Privacy Policy

Linking Lotus Ltd ("us", "we", or "our") operates the DeckHunter mobile application (the "App"). This Privacy Policy informs you of our policies regarding the collection, use, and disclosure of personal data when you use our App and the choices you have associated with that data.

We use your data to provide and improve the App. By using the App, you agree to the collection and use of information in accordance with this policy. Unless otherwise defined in this Privacy Policy, terms used in this Privacy Policy have the same meanings as in our Terms and Conditions.

1. Data Controller

Linking Lotus Ltd, an Irish registered company, is the data controller for the personal data collected through the DeckHunter App.

Our contact email for privacy concerns is: Support@deckhunter.app

2. Information We Collect

We collect several different types of information for various purposes to provide and improve our App to you.

2.1. Personal Data Provided Directly by Users

When you create an account or use certain features of the App, you provide us with:

• Account Information
  • Email Address. Used for account verification, password resets, and essential communications.
  • Username. Your chosen identifier within the App.
  • Password. Stored securely (encrypted). We do not have access to your raw password.
• Optional Profile Information (for Trade Features). If you choose to use the trade binder feature, you have the option to provide your Instagram handle, Discord handle, and general area (Country, County/State, City). This optional profile information will be publicly visible to other DeckHunter users when you list cards in your trade binder, for the purpose of facilitating contact outside the App. You control whether to provide this information.
• Customer Support Information. If you contact our support team at Support@deckhunter.app, we collect your email address, username, and the details of your query to respond to your request.
• Subscription Status. We receive information from Apple App Store and Google Play Store regarding your subscription status to grant you access to premium features. We do not receive your payment details.

2.2. Data Collected Automatically (Anonymised / Pseudonymous)

• Firebase Crashlytics Data. Anonymised crash reports and app performance data, including app version, OS version, unique installation UUIDs (pseudonymous), and crash traces. This data helps us identify and fix bugs.
• Camera & On-Device Processing. The App includes a card scanning feature that uses your device's camera to identify physical trading cards. When you use this feature, the camera image is processed entirely on your device using embedded machine-learning models (TFLite and Google ML Kit). No photos, images, or camera data are stored, saved to your photo library, or transmitted to any server. The camera frame exists only in temporary memory during processing and is immediately discarded.
• No Other Automated Data Collection. We do not collect device identifiers, photos or camera data, precise usage data beyond crash reports, location data (other than your user-inputted area), cookies, or advertising identifiers.

2.3. Information from Third Parties

• App Stores (Apple / Google). We receive subscription status information from them. They handle your payment data directly and do not share it with us.
• TCGplayer / Cardmarket / CardTrader. We only receive card pricing data from these services; no personal data about users is shared with us from these sources.

3. Purpose of Data Collection and Legal Basis for Processing (GDPR)

We process your personal data for the following purposes, relying on the specified legal bases under GDPR:

4. Data Sharing and Disclosure

• With Your Consent. For the optional Instagram / Discord handle and Area, you explicitly consent to this information being publicly visible to other DeckHunter users when you use the trade binder feature.
• With Third-Party Service Providers. We use third-party providers to facilitate our App.
  • Google Cloud Platform. Your primary account data is hosted and processed on Google Cloud Platform servers.
  • Firebase Crashlytics. Anonymised crash reports and app performance data.
• App Stores (Apple / Google). They process subscription payments. We receive only subscription status from them.
• Legal Requirements. We may disclose your Personal Data in the good-faith belief that such action is necessary to comply with a legal obligation, protect our rights, prevent wrongdoing, or protect personal safety.
• Business Transfers. In the event of a merger, acquisition, or sale of assets, your Personal Data may be transferred.
• No Sale of Personal Data. We do not sell your personal data to any third parties.

5. Data Retention

• Account Data. Retained for as long as your account is active. Once you initiate account deletion, all associated personal data in your user collection in Firebase will be irreversibly destroyed as soon as technically feasible (typically within 24-48 hours).
• Subscription Data. Retained for the duration of your subscription and up to 3 years after cancellation for auditing and billing reconciliation.
• Customer Support Communications. Retained for up to 2 years after resolution.
• Legal Obligations. We may retain certain data for longer periods if required by law.

6. Data Security

The security of your data is important to us. We rely on the security measures provided by Google Cloud Platform and Firebase to protect your Personal Data: encryption in transit and at rest, strict access controls, and regular security audits.

Data Breach Response. In the unlikely event of a data breach, we will notify the Irish Data Protection Commission (DPC) within 72 hours where required by GDPR, and inform affected users without undue delay if the breach poses a high risk to their rights and freedoms.

7. International Data Transfers (GDPR)

As Linking Lotus Ltd is based in Ireland, any transfer of your Personal Data outside the European Economic Area (EEA) is subject to GDPR rules. We rely on Standard Contractual Clauses (SCCs) and other appropriate safeguards implemented by Google, acting as our data processor.

8. Your Data Protection Rights Under GDPR

• The Right to Access. Request copies of your personal data.
• The Right to Rectification. Request that we correct any inaccurate information.
• The Right to Erasure. Request that we erase your personal data, under certain conditions. You can exercise this right for your core account data using the in-app deletion feature.
• The Right to Restrict Processing. Request that we restrict the processing of your personal data, under certain conditions.
• The Right to Data Portability. Request that we transfer your data to another organisation, or directly to you, in a structured, machine-readable format.
• The Right to Object to Processing. Object to our processing of your personal data, under certain conditions.

9. Children's Privacy

Our App is not directed to individuals under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If you become aware that your child has provided us with Personal Data, please contact us at Support@deckhunter.app.

10. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and, where appropriate, an in-app notification, and update the "Last Updated" date.

11. Contact Information for Privacy Concerns

If you have any questions about this Privacy Policy or wish to exercise any of your data protection rights, please contact us by email at Support@deckhunter.app.

Right to Lodge a Complaint with a Supervisory Authority. You also have the right to lodge a complaint with the Data Protection Commission (DPC), the supervisory authority in Ireland:

• Website: www.dataprotection.ie
• Address: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
• Email: info@dataprotection.ie