Privacy Policy

1. Who we are

Regolith LLC ("we", "us") operates ListFlow, a seller-side tool for creating and managing trading card listings on eBay. This policy explains what we collect, why, and what we do with it.

2. What we collect

Account information. Your email address and authentication details. Sign-in is handled by our authentication provider (Supabase), and we do not store your password. We also keep a copy of your email address in our own records so we can show which person listed or pulled a card, and so we can reply when you report a problem.

eBay authorization. An OAuth access token for the eBay seller account you connect. We never receive or store your eBay password. Tokens are encrypted at rest.

Listing and inventory data. Card photographs you upload, item details, item specifics, prices, SKUs, eBay listing identifiers, box and position records, and records of which user listed or pulled which card.

eBay marketplace data. Listing information retrieved from eBay's APIs to help build your drafts, including item details used to prefill item specifics. Search results are cached for up to 24 hours and item details for up to 7 days, solely to avoid repeated calls to eBay; expired entries are purged nightly.

Order information. When you view your orders page, we retrieve order details from eBay, which include buyer name, email, and shipping address. This is held only in temporary memory for approximately 60 seconds and is never written to disk, never logged, and never exported.

Operational logs. Technical logs for reliability and security. They can contain your user or account identifier and identifiers for your batches and photographs, which is how we trace a problem back to the right place. They are written to exclude names, email addresses, buyer details and payment details.

Problem reports. If you report a problem from inside the Service, we keep what you send us — your description, the page you were on, and the card and photo involved — so we can look into it and reply.

Card-identification records. Each time the automated system reads a card we keep a record of which photographs it looked at, what it read from them, and what the finished listing said. This is what the review pages show you when you check a box of cards later, and it is how we find out where the system went wrong.

Your agreement to these documents. When you accept these Terms and this Privacy Policy we record your user account, which document you accepted, its version, and the date and time. We do not record your IP address or device details. If we later publish a material update we ask you to accept again, and the earlier record is kept so it stays clear what you agreed to at the time.

Automated card identification. Photographs you upload are processed automatically to identify the card and pre-fill listing details. Where that happens depends on what you are listing:

• Sports mass uploads are identified on our own self-hosted systems inside our private network. No third party sees those images.
• Single-card listings, and Pokemon and Yu-Gi-Oh mass uploads, are sent to OpenAI for identification.
• Sports mass uploads fall back to OpenAI only if our own system is unavailable at that moment.
• The Scan Unsorted Cards tool — card scanning used for sorting and search, which is a separate feature from Pokemon mass uploads — is identified entirely on our own self-hosted systems inside our private network.

Images sent to OpenAI are sent for identification only. Separately, we keep your card photographs, the final corrected card details, and whether the card sold, and we use them to train our own card-identification system so that it gets better at recognising cards. That training data stays with us — we do not sell it, and we do not give it to OpenAI or anyone else. We do not use eBay marketplace data to train anything. You review and can change every detail before anything is listed.

3. What we do not do

• We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising. We disclose it only to the service providers listed in Section 8, who may use it only to provide services to us.
• We do not use eBay data to train machine-learning models or artificial intelligence systems. We do train our own card-identification system on your card photographs and the corrected card details — see Section 2.
• We do not use your data to build market statistics or pricing products.
• We do not give users access to data belonging to another eBay account. People who sign in under the same eBay seller account can see that account’s cards and photos, because they are working on the same inventory.

4. Why we process it

To operate the Service: authenticating you, creating and revising your eBay listings, tracking your inventory, showing your orders so you can fulfil them, supporting you when you report a problem, and securing the Service against abuse.

5. Buyer information

Buyer personal information originates from eBay and belongs to the buyer. We retrieve it only to display your unfulfilled orders so you can ship them. We do not store it, and we do not use it for any other purpose. You are responsible for handling buyer information you view or record in accordance with applicable law and eBay's requirements.

6. How long we keep things

On account closure we delete or de-identify your data, and we destroy eBay content and personal information within the period eBay's API License Agreement requires. We take a daily backup of our database so we can recover from a failure. Data you have deleted, or data belonging to a closed account, can remain in those backups until they age out, normally within 30 days.

7. eBay account deletion requests

Where eBay notifies us that a user has closed their eBay account, we delete any personal information we hold for that user. We verify that such requests genuinely originate from eBay before acting on them.

8. Sharing

We share information only with:

• eBay, to create and manage your listings at your direction.
• OpenAI, which receives photographs of your cards for identification in the cases described in Section 2 — single-card listings, Pokemon and Yu-Gi-Oh mass uploads, and sports mass uploads only when our own system is unavailable. Images are sent to OpenAI for identification only. We do use your photographs to train our own card-identification system, as described in Section 2, but that happens on our own systems and the training data is not shared with OpenAI or anyone else.
• Amazon Web Services, which hosts the Service and stores your photographs and data.
• Supabase, which provides account authentication.
• Our email provider, used to send you service and support messages.
• Authorities, where required by law.

Sports mass uploads and the Scan Unsorted Cards tool are identified on our own self-hosted systems inside our private network. That processing does not involve any third party.

We do not sell, rent, or trade your information to anyone.

Personal information that originates from eBay is handled consistently with the eBay User Privacy Notice, and we do not process it in any way eBay itself could not.

9. Security

We protect information with encryption in transit (TLS 1.2 or higher), encryption of stored eBay credentials, application-level access controls that restrict access to the data of your own eBay seller account, and logging designed to exclude names, email addresses, buyer details and payment details, as described in Section 2. No system is perfectly secure, and we cannot guarantee absolute security.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, or to object to or restrict processing. Contact us at info@thecardlots.com and we will respond as required by law. To protect your information, we will verify a request against your account records before acting on it. You can also disconnect your eBay account at any time from within the Service.

11. Children

The Service is not directed to children under 16 and we do not knowingly collect their information.

12. Changes

We may update this policy. We will post the updated version and, where the change is material, notify you.

13. Contact

Regolith LLC
204 Walnut Way
Port Royal, PA 17082
info@thecardlots.com