Zardly

Zardly Privacy Policy

Version: v1.1 Effective date: September 20, 2026 Last updated: September 20, 2026

This Privacy Policy explains how Zardly LLC ("Zardly," "we," "us," or "our") collects, uses, and shares information when you use the Zardly platform — our web application (app.zardly.ai), our mobile application, and related services (together, the "Service").

Zardly is a business tool for trading-card vendors in the United States. Most of the data in the Service is business inventory and transaction data, but some of it is personal information, and this policy covers both. Plain-language summaries appear throughout; the full text controls.

If you accepted an earlier version of this policy, a plain-language summary of what changed is shown with the update notice in the web application and is available on request from support@zardly.ai.

1. Information We Collect

1.1 Account information

Accounts are created on our website. When you sign up, our authentication provider (Clerk) collects your email address, name (if provided), and authentication credentials (a passkey, an email-based login, or a password). Zardly stores your email address, a display name, and an internal user ID linked to your workspace. We never see or store your passkey private keys or passwords.

We also keep a record of which version of our Terms of Service and this Privacy Policy you accepted, and when.

1.2 Workspace, inventory, and deal data

The core of the Service is the business data you and your team enter:

  • Inventory records — card names, sets, numbers, conditions, grades, prices, quantities, SKUs, notes, and product details, including records you import from a spreadsheet;
  • Card photos — images you take or upload of your cards. Note: photos you attach to inventory are published to marketplaces as part of your listings, and the listing-ready copy of each photo can be viewed by anyone who has its image link (this is required so marketplaces can fetch your listing images). The links are long and unguessable, but they are not protected by a sign-in. Do not photograph anything private alongside your cards.
  • Deal records — deals you record (in person or detected from marketplace sales), including items, agreed prices, market-price snapshots, cash amounts, payment method, timestamps, and an optional event tag (for example, the name of a card show);
  • Counterparty notes — an optional free-text note on a deal. This field is intended for context like "regular customer, wants Charizards." If you type a person's name or contact details into it, that information will be stored with the deal record. We recommend not entering other people's personal information in free-text fields.

1.3 Marketplace connection data

When you connect a marketplace account:

  • eBay: we store OAuth access and refresh tokens (encrypted), your eBay seller account identifier, and listing/offer identifiers.
  • Shopify: we store the access and refresh tokens issued when you install the Zardly app and approve its permissions (or, for some early accounts, the access token and webhook secret you provided), all encrypted, along with your shop domain and listing identifiers.

Order data: when a sale happens on a connected marketplace, we learn about it from the marketplace — through an order notification it sends us, or by checking your account for new orders. Those messages can include buyer information the marketplace sent, such as the buyer's name, shipping address, and contact details. We read each message to find the items that sold, and then we keep only a reduced copy: SKUs, item identifiers, quantities, sale prices, order IDs, and timestamps — not buyer names, addresses, or contact details. Buyer details are removed before the record is stored, and records stored before we introduced this step (July 2026) were scrubbed the same way. See Section 4 (buyers' information) and Section 6 (retention).

1.4 Scanning cards: what happens on your phone and what is sent

On your device. Card matching runs on your phone first. The app reads printed text on the card or slab label (such as the collector number, grade, or certification number) and, if you have downloaded scan data for a game (Account → Scan Data), compares the photo against that data — all on the device. Scan data is a download of card reference information from us to you; downloading it does not send us your photos. When a card is identified on the device, the photo is not sent anywhere for recognition.

Sent for recognition. When the app cannot identify a card on the device and you are online, a copy of the photo (usually reduced in size) is sent to our servers and on to our card-recognition provider (CardSight AI) to identify the card. The photo is also stored with your inventory or deal record if you attach it.

Barcodes. When you scan the barcode on a sealed product, the barcode number is sent to our servers. If we have not seen that barcode before, we may look the number up with a barcode-lookup provider (UPCitemdb); only the barcode number is sent. When you confirm which product a barcode belongs to, that match is added to a lookup table shared across all Zardly workspaces so the next vendor gets an instant match. The shared table contains the barcode and the product — it does not show other vendors who confirmed it.

1.5 Device and notification data

If you enable push notifications in the mobile app, we store a push notification token for your device (via Expo's push service) so we can deliver operational alerts (for example, a sale or a failed delisting). We also collect basic device information needed to run the app.

If you opt in to SMS alerts, we store the mobile phone number you provide and verify. SMS alerts are strictly opt-in (the consent box is never pre-checked, and your number is confirmed with a one-time code), transactional-only (sales, critical account or sync issues, and verification codes — never marketing), and delivered through Twilio, our SMS provider, which processes your number solely to deliver these messages. Message frequency varies with your sales activity; message and data rates may apply. You can opt out at any time by replying STOP to any message or by removing your number in the app (Account → SMS alerts). Reply HELP or contact support@zardly.ai for help. Full details: SMS Alerts Opt-In Policy. We never sell your phone number or share it with third parties for their marketing. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

1.6 Usage, diagnostics, and log data

Like most online services, our infrastructure providers collect standard technical logs — IP addresses, browser/device type, pages or endpoints accessed, and timestamps — used for security, debugging, and operating the Service. We do not use third-party advertising trackers or third-party analytics trackers.

Scan diagnostics. To measure and fix scanner performance, the mobile app sends us a small diagnostic record for each scan attempt: which recognition step identified the card (or that none did), how long it took, match-confidence scores, whether the device was offline, the app version, which scan data is loaded, the game, and short technical status lines. For troubleshooting misreads, the record can include short snippets of printed text the app read from the card or slab label (for example, a collector number such as "143/132," or a grade). These records are tied to your workspace and user ID so we can investigate a problem you report. They contain no photos and are not linked to your inventory items or deals.

Crash and error diagnostics. When enabled, we use Sentry to collect crash and error reports from the web and mobile apps: the error, where in our code it happened, app and device/browser type, and an internal user ID. Reports are filtered before they are sent — request bodies are not included, and reports containing email addresses or credential-like values are dropped.

1.7 Billing information

If you subscribe directly, payments are processed by Stripe. Stripe collects your payment card details directly; Zardly never receives or stores your card number. We store your Stripe customer and subscription identifiers and your subscription status. If you subscribe through a third-party marketplace or app store that bills you itself (for example, an e-commerce platform's app store), that marketplace collects your payment; we store the subscription identifier and status it gives us and never receive your payment details. We also store your free-trial or complimentary-access dates, whether your workspace is a founding vendor and when its price lock began, and which billing emails we have sent you. Subscriptions are started and managed only on our website; the mobile app never takes payment.

1.8 Corrections and price reports

When you correct something the Service suggested, we record the correction so we can make the Service more accurate:

  • Market price reports — when you type a market price that differs from the one we showed, we store the card's identity (name, set, number, language, printing, grade or condition), the price we showed, the price you entered, where in the app it happened, and the date.
  • Identification corrections — when you change a card the scanner identified, we store the identity it suggested, the identity you corrected it to, which recognition step made the suggestion, and the date. No photos and no prices.

These records are tied to your workspace and user ID. Section 5 explains how they may be used in aggregated form.

1.9 Support requests

When you contact us through the Support & Feedback screen or by email, we store your message, the contact email you give us (if any), and basic context (platform, app version, and the screen you were on), and we send a copy to our support mailbox so we can reply.

1.10 Public share links

If you create a share link for a card, that card becomes public to anyone who has the link: its photo, its details (name, set, number, condition or grade), its price if you have set one, your workspace name, and links to your marketplace listing for it where one exists. We store the link, which card it points to, who created it, and when. Links are unguessable, but anyone you send one to can pass it on. To have a link turned off, contact support@zardly.ai.

1.11 Social accounts

Where the feature is available, you may choose to connect your own social media accounts so posts you create in Zardly are published to them. We use a social-publishing provider (Ayrshare) for this. If you connect, we store an encrypted key for your publishing profile, the platforms and account names you linked, and a record of each post (its caption, image link, target platforms, and result). If you never connect a social account, none of this applies to you.

2. Where Information Comes From

We collect information: (a) directly from you and your workspace members; (b) automatically from your use of the Service; (c) from marketplaces you connect (eBay, Shopify); and (d) from our data providers (Scrydex catalog and pricing data matched to your inventory; CardSight recognition results and sales-based price estimates for photos and cards you submit; UPCitemdb product names for barcodes you scan).

3. How We Use Information

We use the information described above to:

  • Provide and operate the Service — inventory management, listing sync, sale detection, deal recording, search, reports, share links, and notifications;
  • Authenticate you and secure your workspace;
  • Process subscription billing, free trials, and seat management;
  • Send operational emails (invitations, sale alerts, sync-failure alerts, trial and billing notices), push notifications, and — if you opt in — text messages;
  • Provide support and respond to your requests;
  • Monitor, debug, and improve the Service, including diagnosing failures in marketplace sync and measuring and improving the accuracy and speed of card recognition and pricing;
  • Create aggregated and de-identified data as described in Section 5; and
  • Comply with law and enforce our Terms of Service.

We do not use your data to train third-party AI models, and we do not sell identifiable personal information. We may use identification corrections (Section 1.8) to improve our own card-matching technology.

4. Buyers' and Counterparties' Information

When your marketplace buyers' information passes through the Service (as described in Section 1.3), we process it on your behalf as part of operating your workspace — we do not use it for our own purposes, do not build profiles of buyers, do not contact buyers, and do not include it in any data product. If you record information about an in-person counterparty in a deal note, the same applies. Buyers and counterparties who have questions about their information should contact the vendor they transacted with; if a buyer contacts us directly, we will refer the request to the relevant vendor and cooperate reasonably.

5. Aggregated and De-Identified Data

This section describes a commercial use of data and mirrors Section 7 of our Terms of Service.

Zardly creates aggregated and de-identified data sets from data generated through use of the Service — for example, market-level statistics about which cards are trading, at what prices, in what volumes, and when. Zardly may use and commercialize these data sets for any lawful purpose, including selling market-data products.

What may go into a data set we sell or license: information vendors generate first-hand in Zardly — in-person deal records (what traded, for how much, when), market price reports, and identification corrections (Section 1.8) — combined across vendors.

What never goes in:

  • Marketplace data. Data we receive from a marketplace you connect (your eBay or Shopify orders, sales, and listings) is used to run the Service for you. We do not include it in data sets we sell or license, even in aggregated or de-identified form.
  • Licensed catalog and pricing data. Catalog records, market prices, and recognition results supplied by our data providers are licensed to us for use in the Service and are not resold.
  • Buyers' and counterparties' information, deal notes, photos, phone numbers, and account information.

Our commitments for any such data we publish, sell, or share externally:

  • It will never identify you, your store, or your workspace as the source of any data point;
  • It will never include your customers' or counterparties' names, addresses, or other identifying details;
  • It will be aggregated across vendors and/or de-identified so that an individual store's activity cannot be singled out or re-identified, and we will not attempt to re-identify de-identified data; and
  • We do not sell identifiable personal information about anyone.

6. How Long We Keep Information

  • Workspace Data (inventory, deals, photos, listings) is kept while your workspace is active.
  • Suspended and cancelled workspaces. If a workspace is suspended (for example, after a free trial or a grace period ends without a subscription) or its subscription is cancelled, we keep its Workspace Data for at least 90 days afterward so the workspace Owner can come back, subscribe from the billing page, and pick up where they left off. During that time you can also ask us for an export. After that period we may delete the data in the ordinary course of business, and we will email the workspace Owner at least 14 days before we do.
  • Deleted accounts. When you delete your account (Section 9), your sign-in is deleted and your name and profile image are removed right away. If you are the only person in your workspace, the workspace and its data — inventory, deals, photos, listings records, marketplace connections and tokens, corrections, diagnostics, and support requests — are deleted at the same time, and any Stripe subscription is cancelled. We keep a minimal record of your email address together with the versions of our Terms and Privacy Policy you accepted and when, as evidence of the agreement. Barcode matches you confirmed remain in the shared lookup table (Section 1.4), which does not identify you to other vendors. Aggregated or de-identified data sets that were already created are not affected.
  • Marketplace tokens are kept while the connection is active and deleted or invalidated when you disconnect the marketplace or close the workspace.
  • The marketplace event log (Section 1.3) holds the reduced, buyer-free copy of each order notification and is retained for duplicate detection, operational reliability, and audit purposes.
  • Scan and crash diagnostics are kept only as long as they are useful for troubleshooting and measuring the Service, and are deleted with the workspace.
  • Billing records are retained as required for tax and accounting purposes.
  • Backups and logs roll off on our infrastructure providers' standard schedules.

We honor eBay's marketplace account-deletion notifications: when eBay tells us an eBay user has requested deletion, we review the notification and delete any eBay user data we hold for that user, as required by the eBay Developers Program.

7. Who We Share Information With

We share information only as described here. We use service providers ("subprocessors") to run the Service; each receives only what it needs for its function:

  • Clerk — authentication. Processes your email, name, credentials, and session data.
  • Supabase — database and file storage, hosted in the United States. Processes all Workspace Data, tokens (encrypted), diagnostics, and event logs.
  • Vercel — web hosting and compute. Processes traffic to the web app and API, and request logs.
  • Stripe — payments and billing for direct subscriptions. Processes payment card details (collected directly by Stripe), billing contact, and subscription status.
  • Resend — email delivery. Processes recipient email addresses and email content (invitations, alerts, trial and billing notices, support requests).
  • Expo — mobile push notifications. Processes device push tokens and notification content.
  • Twilio — text messages, only if you opt in to SMS alerts. Processes your mobile phone number and the content of verification codes and alerts.
  • Sentry — crash and error diagnostics, when enabled. Processes filtered error reports (Section 1.6).
  • CardSight AI — card recognition and sales-based price estimates. Processes photos sent for recognition (Section 1.4), recognition results, and card identifiers.
  • Scrydex — card catalog and market pricing. Processes search queries and catalog identifiers (your inventory data is matched against their catalog; we do not send them your customer information).
  • UPCitemdb — barcode lookup for sealed products. Processes the barcode number only.
  • Ayrshare — social publishing, only if you connect social accounts. Processes your publishing profile and the posts (captions and image links) you choose to publish.
  • eBay — a marketplace you connect, under your own eBay account. Receives listing content, photos, prices, and inventory quantities; sends us order data for your account.
  • Shopify — a marketplace you connect, under your own Shopify store. Receives listing content, photos, prices, and inventory quantities; sends us order data for your store and, if your subscription is billed through Shopify, its status.

We may also disclose information: to comply with law, legal process, or enforceable government requests; to protect the rights, safety, or property of Zardly, our customers, or the public; in connection with a merger, acquisition, financing, or sale of assets (in which case this policy continues to apply to previously collected data); and with your direction or consent — for example, when you create a public share link (Section 1.10) or publish a post to your social accounts (Section 1.11).

We do not sell identifiable personal information, and we do not share personal information for cross-context behavioral advertising.

8. Security

We take security seriously and apply safeguards appropriate to a business platform:

  • Marketplace access tokens, webhook secrets, and social-publishing keys are encrypted at rest with AES-256-GCM before storage;
  • Every database record is scoped to a workspace, enforced by row-level security in the database plus server-side permission checks, so one customer's workspace cannot read another's data;
  • All traffic between your devices and the Service uses HTTPS/TLS;
  • Payment card data never touches our systems (it goes directly to Stripe, or to the marketplace that bills you if you subscribed through one);
  • Webhook messages from Stripe, eBay, and Shopify are cryptographically verified before processing; and
  • Access to production systems is limited and credentialed.

No system is perfectly secure. If we learn of a breach affecting your personal information, we will notify you as required by applicable law.

9. Your Choices and Rights

Self-serve today: you can view, edit, and delete inventory records, photos, deals (void), and workspace members directly in the Service, and export your inventory and transaction records from the web application. Workspace Owners can disconnect marketplaces and cancel the subscription at any time. You can disable push notifications in your device settings, and stop SMS alerts at any time by replying STOP to any message or removing your number in the app (Account → SMS alerts). You can delete downloaded scan data from your phone at any time (Account → Scan Data).

Deleting your account: you can delete your account yourself in the mobile app (Account → Delete Account) or on the web (Team → Delete account), or ask us to do it by emailing support@zardly.ai from the email address on the account. If you own a workspace that has other members, remove them first, or contact us for help. What is deleted, and the little we keep, is described in Section 6.

By request: to access, export, or correct your information, or to delete an entire workspace's data, email us at support@zardly.ai from the email address on the account. We will verify the request and respond within a reasonable time (and within any timeline required by applicable law).

Depending on your state of residence, you may have legal rights to access, correct, delete, or obtain a copy of your personal information, and to opt out of certain uses. We honor such requests as required by applicable law, and we do not discriminate against you for exercising them. Because Zardly does not sell identifiable personal information or use it for targeted advertising, there is nothing to opt out of on that front.

10. Children

The Service is a business tool and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

11. United States Only

The Service is offered in and operated from the United States, and data is stored in the United States. If you access the Service from outside the United States, you do so on your own initiative and your information will be processed in the United States.

12. Changes to This Policy

We may update this policy from time to time. If we make material changes — including any change to Section 5 — we will notify workspace Owners by email or in-app notice before the changes take effect, and we will update the version number and effective date above. We may ask you to review and accept the updated policy in the web application.

13. Contact Us

Questions, requests, or concerns:

Zardly LLC Email: support@zardly.ai Web: https://zardly.ai