally, the Telegram username displayed in the panel; the date the channel was connected. The Account is connected to Telegram using a one-time code valid for 15 minutes.
- Discord: for a Discord channel, we store the webhook address provided by the User. The webhook address is stored in encrypted form.
- Pushover: for a Pushover channel, we store in encrypted form: the user key; the application token; and the channel settings, such as the selected priority or notification sound.
- Content of Alerts: in order to deliver an Alert to the external channel you have chosen, we may transfer to its operator: the Product name; the price; the Shop name; the Product image; a link; other information necessary to display the Alert you requested.
Data is transferred only to a channel configured by the User themselves. If the User's Plan ceases to cover a given channel, the sending of Alerts through that channel is suspended. The configuration itself may remain saved until the User deletes the channel or the Account is deleted.
Selected links contained in PRO Alerts may pass through a technical mTCG redirect. In the case of such a redirect, we may record: the date and time of the click; the channel from which the link originated; the identifier of the owner of the configured channel; the Alert identifier; the destination address; the IP address of the person clicking; the User-Agent of their browser; and, if the person clicking is signed in to mTCG at that moment, the identifier of their Account.
The person clicking may be the owner of the channel or a third party with whom the link has been shared. We use the data to detect cases of prohibited sharing of private Alerts channels and to enforce the rules for using this functionality set out in the Terms of Service.
The technical information supports the assessment of a possible breach. Decisions on restricting a channel are not taken solely by automated means. We store raw data concerning such clicks for 3 months.
When you go from the Service to an offer in an external shop, we record information concerning that redirect:
- The date and time of the click and the identifier of the shop, offer and product concerned.
- The destination address together with the parameters we add to the link, including an indication of the place in the Service where the click occurred (e.g. offer list, product page, Shopping List organic or sponsored suggestion, alert notification).
- The IP address and User-Agent of the browser from which the click occurred.
- A technical click identifier assigned at random for each visit and passed in the address to the shop to allow affiliate partnerships to be settled.
The click identifier is random and contains no data about you or your Account. We do not use our own cookies to handle redirects. We do not record cookie values, the session identifier or the Account identifier in the click record. We do not use the click record to build an activity history of a specific User, including when you are signed in. If you consent to analytics, the click itself additionally generates an event in Google Analytics, which uses its own cookies.
The above rule applies to standard redirects from the Service to Shop offers. It does not apply to the separate mechanism of technical redirects used in selected PRO Alerts to prevent prohibited sharing of private notification channels. That mechanism is described in the section “Clicks on links in PRO Alerts”.
The Scanner recognises a card from a photo and is available only after signing in. Before processing, we remove EXIF metadata from the photo (including location data and device information); we do not record it in the scan log or pass it on. The photo prepared in this way is sent to our card recognition service, which compares it with the catalogue and returns a match. The photo is not stored after the result is returned, nor is it used to train models, unless you enable the “Scan photos” option described below.
We do, however, record a technical log of the scan itself: the scan identifier, your Account identifier, the date and time, the identifiers of the recognised card, the match confidence, the number of results and the processing time. The log is used to detect abuse, to measure the effectiveness of the Scanner and, in Plans with a Scanner usage limit, to determine how much of that limit has been used. We do not record the IP address or User-Agent in it.
Irrespective of the limits arising from Plans, the Service may apply technical mechanisms to counter excessive or automated use of infrastructure resources. These mechanisms serve to protect the stability and security of the Service.
In your Account settings you can enable the “Scan photos” option. The option is voluntary and disabled by default. If you enable it, we save only the cropped image of the detected card together with a small margin of its surroundings (up to approximately 15% on each side), after removing EXIF metadata. The margin allows us to improve cases in which the Scanner determined the outline of the card inaccurately. If the Scanner fails to detect the outline of the card in the photo, we save nothing.
Together with the photo, we store the identifier of the scan, your Account identifier, the recognition result returned by the Scanner (up to 12 candidates together with the match confidence), the coordinates of the detected card outline, the card ultimately selected or corrected by you, the version of the recognition model used and the date of saving.
We use this data to train the card recognition model and to assess its effectiveness. The legal basis for the processing is your consent (Art. 6(1)(a) GDPR). The terms of the licence to use the images provided are set out in section 7.7 of the Terms of Service.
We store data linked to your Account for a maximum of 12 months from saving and then permanently anonymise it. You may withdraw your consent at any time using the same switch in your Account settings; deleting the Account has the same effect as withdrawing consent. After consent is withdrawn, we do not save new images, and we permanently anonymise the data previously linked to your Account without undue delay.
Anonymisation means the permanent deletion of data and links that would reasonably allow a sample to be linked to your Account or its source to be identified, including the scan identifier and the Account identifier. We store anonymised images, labels and technical data without a fixed time limit and use them to train and test the card recognition model, to detect regressions and to improve the performance of the Scanner. Anonymisation does not reverse the effects of earlier lawful use of the data, including the retraining of previously created models.
Neither withdrawal of consent to the processing of personal data nor anonymisation affects the ability to use materials that were effectively anonymised before that moment, provided that they no longer constitute personal data.
For as long as your consent remains in force, you receive an additional 20 scans per day above the limit arising from your Plan. Withdrawing consent removes only this bonus and does not restrict anything else in your use of the Scanner.
We store saved photos in the Cloudflare R2 service, outside the Service database. We do not publish them or make them available to other entities for their own purposes. Entities processing the data on our behalf, in particular infrastructure providers, may have access to the data.
If you use the CSV import function, the file you provide is processed solely to perform the requested operation. The file is not stored after the import is completed.
In connection with the use of the Booster Simulator, we record information about the simulation carried out, in particular the selected set, the generated booster contents and the order of the cards, data used to reproduce the draw, the estimated value of the generated cards, the EV and booster price at the time of the simulation and the date and time it was carried out.
For a signed-in User, the simulation is linked to the Account identifier. For a User who is not signed in, we use a random identifier stored in the mtcg_sim_id cookie, which is used to count the simulation limit and to recognise simulations created from a given browser. This identifier contains no information about the device and is not created using fingerprinting.
A public link to a simulation result is created only when the User selects the “Share” function.
Independently of this, we may present summaries of simulations on the Service, for example a summary of the best virtual openings of a given day. The summaries include the generated booster contents and their estimated value, but do not contain the Account identifier, the Username, the cookie identifier or a link to the result of a specific simulation.
3. Purposes and legal bases of processing
| Purpose of processing | Legal basis |
|---|---|
| Creating and maintaining the Account | Art. 6(1)(b) GDPR (performance of a contract) |
| Handling Collections, Binders, their synchronisation, Shopping Lists and alerts | Art. 6(1)(b) GDPR |
| Sending the price alerts you requested | Art. 6(1)(b) GDPR |
| Sending push notifications about the alerts you requested, if you enable them | Art. 6(1)(b) GDPR |
| Operating the Booster Simulator, applying usage limits and saving simulation results | Art. 6(1)(b) GDPR |
| Making a public link to a Collection, Binder, Shopping List or simulation result available at the User's request | Art. 6(1)(b) GDPR |
| Creating aggregated market statistics | Art. 6(1)(f) GDPR (legitimate interest: developing and analysing the functions of the Service, presenting market data in a form that prevents the identification of Users) |
| Recognising a card from a photo sent to the scanner | Art. 6(1)(b) GDPR |
| Recording the scan log in order to counter abuse, measure the effectiveness of the Scanner and, where applicable, determine the use of the limit arising from the Plan | Art. 6(1)(b) GDPR as regards applying the Plan limit and Art. 6(1)(f) GDPR as regards countering abuse and measuring the effectiveness of the Scanner |
| Saving card crops from scans and recognition results in order to train and assess the effectiveness of the Scanner (option enabled by the User) | Art. 6(1)(a) GDPR (consent) |
| Handling redirects to shops, offer popularity statistics and settling affiliate partnerships | Art. 6(1)(f) GDPR (legitimate interest: developing the price comparison service, measuring the effectiveness of the offers presented, preventing abuse and settling accounts with partners) |
| Security, abuse prevention, diagnostics | Art. 6(1)(f) GDPR (legitimate interest: protecting the Service and Users, identifying the sources of errors) |
| Handling correspondence and complaints | Art. 6(1)(b) or (f) GDPR, depending on the type of message |
| Establishing, pursuing or defending claims | Art. 6(1)(f) GDPR |
| Handling the Premium Plan and Subscription | Art. 6(1)(b) GDPR |
| Handling payments for the Premium Plan, including transferring data to Link and SMP in the Link channel | Art. 6(1)(b) GDPR |
| Documenting the conclusion of the contract and the statements required when concluding the contract | Art. 6(1)(b) GDPR and, to the relevant extent, Art. 6(1)(c) GDPR |
| Synchronising billing events, preventing operations from being executed more than once and payment diagnostics | Art. 6(1)(b) and (f) GDPR |
| Issuing and storing the required accounting and tax documents | Art. 6(1)(c) GDPR |
| Delivering Alerts through an external channel chosen by the User | Art. 6(1)(b) GDPR |
| Detecting prohibited sharing of private Alerts channels and enforcing the rules for using this functionality | Art. 6(1)(f) GDPR: the Controller's legitimate interest in protecting a paid service against abuse |
| Storing the history of Discord channel restrictions | Art. 6(1)(f) GDPR |
| Counting the use of Scanner limits arising from the Plan | Art. 6(1)(b) GDPR |
| Importing and exporting data within Service functions | Art. 6(1)(b) GDPR |
| Analytics (Google Analytics) | Art. 6(1)(a) GDPR (consent) |
| Electronic marketing | Art. 6(1)(a) GDPR and a separate consent required under the legislation on electronic communications |
Basic traffic statistics. Cloudflare Web Analytics provides aggregated statistics on the use of the Service without using cookies, localStorage or fingerprinting. The processing of technical data by Cloudflare related to ensuring the security and operation of the Service takes place on the basis of Art. 6(1)(f) GDPR.
Redirects to shops. Information about a visit to an external shop's offer is recorded in our statistics system regardless of consent to cookies, because we do not use cookies or browser storage for this purpose, and the processing is based on the Controller's legitimate interest. Separately, if you consent to analytics, the click is also logged by Google Analytics. We use the data from our system to present aggregate summaries of product popularity (in which we count unique IP addresses so that one person does not inflate the result), not to build a User profile. You may object to this processing, see .
Clicks from PRO Alerts. The processing of technical data concerning the use of links from selected PRO Alerts takes place on the basis of the Controller's legitimate interest in countering prohibited sharing of paid functionalities and enforcing the rules for using the Service. You may object to this processing in accordance with .
Alerts and marketing. We send notifications related to the performance of a function you requested (e.g. a price alert) in order to perform the contract. We send marketing messages or commercial information only after obtaining the required consent, which you may withdraw at any time.
Public sharing. You activate a public link to a Collection, Binder or simulation result yourself and can disable it using a function available on the Service. A public link to a Shopping List is likewise created only at the User's request, but remains active until the Shopping List is deleted. The public page of a Shopping List may present in particular its items and the optimisation result. A public simulation result may contain the Username if the simulation was carried out while signed in. The pages of public Collections, Binders, Shopping Lists and simulation results have the noindex, nofollow directives set, the purpose of which is to limit their indexing and the following of links by search engines.
Automated decisions. The Controller does not take decisions concerning Users based solely on automated processing, including profiling, which would produce legal effects concerning them or similarly significantly affect them.
Minors. If you are under 16, or under 15 if you live in the Czech Republic, consents concerning optional data processing (in particular marketing or analytics) should be given or approved by a parent or legal guardian. The basic functions of the Service that do not require an Account are available without Registration and may be subject to technical limits.
4. Retention period
User data
As a rule, we store Account, Collection, Binder and Shopping List data until it is deleted by the User or the Account is deleted. After deletion, data in active systems is deleted or anonymised; we may store certain information for longer if required by law or if necessary to establish, pursue or defend claims.
Backups
Backup copies are rotated automatically and stored for a maximum of 30 days. Data deleted from the active database may remain in backup copies until they are deleted, for no longer than 30 days.
Error logs (Sentry)
Technical data about application failures is deleted automatically after 90 days.
Correspondence
We store messages from the contact form for up to 3 years for evidential purposes.
Plans and Subscriptions
We store operational information concerning the Plan and Subscription for as long as the Account is maintained. Certain information may be stored for longer if required by law or necessary to establish, pursue or defend claims.
Stripe technical events
We store raw technical billing events received from Stripe for 90 days.
External notification channels
We store the Telegram, Discord and Pushover configuration until the User deletes the given channel or the Account is deleted. Switching to a Plan that does not cover a given channel does not in itself cause its configuration to be deleted automatically.
Telegram connection codes
The one-time code used to connect the Account to Telegram is valid for 15 minutes. Expired codes are deleted automatically as part of the data clean-up process.
Clicks from PRO Alerts
We store raw data concerning clicks on links from PRO Alerts, including the IP address and User-Agent, for 3 months.
Discord restriction history
We store information concerning restrictions of a Discord channel for as long as it is needed to enforce the rules for using the function and to assess whether breaches recur, as a rule no longer than for as long as the Account is maintained.
CSV import
Files provided for a CSV import are not stored after the import operation is completed.
Accounting and tax records
We store data contained in accounting and tax documents and invoices for the period required by applicable law.
Scan logs
We store the scan log for 90 days and then delete it. Only daily counts remain for statistics: how many times a given card was scanned, how many of those scans resulted in a match and with what total confidence. These summaries are not linked to the Account. We also delete the logs immediately when the Account is deleted. The photo itself is not stored unless you enable the “Scan photos” option: we store crops linked to the Account for up to 12 months or until consent is withdrawn, and then permanently anonymise them; we store anonymised data without a fixed time limit.
Simulation results
We store simulation results that have not been shared publicly for 90 days from their creation. We store publicly shared results for a maximum of 1 year from the creation of the simulation, unless the User disables sharing earlier. Once sharing is disabled, the result is subject to the standard 90-day retention period calculated from the day the simulation was created. The link between a simulation and the Account is also removed if the Account is deleted.
Clicks on offers
We store raw click data, including the IP address and User-Agent, for 3 months. In justified cases related to preventing abuse, settlements with partners or handling complaints, this period may be up to 6 months. After this period, we delete the IP address, User-Agent, destination address and technical click identifier. Data used further for statistics is aggregated to the level of day, product, offer and shop, so no record of an individual visit remains.
Web Push subscription
We store the push subscription address together with the device User-Agent until notifications are disabled or the Account is deleted. We also delete it automatically when the browser reports that the subscription has expired or been revoked.
Server logs
Up to 12 months for the purposes of detecting attacks and security auditing.
5. User rights
Right to object
You may at any time object to the processing of your data that we base on the Controller's legitimate interest. This applies in particular to data on redirects to shops, card scan logs, the creation of aggregated market statistics and processing for the purposes of security and abuse prevention.
It is sufficient to send your objection to [email protected]. Once we receive it, we will stop processing the data for those purposes, unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for the establishment, pursuit or defence of claims.
In addition to the right to object, in connection with the processing of personal data the User may have the right to:
- access their data and obtain a copy of it;
- have inaccurate data rectified or incomplete data completed;
- request erasure of the data;
- request restriction of processing;
- portability of data processed by automated means on the basis of consent or a contract;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal;
- lodge a complaint with a supervisory authority competent for personal data protection, in particular in the Member State of the European Union in which you have your habitual residence or place of work or in which the alleged infringement took place. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl), in the Czech Republic the Úřad pro ochranu osobních údajů (uoou.gov.cz) and in Slovakia the Úrad na ochranu osobných údajov Slovenskej republiky (dataprotection.gov.sk).
Requests concerning personal data may be sent to: [email protected]. Before fulfilling a request, the Controller may ask for additional information necessary to confirm the identity of the person making the request.
Some rights are not absolute and may be subject to limitations arising from applicable law; their application depends on the basis and purpose of the processing.
The CSV function and personal data rights
The CSV import and export function available in certain Plans is a functionality of the Service and does not replace or limit the rights of the data subject under the GDPR. The rights under Articles 15 to 22 GDPR are exercised regardless of the Plan held.
Where the conditions for the right to data portability are met, the exercise of that right does not depend on holding a paid Plan. The exercise of rights is, as a rule, free of charge, save for cases in which the GDPR allows a reasonable fee to be charged or action to be refused in connection with a manifestly unfounded or excessive request.
Deleting the Account
You can delete your Account yourself in the settings, without contacting the Controller. Deleting the Account results in the loss of access to the linked Collections, Binders, Shopping Lists, alerts and other usage data; what happens to the data afterwards is described in the section “Retention period”.
6. Recipients and transfer of data
What we do
We may create and publish aggregate market statistics (e.g. “Card X is in 500 collections”). Before publication, the data is aggregated and processed in a manner intended to prevent the identification of individual Users.
What we do NOT do
We do not publish information about the contents of Collections assigned to a specific User, unless that User has shared a public link themselves. We do not sell your individual data on the cards you own and their purchase prices.
In connection with the provision of the Service, data may be entrusted to entities processing it on our behalf or made available to other data controllers. Some recipients or entities in their corporate groups may process data outside the European Economic Area. Where data is transferred outside the EEA, this takes place using the mechanism provided for in Chapter V GDPR that is appropriate for the given case, in particular on the basis of a European Commission decision finding an adequate level of protection, the EU-US Data Privacy Framework (where applicable) or standard contractual clauses approved by the European Commission together with additional safeguards, where required. Information on the safeguards applied can be obtained by contacting the Controller. Below we list both entities processing data on our behalf and independent controllers who receive data as a result of your action (e.g. going to a shop or signing in through an external provider).
The main servers and database are maintained in the Warsaw, Poland region, within the European Union.
Protection against DDoS attacks, WAF and CDN; processes the IP address for security purposes. Separately, Cloudflare Web Analytics provides us with traffic statistics without cookies and without fingerprinting. We also store scan photos of users who have enabled this option in the Cloudflare R2 service. Transfer: active EU–US Data Privacy Framework certification.
Application error monitoring. Receives technical crash reports, which we have restricted so that they do not contain cookies, headers, URL parameters or IP addresses. Transfer: active EU–US Data Privacy Framework certification and standard contractual clauses.
E-mail infrastructure: sending verification messages and notifications and handling the contact form (processes the e-mail address and message content). Transfer: active EU–US Data Privacy Framework certification and standard contractual clauses.
To handle payments and Subscriptions, we use the services of entities in the Stripe group, including (depending on the type of service provided and the role in the processing) Stripe's European entities. Stripe receives the data necessary to handle payments and Subscriptions, in particular: payment instrument data provided directly by the User; the e-mail address; information concerning the transaction; information concerning the Subscription; technical customer and payment identifiers; technical data related to the device, the browser and the payment process, to the extent needed for security and fraud prevention. Depending on the specific activity, entities in the Stripe group may act on our behalf as processors or as data controllers to the extent arising from their own legal obligations, payment security or fraud prevention. mTCG does not store the full payment card number or the card security code.
In the Link channel (clause 8.12 of the Terms of Service), payment is handled by Link, a payment service of the Stripe group, and the transaction is handled on our behalf by Sold through Link, LLC (SMP) as merchant of record. Link and SMP receive the data needed to conclude and settle the transaction, in particular: the e-mail address; the billing country and address; payment instrument data provided directly by the User; information concerning the transaction and the Subscription; technical data and data used for fraud prevention. Under the Link terms, Link and SMP process this data as independent controllers, for the purposes of the transaction, taxes, receipts, refunds, the Link account and fraud prevention. The details are set out in the Stripe privacy policy presented in the payment process. Buying a Subscription in this channel may require a Link account. Transfer: according to the Stripe privacy policy, data is transferred to the USA on the basis of the EU–US Data Privacy Framework and standard contractual clauses.
If you ask Link to delete your data, Link deletes the transaction data it holds, including the related data in our Stripe account, and the Subscription purchased in this channel is cancelled. Such a request does not delete the data we keep in our own database, such as the Account, the order history or the statements made when placing the order. You can request the deletion of that data separately, as described in .
Google Analytics 4: statistics on the use of the Service. The script is loaded only after consent to analytics has been given. Transfer: active EU–US Data Privacy Framework certification.
Protecting the contact form against spam and countering automated abuse. hCaptcha may also be loaded by Stripe.js as part of the mechanisms securing the payment process. Transfer: active EU–US Data Privacy Framework certification and standard contractual clauses.
A photo sent to the scanner goes to our own card recognition service, running on the Controller's infrastructure, and recognition is not outsourced to external entities. After the result is returned, the photo is not stored unless you enable the “Scan photos” option: in that case, we save the cropped image of the card in the Cloudflare R2 service, on the terms described in the section “Scan photos”.
If you enable push notifications, they are sent through the push service of your browser's vendor (including Google for Chrome, Mozilla for Firefox, Apple for Safari), which receives the technical subscription address assigned by your browser. We encrypt the content of the notification with the keys of that subscription, so the push service only forwards it and cannot read it. We do not pass on your e-mail address or Account name in the process.
If you voluntarily connect your Account to Telegram, we transfer to Telegram Messenger Inc. the data necessary to deliver the Alerts you requested, in particular the content of the Alert, the Product image and a link. Data is transferred only after the User has activated this function themselves. Further processing of the data by Telegram takes place on the terms set by that operator.
If you voluntarily configure a Discord webhook, we transfer to Discord the data necessary to deliver Alerts to the channel you specified, in particular the content of the Alert, the Product image and a link. For users located in the European Economic Area, the data controller for Discord services is Discord Netherlands B.V. Data is transferred only after you have configured this function yourself. Further processing of the data by Discord takes place on the terms set by that operator.
If you voluntarily configure Pushover, we transfer to Pushover, LLC the data necessary to deliver Alerts, in particular the content of the Alert, a link and, if used, the Product image. Data is transferred only after you have configured this function yourself. Further processing of the data by Pushover takes place on the terms set by that operator.
By clicking on an offer, you leave the Service and go to the shop's website, sometimes through an affiliate network (including TradeDoubler, webePartners, Amazon Associates, Performers.tech). These entities receive data resulting from the connection to their server itself (e.g. IP address, User-Agent) and the parameters we add to the link: the identification of mTCG as the traffic source, the place of the click in the Service and the technical click identifier. We do not pass on your e-mail address, Account name or the contents of your Collection to them. Destination shops, as a rule, process data as independent controllers. The role of the affiliate network operator depends on the rules of the given programme and the agreements concluded: it may process data on behalf of the advertiser or for its own purposes specified in its privacy policy. After you go to their websites, they may store their own cookies on your device, on the terms described in their policies. The scope of data recorded on our side is described in .
If you choose to sign in with Google or Discord, authentication takes place with that provider as an independent controller, and we receive basic profile data (ID, name, e-mail, avatar). The rules of processing by the provider are set out in its own privacy policy.
7. Security
We apply the following data protection measures:
- HTTPS encryption
- Password hashing (scrypt)
- Encryption of 2FA secrets (TOTP)
- Protection against brute-force attacks (rate limiting)
- Support for Passkeys (WebAuthn/FIDO2)
- Sessions in HttpOnly cookies
- Encryption of stored data that enables the use of external notification channels
- Restricting access to data used in abuse analysis to authorised persons
9. Changes to the policy
We will inform you of any material changes to this Policy with appropriate advance notice by means of a notice on the Service or an e-mail message (for registered users).
This Privacy Policy is available in Polish, English, German, Czech and Slovak. All versions have the same content. If the versions differ from one another, we apply the wording that is more favourable to you.