Privacy Policy

Note: this policy is a template and must be legally reviewed and completed with the [PLACEHOLDER: …] (controller) information before going live.

1. Controller

Responsible for data processing on this website is: [PLACEHOLDER: First and last name / company name], [PLACEHOLDER: Street and house number], [PLACEHOLDER: Postal code and city], Email: support@lumex-tcg.de

2. What data we process

Account & collection: When you register, we process your email address and a (hashed) password. After signing in, we process the collection, deck, and wishlist data you enter in order to provide you the service (Art. 6(1)(b) GDPR — contract performance).

Server logs: When you access the site, technically necessary data (IP address, timestamp, user agent) is processed by our hosting provider (Art. 6(1)(f) GDPR — legitimate interest in operation and security).

3. Processors / hosting

Vercel: The web app is hosted via Vercel. A data processing agreement is in place with Vercel.

Vercel Analytics & Speed Insights: In addition to hosting, we use Vercel Analytics and Speed Insights for anonymized, cookieless evaluation of page views and load times (Art. 6(1)(f) GDPR — legitimate interest in operating and improving the service). No cookies are set and no personal profiles are built.

Upstash: For rate limiting on certain API routes (including Archidekt import, tournament calculator), we use Upstash Redis; your IP address is processed briefly to prevent abuse (Art. 6(1)(f) GDPR — legitimate interest in abuse prevention). A data processing agreement is in place with Upstash.

Supabase: Authentication and database run via Supabase (EU region, eu-west-1). Your collection and account data is stored there. Access is restricted to your own account via row-level security.

4. Cookies

We use exclusively technically necessary cookies to manage your login session. There is no tracking and no advertising.

5. Retention period

Your account data and collection contents are stored until you delete your account. On request to support@lumex-tcg.de, we delete your account along with the associated data.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection (Art. 15–21 GDPR), as well as the right to lodge a complaint with a supervisory authority. Contact support@lumex-tcg.de for this.

7. External card content

Card images are loaded from third-party providers (including the Scryfall CDN and pokemontcg.io). Your IP address may be transmitted to these providers in the process (Art. 6(1)(f) GDPR).

8. External content in the app (news feed)

The news feed in the Lumex app primarily fetches RSS feeds via the third-party service rss2json.com as a JSON proxy, to work around Cloudflare/CORS restrictions on direct RSS fetches from mobile devices (only if that fails does it fall back to a direct RSS/Atom fetch). In doing so, the fetched feed URL and your IP address are transmitted to rss2json.com (Art. 6(1)(f) GDPR — legitimate interest in a reliable news feed).