Privacy Notice

Poplex Technologies LLC — A Wyoming Limited Liability Company, United States ("Poplex," "we," "us") operates the Poplex website, API and related account services. This notice explains how we handle personal information associated with those Services. Our public contact location is Sheridan, Wyoming, United States; it is not a postal delivery address. Send privacy questions or requests to support@poplextcg.com with the subject "Privacy request."

The Services are offered to US businesses and developers. Information about an employee, developer or sole proprietor can still be personal information. We do not treat a business account as an exemption from applicable privacy law.

1. Information we handle and its sources

Account and organization information comes from you, your organization's authorized administrator and our account service providers. It can include your name, business name, contact email, account or organization identifier, role, authentication records, preferences, plan, and the version and time of an agreement you accept. Passwords and authentication secrets require special protection; do not send them to support.

API credential records include a key identifier, hash, short display prefix, organization association, status and creation, expiration or revocation times. Keys should be treated as confidential credentials. Our key verification design uses a hash rather than keeping a retrievable copy of the issued key in the key record. Avoid putting a key in a URL or support message, because doing so can expose it to other systems.

Usage and technical information is generated when you use the Services. It can include request counts, organization and key identifiers, timestamps, requested resource identifiers, response status, request identifiers and timing. Hosting and security providers receive connection information such as IP address, device or browser details, and network events. Application logs may be sampled. Some infrastructure logs may contain a full URL and its query even where our application log records only the path. Do not put personal or sensitive information into search queries or URLs.

Payment and billing information comes from you and Stripe when a payment feature is used. It can include billing contact and address, tax information, payment or customer identifiers, transaction amounts, currency, subscription status, invoices, refunds and disputes. Stripe handles payment credentials and performs its own payment, security and legal functions. Our operational billing records are intended to use only necessary identifiers, amounts, statuses and timestamps. Financial and support records may contain additional personal information needed to resolve a transaction or satisfy legal duties. Do not send payment card numbers or security codes to Poplex.

Support information includes your messages, attachments and the information needed to resolve a request. Rights complaints may include a rights owner's or representative's name, contact details, signature and claim evidence. We may receive corrections or publicly available professional credits, such as illustrator names, from catalog sources. Those credits are distinct from customer account data.

Issue reports sent through the form on our website include the e-mail address you enter, your message and an optional request or card identifier. Sending a report is voluntary. Only Poplex administrators can read reports, and they are stored with our hosting provider (section 3). Instead of your IP address and browser details we store keyed hashes of them, only to limit abuse of the form. We use a report to answer you and fix the problem; we do not use it for marketing. We keep it as support correspondence (section 5) and delete a closed report within 24 months after it was closed. To ask for access to, correction of or deletion of a report, write to support@poplextcg.com (section 6). Do not put keys, passwords or private personal information in a report.

We do not ask for sensitive personal information, children's information or your end users' personal data through the public catalog API. A future scanning, image-upload or end-user data processing feature will need appropriate disclosure before it is offered; this notice does not describe such a feature as currently operating.

2. How and why we use information

We use account and contact information to administer access, verify authority, authenticate users and keys, communicate service notices and provide support. We use request counts and payment information to apply allowances, manage subscriptions, detect billing mistakes and process refunds. Technical and security information helps diagnose failures, maintain reliability, investigate abuse, prevent fraud and protect other users. Agreement and financial records help us meet legal duties and establish or defend legal claims. Public professional credits identify contributors to the catalog accurately.

We do not sell personal information, rent customer contact lists, use API activity for targeted advertising or share personal information for cross-context behavioral advertising. We do not use your support attachments to train a general-purpose AI model. We do not enable advertising or optional analytics merely by publishing this notice. Any future materially different purpose requires appropriate prior notice and, where required, consent.

Where a law requires a legal basis for processing, we rely on performance of a contract for individual customers or steps they request before a contract; legitimate interests for business contact administration, security, support and proportionate service improvement, subject to applicable balancing requirements; legal obligations for required records and disclosures; and consent where required for optional activities. We do not rely on a general acceptance of these Terms as consent for every kind of processing. These explanations do not assert that the Services are offered in every jurisdiction.

3. Recipients and service providers

We disclose information only as reasonably needed for the purposes in this notice. Providers supporting the Services include Cloudflare for hosting, delivery, security, operational databases and logs; Supabase for catalog infrastructure and account or authentication functions where used; Stripe for payments and related tax and fraud functions when payments are enabled; Hostinger for support email; and Resend for transactional notifications where used. The information each receives depends on the feature used. A catalog database is not a reason to send it every customer's payment information.

We use contractual and access restrictions appropriate to the provider's role. Some providers, particularly payment services, also process information for their own legal obligations and under their own privacy notices. Our lawyers, accountants and other professional advisers may receive information needed for their work under appropriate confidentiality duties. An organization administrator may see account, key and usage information for that organization; do not use a work account to send information you intend to keep private from your organization.

We may disclose information when legally required, to respond to a binding order, protect rights or safety, investigate abuse, or establish a legal claim. We assess a request's scope and authority and limit disclosure where appropriate. We may share the relevant part of a rights complaint with the affected party or advisers to investigate it, excluding unnecessary contact details where practicable. A merger or business transfer may involve confidential diligence and transfer of relevant records, subject to this notice and applicable law. We do not promise to withhold information when a lawful disclosure is required.

4. Location and transfers

Poplex is a US company. Information may be processed in the United States and other locations where our providers operate; we do not promise US-only storage or processing. Where applicable law requires a transfer mechanism or additional safeguards, we must put those in place before the relevant transfer. Contact us for information about the arrangements relevant to your account. This statement is not a claim that a specific certification or transfer mechanism applies to every provider or data flow.

5. Retention and deletion

We apply the following retention schedule, subject to a documented legal hold or a specific legal duty requiring longer retention. A legal hold is limited to relevant records, restricted in access and reviewed when the matter ends. We may retain statistics that have been irreversibly deidentified so they cannot reasonably be linked back to a person or organization.

Active account contact and profile information is retained while the account is open. After a verified account closure or deletion request, we delete or deidentify ordinary account information within 30 days, except for the limited records below. Removing an individual user from an organization does not delete records the organization is legally entitled or required to retain.

Revoked or expired API key hashes, display prefixes and related security metadata are kept for up to 90 days after revocation or expiry, then deleted or deidentified unless needed for an active security investigation. Monthly usage and billing-reconciliation counters are kept for up to 13 months after the end of the relevant usage month. Ordinary application and infrastructure request logs are kept for up to 7 days after collection. A limited extract needed for a security incident may be retained until 90 days after the incident closes, unless a legal hold applies.

Ordinary support correspondence is retained for up to 24 months after resolution. A rights complaint, formal legal notice or material security complaint may instead become a restricted legal or incident record. Necessary transaction, tax, refund and dispute records are kept for 7 years after the end of the financial year to which they relate, or longer when a specific law or unresolved proceeding requires it. We retain only the information reasonably needed for that purpose, rather than treating every historical payment-provider payload as a permanent record.

Minimal evidence of contractual acceptance and material legal notices is kept for up to 10 years after the account closes, limited to what is reasonably needed to establish the agreement or resolve a claim. That is a company retention period, not a statement that every law requires it. Account deletion does not invalidate an agreement already made or erase a legally required financial record.

Deleted information may remain in restricted backup copies for up to 30 days before expiry. We do not use backup copies to continue ordinary processing of deleted information. If a backup is restored, applicable deletion instructions must be reapplied. Provider records held independently for a provider's own legal duties follow that provider's applicable retention obligations; they are not additional active Poplex copies available for general use.

6. Requests and choices

Email support@poplextcg.com to request access, correction, deletion or a portable copy of information associated with you, or to ask about an applicable objection, restriction, consent withdrawal, opt-out or appeal right. Tell us the account and the type of request. We verify identity and authority proportionately and do not ask for a government ID by default. Authorized agents may act where law permits and with appropriate evidence of authority. We do not charge for an ordinary request; an exception must be permitted by law and explained beforehand.

We acknowledge requests within 10 business days and respond to verified requests within 30 calendar days where practicable and no later than the applicable legal deadline. Where law allows an extension, we explain the reason and timing within the original period. If we deny all or part of a request, we explain the basis and how to appeal by replying with "Privacy appeal." We decide an appeal within 45 calendar days or the shorter period required by law and provide information about an appropriate regulator or complaint route where required. We do not retaliate for exercising a privacy right.

Some records cannot be deleted immediately because they are required for security, a transaction, a legal obligation or another person's rights. We explain relevant exceptions rather than claiming deletion is unconditional. If your organization controls the account, we may refer an employment or organization-record request to its administrator while handling our own duties directly. You can ask to stop optional promotional communications without losing necessary security, billing or service notices. Withdrawal of consent does not undo lawful processing that occurred before withdrawal.

7. Cookies and similar technologies

The public informational website does not use advertising cookies or optional behavioral analytics. Account, authentication and hosting features may use cookies or similar storage necessary for security, session management or functionality. Providers can also receive IP and connection information without a cookie. You can manage browser storage through your browser, but blocking essential storage may affect account functions. We will explain and obtain any legally required consent before adding optional tracking. Because we do not sell or share information for targeted advertising, an opt-out preference signal does not need to stop such a practice; we honor signals and other choices to the extent applicable law requires.

8. Security, children and changes

We use safeguards designed to match the information involved, including hashed API key verification, access restrictions and reputable infrastructure providers. No service is completely secure. Report a suspected compromise to support@poplextcg.com without sending secrets. We assess incidents and provide notifications required by applicable law; this notice does not replace or narrow a mandatory notification deadline.

Our accounts are for adults with legal capacity as described in the Terms and Conditions. We do not knowingly collect personal information from children under 13. If you believe a child has provided it, contact us so we can investigate and remove it as required. Requiring adult account holders does not alone establish compliance with every children's privacy law.

We publish an updated version when this notice changes. For a material change affecting account users, we give advance notice by account email or another direct method where practicable, and obtain consent where law requires it. Contact support@poplextcg.com for privacy questions, to exercise rights or to request an explanation of a specific practice.