Privacy Policy
What we collect, why we collect it, who else sees it, and how to make us delete it. We do not sell customer data to anybody, for any purpose.
What we collect
- When you order
- Your name, email address, delivery address, phone number, and what you bought.
- When you contact us
- Your name, email address, and whatever you put in the message.
- Automatically
- IP address, browser and device type, the pages you viewed, and where you arrived from. Used to understand how the site is used and to detect fraud.
- Never
- Your full card number, expiry date or security code. Those go to our payment provider directly and never reach our servers.
Why we hold it
- To take payment, ship your order, and email you about it. Without this we cannot sell you anything.
- To answer your messages.
- To meet tax and accounting obligations, which require us to keep transaction records for a set number of years.
- To detect and prevent fraud and abuse of allocation limits.
- To understand how the site is used in aggregate, so we can improve it.
Who we share it with
- Our payment provider, to take payment. They receive your card details directly; we receive only a confirmation and the last four digits.
- Carriers (USPS, UPS, Royal Mail, DHL, FedEx and others depending on destination), who need your name and address to deliver the parcel.
- Analytics providers, which currently means Microsoft Clarity, and Meta where advertising is running. These see usage data, not your order details. The Cookie Policy explains this in more detail.
- Legal authorities, where we are legally required to disclose something.
We do not sell, rent or trade personal data. There is no circumstance in which we would.
How long we keep it
- Order records
- Kept for as long as tax and accounting law requires, then deleted.
- Contact messages
- Kept for two years, so we have the history if you write again about the same problem.
- Analytics data
- Kept in aggregate. Individual session records expire according to the provider's own retention settings.
Your rights
Wherever you live, we will honour these. You do not need to be in a particular jurisdiction to ask.
- Ask for a copy of what we hold about you.
- Ask us to correct anything wrong.
- Ask us to delete it, except where we are legally required to keep a transaction record.
- Ask us to stop using it for marketing. Every marketing email has an unsubscribe link that works immediately.
- Object to processing, or ask for your data in a portable format.
Email privacy@zypheratcg.com and we will respond within 30 days, usually much sooner. We will not ask you why.
Security
- The whole site, including checkout, is served over HTTPS.
- Card details never reach our servers, so there is nothing there to be stolen.
- Administrative access requires two-factor authentication.
- We keep the data we need and delete what we do not. The most reliable protection for a piece of data is not holding it.
Children
This site is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has given us personal information, email us and we will delete it.
Changes
If we change this policy in a way that materially affects you, we will say so on this page rather than quietly editing it.
Contact
Privacy questions: privacy@zypheratcg.com. Anything else: support@zypheratcg.com.