Privacy Policy

1. Data controller

[DA COMPILARE: company name or full name, registered office, VAT no. / tax code, privacy contact email]

Website: https://cardbrix.com

[DA VERIFICARE: DPO and contact, if appointed]

[DA VERIFICARE: if the controller is not established in the European Economic Area, the EU representative under Art. 27 GDPR]

2. Data you give us

• Account: email, username, password (stored only in encrypted form) and preferred language.

• Sign-in with Google or Apple: the identifier and email returned by the provider you choose.

• Public profile: avatar, city and country, an optional bio and the reviews you receive. For professional sellers, also the business identification data that the law requires us to show to consumers.

• Listings and auctions: titles, descriptions, photos, prices and bids.

• Shipping: name, address and contact details needed for delivery.

• Payments: full card or bank details are handled by Stripe and PayPal and never pass through or stay with CardBrix. We see amounts, order status and transaction identifiers.

• Seller verification: the identity data required by Stripe Connect is given directly to Stripe.

• Support: the content of the requests you send us and the questions you ask the Help Center’s automated assistant.

[DA VERIFICARE: other data collected, for example messages between users, phone, documents]

3. Data we collect automatically

• Technical data: IP address, browser, country derived from the IP and security logs.

• Credits and Skill Zone: the credit ledger (date and reason) and puzzle entries.

• Anti-abuse signals: irreversible fingerprints (SHA-256 hashes) of IP, device, payment method and shipping address. For this purpose we do not keep the plain value.

• Usage statistics, only with your consent: pages visited, duration, clicks on links and buttons, random session and visitor identifiers. Details in the Cookie Policy.

• Consent record: your cookie choice, the date, the policy version, an encrypted fingerprint of the IP (never the IP itself) and the browser, so we can prove consent or refusal.

4. CardBrix the game

CardBrix the game is CardBrix’s interactive world, reached with the same account as the website. This is what it processes.

• Character: the look you choose (skin, hair, clothes, accessories) is saved on your account.

• Plaza and maps: while you are in the game, the other players present see in real time your username, your character, where you are and which way you are walking. This data stays only in the server’s memory while you are connected: it is not saved or logged.

• Phrase chat: you can only say preset phrases and emoji, not free text. They are not saved.

• Visibility: from the game you can choose not to be visible to others; if you do, we send you to nobody.

• Inventory: clicking a player opens their public profile (listings, ratings, city and country). This is data already public on the website.

• Preferences on your device: your visibility choice, the tutorial already seen and a few minimal settings are stored in your browser (see the Cookie Policy), not on our servers.

• The game uses no advertising cookies, does not profile players and awards no cash prizes. You need an account and must be at least 18 to play.

5. Why we process it and on what legal basis

• Creating and managing your account, authenticating you, verifying your email: performance of a contract (Art. 6.1.b GDPR).

• Enabling listings, auctions, purchases, shipping, payments, reviews and disputes: performance of a contract.

• Managing credits (crediting, maturation, use in puzzles, ledger): performance of a contract.

• Providing CardBrix the game (character, plaza, maps): performance of a contract; visibility to other players can always be switched off.

• Sending service emails (verification, orders, security): performance of a contract.

• Preventing fraud and bonus abuse, including caps and checks on shared signals: legitimate interest (Art. 6.1.f) in protecting the platform and users.

• Information security and bot prevention (Cloudflare Turnstile): legitimate interest.

• Answering Help Center questions, also through the automated assistant: legitimate interest in providing support; for email requests, performance of a contract.

• Keeping proof of cookie consent: legal obligation and legitimate interest in demonstrating compliance (Arts. 6.1.c, 6.1.f and 7.1).

• Tax and accounting duties, traceability of professional sellers and requests from authorities: legal obligation (Art. 6.1.c).

• Usage statistics: consent (Art. 6.1.a), which you can withdraw at any time at no cost.

• Promotional communications [DA VERIFICARE: if planned]: consent.

• Defence of legal claims: legitimate interest.

6. Automated decisions

The system may refuse or suspend the crediting of bonus credits when it detects signs of abuse, for example the same IP, device, payment method or address shared by seller and buyer. The Help Center’s automated assistant answers general questions but makes no decisions about your account.

You can ask for human intervention, express your view and contest the decision by writing to [EMAIL PRIVACY].

7. Who we share data with

We share data with providers that process it on our behalf (processors) or as independent controllers:

• Supabase: database and infrastructure.

• Render: hosting of the website and server.

• Stripe and PayPal: payments; Stripe also for seller verification.

• Cloudinary: image storage and optimisation.

• SendGrid: sending emails.

• Cloudflare Turnstile: anti-bot protection.

• Google (Gemini): the Help Center’s automated assistant, which receives the question you write. Do not put personal data in the message.

• Google and Apple: only if you choose to sign in with their account.

• Carriers and shipping services [DA VERIFICARE: names, for example Sendcloud].

• Advisers, accountants and competent authorities, where the law requires.

Other users see only the data they need: the buyer sees the seller’s username, the seller sees the order’s shipping address, plaza players see your username and character. We do not sell your data.

8. Transfers outside the European Economic Area

Some providers may process data in the United States or other non-EU countries. In that case the transfer relies on an adequacy decision (for example the EU-US Data Privacy Framework for certified providers) or the European Commission’s Standard Contractual Clauses. You can ask for a copy of the safeguards by writing to [EMAIL PRIVACY]. [DA VERIFICARE: confirmation for each provider]

9. How long we keep data

• Account and profile: until the account is deleted [DA VERIFICARE: proposal, deletion within 30 days of the request].

• Orders, invoices and accounting documents: 10 years, for tax obligations.

• Credit ledger: [DA VERIFICARE: proposal, 10 years like accounting documents].

• Anti-abuse signals (hashes): [DA VERIFICARE: proposal, 24 months from the last signal].

• Usage statistics: [DA VERIFICARE: proposal, 14 months]; the visitor cookie lasts up to 400 days.

• Consent record: [DA VERIFICARE: proposal, 3 years from the choice].

• Position and phrases in the CardBrix the game plaza: not kept; they exist only while you are connected.

• Support requests: [DA VERIFICARE: proposal, 24 months after closing].

When the period ends the data is deleted or anonymised.

10. Your rights

You can ask for access to your data, rectification, erasure, restriction, portability in a structured format, and object to processing based on legitimate interest. You can withdraw consent at any time from the “Manage cookies” link at the foot of every page: withdrawal does not affect processing already carried out.

Write to [EMAIL PRIVACY]: we reply within one month, extendable by two in complex cases. Exercising your rights is free of charge.

You also have the right to lodge a complaint with the supervisory authority of the country where you live, work or where you believe the infringement took place (Art. 77 GDPR). List of European authorities: https://www.edpb.europa.eu. In Italy: Garante per la protezione dei dati personali, www.garanteprivacy.it.

11. Providing your data

Account, shipping and payment data are needed to use the marketplace: without them we cannot conclude the contract. Statistics and non-essential cookies are optional: refusing them does not limit use of the website or the game.

12. Security

We use encrypted connections (HTTPS), passwords stored only as hashes, administrator access checked on every request and attempt limits. No system is risk-free: if a breach affects you we will inform you, and the supervisory authority, as the law requires.

13. Minors

The service, including CardBrix the game, is for people aged 18 or over. We do not knowingly collect minors’ data; if we find out, we close the account and delete the data. If you think a minor has registered, write to [EMAIL PRIVACY].

14. Credits

Credits are an internal CardBrix tool: they cannot be bought with money, converted into money or transferred between users. The ledger exists to ensure correctness, prevent abuse and support users.

15. Professional sellers and transparency duties

To comply with European rules on digital services and consumer protection, professional sellers show their business identification data on their profile (name, address, contacts, VAT number). This data is public because the law requires it. You can report illegal content by writing to [EMAIL PRIVACY] [DA VERIFICARE: dedicated reporting channel].

16. Changes to this policy

We publish every update here with the new date. For significant changes we will notify you by email or on the website. If a change affects processing based on consent, we will ask for it again.