Privacy notice
PRE-LAUNCH DRAFT · Updated October 12, 2026. Website and mobile feature descriptions reflect the current build. Legal business identity, retention periods, analytics and applicable regional disclosures must be finalized before public launch.
Current preview
CRX supports verified accounts, password reset, private conversations, account-linked grading and consignment requests, and private collection records with card photos and optional storage-location notes. Authorized staff have a bulk inventory intake workspace. Daily collection pricing is awaiting licensed data and exact card matches. Online checkout is not open yet. A service request does not authorize work, payment, sale, or shipping. Wait for written acceptance before sending cards.
Data and purposes to document
Collection records can include card details, images, quantity, purchase cost, tags, notes, and an optional box or storage location. These support your private collection, card lookup, and value tracking. Use a box label rather than a home address. Service requests and messages support CRX review and responses. The final notice must also document retention periods, applicable legal bases, and any analytics or device data.
Service providers and disclosures
Framer hosts the website. Supabase provides authentication and stores account details, private collection records and photos, service requests, consent records, conversations, payment-connection references, and operational history. Authorized CRX staff can access records needed to operate the service. Fastmail supports account emails and personal support replies. Requested card recognition sends selected card images to Ximilar; AI title assistance can use OpenAI when enabled. Connected payment providers process their own payment and identity-verification details. The mobile app uses Expo and Apple notification services: if you opt in, a device push token and generic update notification are processed to alert you to company replies or service changes. Message text stays inside CRX. Pricing sources, when connected, receive card identifiers for lookups. Final provider, international-transfer and retention disclosures remain under review.
Retention and security
Set retention periods based on service needs, tax obligations, dispute handling, and applicable law. Restrict private data to authorized users, enforce access on the server, protect administrative accounts, and maintain deletion and incident-response procedures. No online system can promise absolute security. Public CMS content must never contain credentials or private customer records.
Cookies and preferences
The website uses browser storage for your signed-in session, cart and appearance preferences. The native app uses secure device storage for session credentials and local storage for preferences and temporary workflow data. Camera and photo-library access is requested when you choose those features. You can decline optional permissions and change them in your device settings. Push notifications are optional and can be disabled in CRX settings or on your device. Signing out removes the active local account session. The final notice must also document any hosting analytics or non-essential tracking actually used.
Your rights
Depending on location and applicable law, individuals may have rights to access, correct, delete, restrict, or port data, object to processing, withdraw consent, or opt out of certain uses. The final notice must provide a working request channel, a proportionate identity-verification process, and information about complaints to a competent regulator.
Children and sensitive information
The grading and consignment request forms are intended for adults aged 18 or older and require an ownership or permission acknowledgment. Do not submit a child’s personal information. Any future account or transaction age policy must be finalized before those services open. Card photographs shared later should not expose addresses, payment information, or unrelated personal documents.
Contact and changes
For account or privacy questions, contact Support@CRXCollect.com. The data controller’s legal name, business address, regional disclosures, retention schedule, and request-handling procedures remain to be confirmed. This draft does not claim completion of privacy compliance.
Consignment information
The grading and consignment request forms collect a name, contact email, card category, quantity, format, requested service, condition notes, optional estimated value, and required acknowledgments. They do not collect shipping addresses, payment details, tax documents, or identity documents. CRX reviews requests privately and confirms any additional information and secure collection method before accepting cards. Public listings must not disclose private consignor information. Formal intake, payout verification, retention periods, and the related providers require a separate service agreement and completed privacy disclosures.