Privacy Policy
Last updated: 13 September 2026
ProdCards is operated by TODO: registered company name (e.g. "ProdCards ApS"), TODO: street and number, TODO: postcode TODO: city, Denmark, CVR TODO: CVR no.. We are the data controller for the personal data described below, and you can reach us at TODO: [email protected].
This policy covers everything that happens on prodcards.gg: browsing the shop, creating an account, ordering cards, and taking part in a box break.
What we do not do: we run no advertising cookies, no analytics, no tracking pixels and no profiling. We do not sell or rent your personal data to anyone, and we do not send marketing email unless you have asked us to.
1. What we collect
Account data. Sign-up and login are handled by Clerk. When you register we receive and store your name, email address, profile image URL and your Clerk user ID. You can optionally add a phone number and a Twitch username to your profile.
Order data. When you place an order we store your email address, the delivery name, street, apartment, city, region, postcode and country, an optional phone number, the items ordered with a snapshot of their name, description, image, set, rarity and price, the currency, subtotal, discount, shipping cost, VAT and total, any coupon code used, your order notes, the order status and — once dispatched — the tracking number.
Payment data. Payment is taken by Stripe on Stripe's own checkout pages. We never see or store your card number, security code or bank details. What we store is the Stripe session reference, the payment status, the amount, the currency and the VAT that Stripe Tax calculated for your delivery address.
Box break data. To join a break you give us a Twitch username — that is how your spot is identified on stream — and an email address. We store your reservation (which expires automatically after 10 minutes if you do not complete payment), the packs or team slot you bought, the price and the payment status.
Cart, wishlist and saved addresses. These are stored against your account. If you are not signed in, your cart lives in your browser and is tied to a random guest identifier in a cookie.
Technical data. Our server and our CDN keep ordinary request logs: IP address, date and time, the page requested, browser user agent and referrer. We use these for security, abuse prevention and debugging.
We do not collect special categories of data (health, ethnicity, political opinions and so on), and we do not ask for your date of birth beyond a confirmation that you are 18 or older.
2. Why we use it, and our legal basis
| What for | Legal basis under the GDPR |
|---|---|
| Taking, processing, shipping and supporting your order | Art. 6(1)(b) — performance of a contract |
| Running your account, cart, wishlist and break reservations | Art. 6(1)(b) |
| Keeping accounting records of every sale | Art. 6(1)(c) — legal obligation under the Danish Bookkeeping Act |
| Preventing fraud, coupon abuse and attacks on the site | Art. 6(1)(f) — our legitimate interest in a working, non-defrauded shop |
| Answering your emails and handling complaints, returns and warranty claims | Art. 6(1)(b) and (c) |
| Showing the live Twitch player on the Breaks page | Art. 6(1)(f) — see section 7 |
We do not make automated decisions with legal effect about you, and we do not profile you.
3. Who we share it with
We use a small number of processors, each under a data processing agreement. Nobody else receives your data, and we never sell it.
| Recipient | What they receive | Where |
|---|---|---|
| Hetzner Online GmbH — server hosting | everything stored in our database | Finland (EU) |
| Cloudflare — DNS, CDN and firewall | IP address and request metadata | EU edge, global network |
| Clerk — accounts and login | name, email, avatar, login metadata | USA |
| Stripe Payments Europe, Ltd. — payments and VAT calculation | name, email, delivery address, order amount, payment details | Ireland (EU), with onward transfer to Stripe, Inc. (USA) |
| UploadThing — image hosting | product photographs uploaded by our staff — no customer data | USA |
| Twitch (Amazon) — embedded live player on the Breaks page | your IP address and Twitch's own cookies, if the player loads | USA |
| OpenRouter and Google — AI touch-ups of product photographs | product photographs only — never customer data | USA |
| open.er-api.com — USD to DKK exchange rate | nothing personal | — |
We also disclose data where we are legally obliged to, for example to the tax authorities, and to our shipping carrier so that your parcel can be delivered.
4. Transfers outside the EU/EEA
Clerk, UploadThing, Twitch, OpenRouter and Stripe's US entity are located outside the EU/EEA. Those transfers are made under the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. Email us if you would like a copy of the safeguards that apply to a specific transfer.
5. How long we keep it
| Data | Retention |
|---|---|
| Orders, invoices and payment records | 5 years from the end of the financial year, as required by the Danish Bookkeeping Act |
| Your account, cart, wishlist and saved addresses | until you delete your account — deleting it in Clerk also deletes your ProdCards profile and everything attached to it |
| Break reservations that are not paid for | 10 minutes, then deleted automatically |
| Break purchases | kept with the corresponding order record |
| Emails to and from support | up to 2 years after the matter is closed |
| Server and CDN request logs | a few weeks |
6. Your rights
You have the right to access your data, to have it corrected, to have it erased, to restrict or object to our processing of it, and to receive it in a portable format. Where we rely on consent, you can withdraw that consent at any time.
Write to TODO: [email protected] and we will answer within one month. Most of it you can also do yourself: your profile, email and account deletion are in Account, and your order history is in Orders.
If you think we are handling your data incorrectly you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, [email protected], datatilsynet.dk.
7. Cookies and local storage
We use no advertising, analytics or tracking cookies — there is no Google Analytics, no Meta pixel and no ad network on this site.
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
| __session, __client_uat and other __clerk cookies | Clerk | keeps you signed in; strictly necessary | session to a few days |
| prodcards_guest_id | us | links a guest cart and break reservations to your browser; strictly necessary | 30 days |
| NEXT_LOCALE | us | remembers whether you chose English or Danish | 1 year |
| cart, orders_last_seen | us, in localStorage | your cart contents and the unread-orders badge | until you clear your browser data |
| Stripe cookies | Stripe | payment processing and fraud prevention, on Stripe's own checkout pages | per Stripe's policy |
| Twitch cookies | Twitch | the embedded live player on the Breaks page | per Twitch's policy |
Strictly necessary and functional cookies do not require consent, so there is no cookie banner to click through.
One thing worth calling out: the Breaks page embeds Twitch's live player, and Twitch can set its own cookies as soon as that page loads. If you would rather it did not, block third-party cookies in your browser or avoid that page. Twitch's privacy notice governs what they do with it.
8. Age
The shop and the box breaks are intended for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has given us personal data, email us and we will delete it.
9. Security
The site is served over HTTPS, our database sits on a server inside the EU, admin functions are restricted to named accounts, and card data never touches our systems because Stripe handles it on their own pages.
10. Changes to this policy
If we change how we handle personal data we will update this page and the date at the top. Material changes affecting existing customers will also be sent by email.