Privacy Policy

VaultMKT LLC ("VaultMKT," "we," "us," or "our") operates a trading card marketplace with buyer accounts, seller accounts, listings, saved drafts, carts, offers, checkout, payments, seller subscriptions, seller verification, shipping labels, tracking, returns, disputes, messaging, notifications, packaging evidence, dispute evidence, and admin review tools.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use the Service. It applies to visitors, buyers, sellers, admins, and other users of VaultMKT. Our Terms of Service explain the marketplace rules that apply to your use of the Service.

Account and profile information. We collect account identifiers such as email address, username, display name, profile image, account role, password hash, email verification status, password reset tokens, suspension status, account settings, and profile content.

Seller verification and payout information. Sellers may provide information to Stripe Connect and Stripe Identity, including identity, business, tax, payout, bank, and verification information. VaultMKT receives and stores limited verification and payout status metadata, such as Stripe account IDs, verification session IDs, verification report IDs, KYC status, failure or requires-input reason, and timestamps. VaultMKT does not need to store full government ID document images to operate the current verification flow unless a provider, support, legal, or compliance process separately requires it.

Listings, drafts, catalog, and market activity. We collect listing titles, descriptions, category, game, sport, set, card number, condition, grade, grading company, certification number, quantity, price per item, images, package dimensions, shipping selections, return setting, drafts, product lookup selections, market data queries, listing edits, deactivation reasons, views, favorites, saved searches, offers, reviews, and related seller dashboard data.

Orders, checkout, payment, and tax records. We collect cart items, checkout groups, accepted offer pricing, order IDs, order line items, quantities, item subtotal, shipping amount, Buyer Protection Fee, seller fees, sales tax amount, seller payout allocation, VaultMKT revenue amount, Stripe PaymentIntent IDs, Stripe Checkout Session IDs where used, payment status, refund status, transfer IDs, subscription IDs, invoice events, and tax calculation data. VaultMKT does not store full card numbers, card security codes, or full bank account numbers.

Shipping, addresses, and contact information. We collect buyer Shipping To addresses, saved default shipping addresses, seller Shipping From addresses, recipient name, email address, phone number, street address, city, state, ZIP code, country, address validation status, normalized or suggested address data, address change history, carrier, service, tracking number, tracking events, label URLs, label cost, package dimensions, insurance selection, signature selection, and return label information.

Messages, notifications, support, returns, and disputes. We collect messages, notifications, support requests, return requests, return reasons, seller responses, dispute reasons, dispute descriptions, admin notes, moderation records, audit logs, account enforcement records, and communications with VaultMKT.

Photos, video, and uploaded evidence. We collect listing photos, profile images, seller packaging videos recorded through the in-app recorder, dispute evidence photos or videos, file names, content types, size metadata, S3 object keys, signed upload/download URL activity, recording duration, and evidence review status.

Device, browser, session, and security data. We collect IP address, user agent, device and browser information, pages or routes visited, request metadata, authentication tokens, cookies, local storage values, server logs, rate-limit logs, CORS/security origin checks, API errors, crash reports, performance diagnostics, and similar technical information.

We collect information directly from you, automatically from your browser or device, from your transactions and platform activity, from other users involved in your transactions, from admins and support workflows, and from service providers such as Stripe, Shippo, carriers, AWS, Sentry, Algolia, Supabase, email providers, and product or market data providers.

We use personal information to:

• Create, secure, verify, maintain, and support accounts.
• Operate listings, drafts, offers, carts, checkout, payments, subscriptions, taxes, refunds, seller payouts, and fee accounting.
• Validate addresses, calculate tax, buy labels, show tracking, support returns, and manage delivery address edits.
• Send account, order, sale, offer, return, dispute, shipping, subscription, security, policy, support, and notification messages.
• Prevent fraud, abuse, off-platform fee avoidance, unauthorized access, chargeback abuse, counterfeit activity, security incidents, and violations of our Terms.
• Review disputes, packaging evidence, uploaded dispute evidence, messages, tracking, order history, address changes, payment status, and admin actions.
• Provide marketplace search, saved search alerts, seller analytics, trust score displays, product lookup, pricing references, and dashboard functionality.
• Comply with tax, accounting, payment, shipping, identity, fraud prevention, legal, law enforcement, and regulatory obligations.
• Debug, monitor, test, secure, improve, and develop the Service.

We do not sell your personal information for money and do not use it for cross-context behavioral advertising.

We do not use sensitive personal information to infer characteristics about you beyond what is reasonably necessary for account security, identity verification, payment, tax, shipping, fraud prevention, legal compliance, and marketplace operation.

With other marketplace users. Public listings, listing photos, public seller profile details, seller verification badges, trust score, review content, and other public marketplace information may be visible to users and visitors. Buyers and sellers receive order information needed for the transaction. Sellers may see buyer shipping information needed for fulfillment and labels. Buyers may see seller profile, shipping, tracking, label, return, and dispute information needed for the order. Normal order pages are designed not to display unnecessary email or phone information, but contact information may be used server-side for fulfillment, payment, tax, fraud, support, and carrier requirements.

With service providers. We share information with providers that process payments, taxes, payouts, identity checks, shipping labels, address validation, tracking, storage, hosting, analytics, search, email, product lookup, market data, error monitoring, and security services for VaultMKT. Service providers are expected to use information only for VaultMKT's operational purposes or their own legal and security obligations, not for their independent advertising.

For disputes, returns, support, and enforcement. Evidence, order records, tracking information, messages, return records, dispute evidence, address changes, and payment data may be shared with the buyer, seller, admin users, payment processors, shipping providers, insurers, legal advisors, or other appropriate parties when needed to resolve a transaction, comply with law, or protect users.

For legal, safety, and business reasons. We may disclose information to comply with legal process, tax or regulatory obligations, law enforcement requests, payment processor rules, carrier requirements, fraud prevention, chargeback responses, rights enforcement, security investigations, corporate transactions, financing, merger, acquisition, reorganization, bankruptcy, or sale of assets.

With consent. We may share information in other ways when you direct us to or consent.

Providers process information under their own terms and privacy policies. The exact provider set may change as VaultMKT adds, removes, or reconfigures operational services.

VaultMKT uses cookies, local storage, and similar browser storage for necessary account and platform functionality. This may include authentication cookies such as vault_auth and vault_token, local storage values such as vaultmkt_user, checkout state, listing draft state, post-verification intent state, preferences, and signed access-gate cookies where configured.

These technologies keep you logged in, route you to the correct dashboard, preserve draft or checkout progress, support security checks, and operate the marketplace. Clearing cookies or browser storage may log you out, remove local draft state, or require you to restart checkout.

We do not use third-party advertising cookies for cross-context behavioral advertising. Error monitoring and operational analytics may collect technical information to diagnose and improve the Service.

VaultMKT uses administrative, technical, and organizational safeguards designed to protect personal information, including password hashing, authentication tokens, rate limiting, origin checks for cookie-authenticated state changes, role and ownership checks, signed upload and download URLs, provider-managed infrastructure controls, security headers, logging, and restricted internal access.

No internet service can guarantee perfect security. You are responsible for protecting your credentials and notifying us promptly at security@vaultmkt.com if you suspect unauthorized access.

We retain personal information for as long as reasonably necessary to provide the Service, maintain accounts, complete transactions, resolve returns and disputes, process refunds and chargebacks, support seller payouts, maintain tax and accounting records, detect fraud, enforce our Terms, protect security, comply with legal obligations, and operate backups and audit logs.

Some information is retained longer than ordinary account data because it is tied to marketplace integrity, payment reconciliation, tax records, dispute evidence, shipping records, packaging evidence, account enforcement, fraud prevention, or legal compliance. This may include orders, payments, transfers, refunds, tax amounts, tracking, evidence, disputes, messages tied to orders, return records, address change history, and admin audit logs.

If you request account deletion, deletion may be blocked while active orders are in progress. When deletion is available, VaultMKT may anonymize the user account and remove or delete user-owned notifications, favorites, saved searches, messages, cart items, and similar data while retaining transaction records needed for legal, tax, fraud, accounting, support, and dispute purposes.

Depending on your location, you may have the right to request access to personal information, correction, deletion, portability, restriction, objection, withdrawal of consent, opt-out of certain sharing or targeted advertising, or other privacy rights. You can edit certain profile and address information in account settings, use available export or deletion tools, or contact us.

To exercise rights, email privacy@vaultmkt.com. We may verify your identity and account ownership before responding. We may deny or limit requests where permitted by law, including where information must be retained for transactions, fraud prevention, dispute resolution, security, tax, accounting, legal, or payment processor obligations.

Authorized agents may submit requests where applicable law allows, but we may require proof of authorization and may still ask you to verify account ownership directly. We do not discriminate against users for exercising privacy rights, but some retained transaction, fraud, tax, evidence, dispute, or compliance records may remain unavailable for deletion while legal or operational retention applies.

If a U.S. state privacy law applies to VaultMKT and your personal information, this section provides additional notice. We collect categories of personal information that may include identifiers, account credentials, commercial information, payment and transaction metadata, internet or network activity, geolocation inferred from IP or address data, audio/visual content such as photos and videos, sensitive information such as account credentials and identity verification metadata, and inferences used for fraud prevention, trust, safety, or marketplace functionality.

We use those categories for the purposes described in this Policy and disclose them to the categories of recipients described above, including other users as needed for transactions, service providers, payment processors, shipping providers, tax providers, fraud prevention providers, legal or compliance recipients, and business transaction recipients.

We do not sell personal information for money and do not share personal information for cross-context behavioral advertising. We use sensitive personal information only for purposes such as account security, identity verification, payment, tax, shipping, fraud prevention, legal compliance, and marketplace operation.

California residents may request to know, access, delete, correct, opt out of sale or sharing, limit certain sensitive personal information uses, and exercise rights without discrimination where applicable. We honor legally required opt-out preference signals where the law requires and the signal applies to our practices.

VaultMKT is not directed to children under 18 and is not intended for children under 13. We do not knowingly collect personal information online from children under 13. If you believe a child has provided personal information to VaultMKT, contact privacy@vaultmkt.com.

VaultMKT is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored in, and processed in the United States and other countries where our providers operate.

Where European, United Kingdom, Swiss, or similar privacy laws apply, our legal bases may include performing a contract with you, complying with legal obligations, legitimate interests in operating and securing the marketplace, protecting users and preventing fraud, and consent where required.

We may update this Privacy Policy from time to time. Material changes will be posted in the Service or sent by email where appropriate. Continued use of VaultMKT after the effective date means the updated Policy applies.