Template — the site operator must replace every [bracketed] value (legal entity, address, governing law, contact addresses, ICO/registration numbers) and have this reviewed by a qualified adviser before relying on it.
1. Controller
The data controller for PokeHive is [legal entity name], [registered address]. Contact for privacy matters: [privacy@your-domain]. [If you have a Data Protection Officer or a UK/EU representative, name them here.]
2. What we collect
| Data | When | Why |
|---|---|---|
| Email address, display name | When you create an account | Authenticate you; contact you about the Service |
| OAuth identifier (Google/Apple) | If you sign in with a provider | Link your account without a password |
| Collection & wants data, photos, notes, prices paid | When you add them | Provide the collection, binder, portfolio and wants features |
| Public username & showcase toggle | If you opt in | Publish the pages you choose to make public |
| Mailing-list opt-in flag | If you tick the box | Send new-set announcements (only if you opted in) |
| Region / currency preference | Set by you or inferred from request headers | Show local pricing and marketplaces |
| Basic server logs (IP, user agent, timestamps) | Automatically | Security, rate-limiting, debugging |
The camera Pre-Grader runs entirely in your browser. Photos you scan for grading are not uploaded unless you separately choose to save a card photo to your collection.
3. Lawful bases (UK GDPR / EU GDPR Article 6)
- 1ContractCreating and running your account and the collection features you use.
- 2Legitimate interestsKeeping the Service secure, preventing abuse, and understanding aggregate usage. You can object — see your rights below.
- 3ConsentMarketing emails and any non-essential cookies/analytics. You can withdraw consent at any time.
- 4Legal obligationRetaining limited records where the law requires it.
4. Cookies and similar technologies
We use a small number of first-party cookies and local-storage entries that are strictly necessary: a session/authentication cookie, and preference values for region, currency, catalogue language, light/dark theme and your cookie choice. These do not track you across other sites.
Non-essential: we use Google Analytics (GA4) for aggregate, non-identifying usage statistics. It runs in Google Consent Mode with all storage denied by default, so no analytics cookies are set and no analytics identifiers are stored until you choose “Accept” on the cookie banner shown on your first visit. You can change or withdraw your choice at any time via “Cookie settings” in the site footer; declining or withdrawing keeps analytics cookies switched off.
5. Sharing
We do not sell your personal data. We share it only with: our hosting and database providers acting as processors under contract; authentication providers you choose (Google/Apple); and an email delivery provider if you opt into mailing-list messages. Marketplace affiliate links pass no personal data — clicking them takes you to a third-party site governed by its own privacy policy. We may disclose data if required by law.
6. International transfers
Our providers may process data outside the UK/EEA. Where they do, transfers are covered by an adequacy decision or by Standard Contractual Clauses / the UK International Data Transfer Addendum. [Confirm and list provider locations.]
7. Retention
Account and collection data are kept for as long as your account is active. If you delete your account, we delete or irreversibly anonymise your personal data within [30] days, except where we must keep limited records to meet a legal obligation or resolve disputes. Server logs are kept for [90] days.
8. Your rights
Subject to the conditions in the GDPR, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to processing, or port it to another service. You can withdraw consent for marketing at any time from your account settings or via an unsubscribe link. To exercise a right, email [privacy@your-domain]; we respond within one month. You also have the right to complain to your supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk).
9. Children
The Service is not directed at children under 16. If you believe a child has given us personal data, contact us and we will delete it.
10. Changes
We will update this policy as the Service changes and will note the “last updated” date above. Material changes will be highlighted in the app or by email where appropriate.