Privacy Policy

Last updated: 16 October 2026 · Version 2026-09-21

This policy explains what personal data Binder Blitz collects, why, who sees it and what you can do about it. It applies to our website, web app, tools, payments pages and support channels (together, the “service”). We wrote it in plain English first; the detail is underneath for those who want it.

Who we are

The data controller is:

• Name: Binder Blitz, trading as Binder Blitz
• Address: 3 Iyshas Terrace, Banner Lane, Newport, Isle of Wight, PO30 5GE
• Country: United Kingdom
• Privacy contact: keironjwest@gmail.com

In this policy “we”, “us” and “our” mean the controller above. Most of our customers are business sellers. Where we handle personal data of a business customer (for example the email address of a shop owner) we treat it with the same care as a consumer’s. Where you upload personal data about other people (for example a buyer’s name in a note you add to the collection tracker), you are responsible for having a lawful reason to do so; please do not upload data you do not need.

What we collect and why

The table below lists each kind of personal data, where it comes from, why we use it, the legal basis under the UK GDPR and EU GDPR (for people in those regions) and how long we keep it. We do not knowingly collect special-category data (for example health or biometric data) and the service is not designed for it. Your password is handled by our authentication provider and is stored only as a hash; we cannot see it after sign-up.

Some things are stored only on your own device and never reach our servers, for example your store details, title templates and pricing rules. See the Cookie Policy for the full list.

You are not required to give us any personal data, but without an email address and password we cannot give you an account, and without payment details processed by our payment providers we cannot sell you a paid plan.

How we use your data

We use personal data to:

• create and secure your account, and give you the plan, credits and features you have paid for or been given;
• process card photos, prompts and chat messages you submit to the AI features and return the result to you;
• take payment, send receipts, handle renewals, refunds, credits, chargebacks and taxes;
• respond to contact messages and provide support;
• keep the service secure, prevent fraud and abuse (for example repeated free-account sign-ups), enforce our Terms of Service and Acceptable Use Policy;
• run the affiliate programme and pay commission;
• send service messages (security notices, changes to terms, billing notices) and, only if you opted in, marketing;
• meet legal obligations, and establish, exercise or defend legal claims.

Where we rely on legitimate interests, those interests are running a secure, sustainable and abuse-free service and keeping accurate records. We balance them against your rights and you can object (see Your rights). Where we rely on consent (newsletter, remembering a referral code, optional analytics where required) you can withdraw it at any time without affecting earlier processing.

AI processing and automated tools

Binder Blitz uses artificial intelligence to read trading-card details from photos, write listing text, design listing themes and answer support questions. In practice:

• Card auto-read. When you use it, the photo you choose is sent over an encrypted connection to Anthropic’s Claude API, which returns the card’s details. We use the result to fill in your listing. We do not keep the photo as part of a library.
• AI theme creation and the AI support chat. The text you type is sent to Anthropic to generate the theme or the answer. We do not store chat transcripts unless you press “send this chat to support”, in which case the transcript is saved as a contact message. Chat history in your browser lives in session storage and disappears when you close the tab.
• Background removal. The background-removal model runs in your browser. The model files are downloaded from a content delivery network (jsDelivr / IMG.LY’s CDN) and your photo is processed on your device.
• Training. We do not ourselves use your photos or messages to train any AI model. Under Anthropic’s commercial terms for its API, customer inputs and outputs are not used by Anthropic to train its models. Anthropic may keep API inputs and outputs for a limited period for safety, abuse-prevention and legal purposes as set out in its own terms, so please do not upload anything you would not want a service provider to process.
• Accuracy. AI output can be wrong. It may misread a card, invent details or miss condition problems. You must check every listing before you publish it.
• No significant automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do use automated checks for abuse (for example rate limits and duplicate sign-up detection); if one wrongly blocks you, contact us and a person will review it.

Who we share data with

We do not sell personal data. We share it only with the service providers (“sub-processors”) that help us run Binder Blitz, and in the situations below. The full, current list, with what each receives and where, is on our Sub-processors page. In summary:

• Infrastructure: Supabase (database, sign-in, file storage) and Render (hosting).
• Payments: Stripe for cards and subscriptions; NOWPayments for crypto (they receive an order ID, amount and the on-chain payment data).
• AI: Anthropic, for card reading, theme creation and chat.
• Security and notifications: Cloudflare Turnstile (optional bot check at sign-up); Discord for internal operator alerts, which contain only an event type such as “new signup” and never your email or message; a transactional email provider (only if enabled).
• Assets and analytics: Google Fonts, flagcdn.com, jsDelivr and the Tailwind CDN (these receive your IP address when their files load) and Plausible Analytics (only if enabled).

We may also disclose data (a) if the law, a court or a regulator requires it; (b) to professional advisers, insurers and auditors under confidentiality; (c) to protect our rights, users or the public, for example against fraud; and (d) to a buyer or successor if the business is sold or restructured, in which case this policy will continue to apply to your data or you will be told of any change. If you connect your eBay account, we exchange data with eBay on your instructions.

International transfers

We are based in United Kingdom, but our providers may process data in other countries, including the United States. Where personal data from the UK, EEA or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards: the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and the EU Standard Contractual Clauses. Where a provider is certified under the EU-US Data Privacy Framework and its UK Extension (the “UK-US Data Bridge”), transfers to that provider may rely on it instead, and only where the provider is certified. You can ask us for a copy of the safeguards relevant to you (details commercially sensitive to our providers may be redacted) by contacting keironjwest@gmail.com.

If you live outside those regions, using Binder Blitz means your data will be processed in the countries where we and our providers operate. Section headings below explain how we handle cross-border disclosures under Australian, Canadian (including Quebec), New Zealand and Brazilian law.

How long we keep data

We keep personal data only as long as we need it for the purposes above, then delete or anonymise it. The specific periods are:

Backups held by our providers roll off on their own schedule and are not restored except for disaster recovery. If we are legally required to keep something longer (for example because of a dispute or tax enquiry) we will keep only what is needed.

How we protect your data

• All traffic to the service is encrypted with TLS.
• Passwords are hashed by Supabase Auth; we never see or store them in plain text after sign-up.
• Database and file storage are encrypted at rest by our providers, including the eBay tokens we hold for you.
• Access to production systems and API keys is limited to the operator on a least-privilege basis; secrets are kept in environment variables, not in code.
• Rate limiting protects sign-in, contact and AI endpoints.
• Files you upload are scanned for malware and images are re-encoded before being stored or served.
• Card data is handled only on Stripe’s hosted pages, never by us.

No system is perfectly secure. If a personal-data breach occurs that is likely to put people at risk, we will notify the relevant supervisory authority within 72 hours of becoming aware where the law requires it, and tell affected users without undue delay. To report a vulnerability, see our Security Policy.

Children

Binder Blitz is for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has given us personal data, contact keironjwest@gmail.com and we will delete it.

Your rights

Depending on where you live you have some or all of the rights below. We apply the core rights (access, correction, deletion, portability and objection) to everyone, wherever you are.

How to use your rights

• Yourself, in the app: sign in and open the Account page. “Download my data” gives you a JSON export of the data linked to your account. “Delete my account” deletes your account and the data we hold for it (subject to the retention exceptions above).
• By email: write to keironjwest@gmail.com from the email address on your account. Say which right you want to use.
• Verification: we may ask you to confirm you own the account before acting, so that we do not give your data to someone else. We will not ask for more than we need.
• Cost and timing: free of charge. We respond within one month (UK/EU), 45 days (California and most US states), 30 days (Canada, where applicable) and the periods set by local law elsewhere. We may extend by a further period where the law allows for complex or numerous requests and will tell you why.
• Cancelling marketing: use the unsubscribe link in any newsletter, or change your preference in your account.

UK, EEA and Switzerland

Under the UK GDPR, EU GDPR and Swiss law you have the right to: be informed (this policy); access your data; have inaccurate data corrected; have data erased; restrict processing; receive your data in a portable format; object to processing based on legitimate interests (and to direct marketing at any time); withdraw consent at any time; and not be subject to a decision based solely on automated processing with legal or similarly significant effects (we make none). You can complain to the UK Information Commissioner’s Office (ico.org.uk) or to the data protection authority in the country where you live, work or believe an infringement occurred. We would appreciate the chance to put things right first, so please contact us, but you do not have to.

California (CCPA/CPRA)

This section applies to California residents, to the extent the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) applies to us. In the past 12 months we have collected the following categories of personal information, from the sources and for the purposes described in the table above:

• We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes other than those the CCPA permits (providing the service, security and fraud prevention). We do not knowingly sell or share the personal information of anyone under 16 and the service is for adults only.
• We honour Global Privacy Control signals. See Your Privacy Choices.
• Your rights: to know what we collect, use and disclose; to delete; to correct; to opt out of sale or sharing (not applicable, because we do neither); to limit use of sensitive personal information (we do not use it beyond permitted purposes); and not to be discriminated against for using these rights.
• How to ask: use the Account page or email keironjwest@gmail.com. We will respond within 45 days, and may extend once by a further 45 days with notice.
• Authorised agents: you may use an agent. We will ask for written permission from you and may verify your identity directly.
• Shine the Light: California residents may ask which categories of personal information we disclosed to third parties for their direct marketing purposes. We make no such disclosures.

Other US states

Residents of states with comprehensive privacy laws (for example Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana, and other states as their laws take effect) may have the right to confirm whether we process their data and access it, correct inaccuracies, delete it, obtain a portable copy, and opt out of targeted advertising, the sale of personal data and profiling with legal or similarly significant effects. We do none of the latter three. We will treat a request from any resident of those states as valid where the law applies to us, and as a courtesy where it does not.

Appeals: if we decline your request you may appeal by replying to our decision, or emailing keironjwest@gmail.com with the subject “Appeal”. We will respond in writing within the period your state requires (generally 45 to 60 days) and explain the outcome. If you are unhappy with the result you may contact your state Attorney General.

Canada (PIPEDA and Quebec Law 25)

If you are in Canada, you may ask for access to the personal information we hold about you, ask us to correct it, withdraw consent (subject to legal or contractual restrictions) and challenge our compliance. Our privacy contact, keironjwest@gmail.com, also acts as the person in charge of the protection of personal information for Quebec purposes. Your information may be stored and processed outside your province or Canada, including in the United States, by the providers listed on our Sub-processors page; where required for Quebec residents we assess the risks of such transfers and rely on contractual protections. We send marketing emails only with consent and you can withdraw it at any time. You may complain to the Office of the Privacy Commissioner of Canada or, for Quebec residents, the Commission d’accès à l’information du Québec.

Australia

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), even where we are not strictly required to. You may ask for access to, and correction of, your personal information (see the section on how to use your rights). Under APP 8, personal information may be disclosed to overseas recipients, mainly in the United States, being the providers on our Sub-processors page; we take reasonable steps to make sure they handle it consistently with the APPs, generally through contractual terms. If you have a complaint, contact keironjwest@gmail.com first; if you are not satisfied you can complain to the Office of the Australian Information Commissioner (OAIC).

New Zealand

We handle personal information in accordance with the information privacy principles in the Privacy Act 2020, including principles on access and correction and on disclosure outside New Zealand (we only disclose to overseas providers that are subject to comparable safeguards or bound by contract). You can ask for access and correction as described above. If you are unhappy with our response you can complain to the Office of the Privacy Commissioner.

Brazil (LGPD)

Under Brazil’s General Data Protection Law (LGPD), you may ask us to confirm that we process your data; give you access; correct incomplete, inaccurate or out-of-date data; anonymise, block or delete unnecessary or excessive data or data processed unlawfully; provide portability; delete data processed with your consent; tell you with whom we have shared data; explain the consequences of refusing consent; and revoke consent. Our legal bases are the ones described in the table above: performance of a contract, compliance with legal obligations, legitimate interests and consent. Contact keironjwest@gmail.com, which is our point of contact for data subjects and for the Autoridade Nacional de Proteção de Dados (ANPD) (the role of “encarregado”). International transfers are made as described in the International transfers section, using the mechanisms the LGPD allows. You can complain to the ANPD.

Other regions

If you are in Singapore (PDPA), South Africa (POPIA), Japan (APPI), South Korea (PIPA), India (Digital Personal Data Protection Act 2023), the United Arab Emirates, Saudi Arabia (PDPL) or elsewhere, we apply the same core rights and will honour requests as required by your local law. Contact keironjwest@gmail.com and tell us where you live so we can apply the right rules.

Cookies and similar technologies

We use no advertising or cross-site tracking cookies. We store a small number of items on your device to keep you signed in and remember your settings and choices. See the Cookie Policy for the full list, and how to change your choices. We honour Global Privacy Control signals.

Marketing and the newsletter

We send marketing email only if you opt in (for example by ticking a box or subscribing to the newsletter). We record your email and the time you consented. Every email has an unsubscribe link, and you can also email keironjwest@gmail.com. You will still receive essential service messages, such as receipts, security notices and changes to your plan or our terms.

Changes to this policy

We update this policy when our practices or the law change. The date and version at the top of the page show the latest revision. For material changes we will give at least 30 days’ notice by email or in the app before they take effect, unless a change is needed sooner to comply with the law. Earlier versions are available on request.

Contact and complaints

Questions, requests and complaints about privacy: keironjwest@gmail.com. General support: keironjwest@gmail.com.

• Name: Binder Blitz, trading as Binder Blitz
• Address: 3 Iyshas Terrace, Banner Lane, Newport, Isle of Wight, PO30 5GE
• Country of establishment: United Kingdom
• Email: keironjwest@gmail.com
• Privacy and data requests: keironjwest@gmail.com