Privacy policy

Last updated: November 2026.

HoloInvestor (“the service”) is run by the responsible business (“we”). Details of the responsible business are added before sales open. We are the controller for the personal data described here. Contact us at support@holoinvestor.com. We have no data protection officer. This policy explains which personal data we process, why, and which rights you have under the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.

1. Which data we process

Account: e-mail address, password (stored as a hash), time of registration and e-mail confirmation. If you choose interests at sign-up, we store them.
Sign-in: a sign-in session with a random ID and an expiry time, so you can stay signed in and be signed out.
Content you create: collections with cards, quantity and cost, the nightly value of your collections (total and per card), price alerts, wishlists and swipe choices, tier lists, lot valuations (link to the listing, notes and bids you type in), grading diary (submissions with fee, the grade you counted on, the grade you got and certificate number).
Sharing: If you share a collection, it gets a public link. The page shows the cards, quantity and grade under the name you choose (otherwise the collection's name), never cost, value or your e-mail address. Search engines may index it only if you turn that on. If you share a tier list, the page shows the title and the cards, not who made it.
Trades you log: date, counterparty (the name you type), note, card lines and cash, stored on your account until you delete the trade or the account.
Card scanning: the image you send is used only to find the card in the catalogue and is not stored, neither as a file nor in the database. Recognition runs on our own server, so the image is not passed on. We store the time, which card was the best match and the similarity score (how alike the image was to the card), for the daily limit on the free account and to improve the scanner. For lot images we store only the time and whether the matches were uncertain. The events are deleted with the account.
Subscription and purchases: plan, status and Stripe references. For Grade Report we also store the e-mail address and the payment reference. Card numbers and payment details are handled by Stripe and are not stored by us. For each purchase we also store the country of the billing address, the language at checkout and when the confirmation was sent.
Notifications: your choices for e-mail, push, frequency and currency, and which summaries we have sent you, so none is sent twice. If you turn on push, we store the address of your push subscription at the browser's push service (with keys) or the device token from the app, and the browser and device text (User-Agent) that comes with it.
Technical: IP address and time in server logs and in rate limiting (short-lived). E-mail address and subject in the log of sent e-mails. What your browser stores locally is in section 6.

We use no third-party tracking scripts and do not sell data. For card images from external image services, see section 3.

2. Why we process it (legal basis)

Deliver the service you asked for: account, collections, alerts, scanning and purchases (contract, GDPR art. 6(1)(b)). To get an account you must give an e-mail address and choose a password. Without them we cannot deliver the service. To buy something you must give payment details to Stripe. Without them we cannot complete the purchase. Everything else you enter is optional.
Send e-mail that belongs to the service: confirmation, password reset, price alerts you have set up, and important changes to the terms or to this privacy statement (contract, art. 6(1)(b)). You stop a price alert by deleting it.
Send a collection update by e-mail, weekly by default. It only covers the collection you entered. You choose daily or turn it off under Account, and every e-mail has an unsubscribe link (legitimate interest, art. 6(1)(f): our interest in giving you an update on the collection you have entered in the service. You can object to this processing).
Send push notifications, such as collection updates and price alerts (consent, art. 6(1)(a)): you turn them on yourself under Account, and you can withdraw consent there or in the settings of your browser or device.
Show card images from external image services (legitimate interest, art. 6(1)(f)).
Security, abuse protection and troubleshooting: logs and rate limiting (legitimate interest, art. 6(1)(f): that the service is safe and running).
Answer enquiries you send us (legitimate interest, art. 6(1)(f), or contract when it concerns a purchase).
Accounting and bookkeeping of payments (legal obligation, art. 6(1)(c), the Bookkeeping Act).

We make no decisions based solely on automated processing that have legal effect on you.

3. Who receives the data

We use providers that process data on our behalf. We have a data processing agreement with each of them.

The hosting provider: servers and database. Countries and transfer basis are stated before sales open.
Domeneshop AS (Norway): domain, e-mail inbox and backups of the database.
Resend (USA): sends e-mail for us. Receives your e-mail address and the content of the message.
Stripe: payment and subscription on the web. Receives your e-mail address and the payment details you enter. Stripe is a processor for the payment, and a controller for its own fraud checks, anti-money-laundering checks and accounting. See Stripe’s privacy policy.
Push services: if you turn on push notifications, the message goes through Apple, Google or the browser’s own push service.

We do not sell data. Public authorities receive it only when the law requires it.

Transfers outside the EEA: Resend processes data in the USA. The transfer rests on the European Commission’s decision on adequate protection for companies certified under the EU–US Data Privacy Framework, or on the Commission’s standard contractual clauses (SCC). You can get a copy of the safeguards by contacting us. Countries and transfer basis for Stripe are stated before sales open.

Card images from external image services

Card images, set logos and product images are fetched by your browser directly from the image services images.pokemontcg.io, images.scrydex.com, assets.tcgdex.net, images.tcggo.com and cdn.poketrace.com. This applies to everyone who visits the pages, also without an account. Each service then receives your IP address, the time, information about your browser, and the fact that the request comes from holoinvestor.com. The image address also shows which card or set the image belongs to. We do not send your e-mail address or other account information to them. The image services are not our processors, and we do not control what they do with the information. See their own privacy policies. Countries and transfer basis are stated before sales open. We do this to be able to show you the cards the service is about (legitimate interest, GDPR Art. 6(1)(f)). We do not use the images for tracking.

4. Storage period

Account and content are stored until you delete the account. When you delete the account under Account, everything you have entered or created with the account is removed at once, including collections, alerts, wishlists, Oracle conversations, the trade log, the lot log, the grading diary, scan events, tier lists, push subscriptions and notification settings. If you have a subscription on the web, it is cancelled at Stripe first.

Backups: the database is copied every night. The copies are deleted automatically after about one week on the server and after about one month at Domeneshop, which stores them for us. What you delete is gone from the copies at the latest 35 days after you deleted it.

Purchases: Grade Report purchases remain when you delete the account, but without any link to you. The e-mail address is replaced with an anonymous placeholder, and the purchase is detached from your account. The payment reference from Stripe is kept for five years after the end of the financial year (the Bookkeeping Act § 13(2)) and is deleted after that. Payments are also held by Stripe and in our accounts, which keep them for the same period. Stripe keeps information under its own rules, including accounting and anti-money-laundering rules.

Server logs (IP address, time and, when we send you an e-mail, your e-mail address): deleted automatically after at most 30 days. Resend, which sends our e-mails, has its own log and keeps it for 30 days.

E-mail you send us: as long as the case requires. The retention period is stated before sales open.

5. Your rights

You have the right to access the data we hold about you (and a copy of it), to have it corrected or deleted, to restrict processing, and to receive the data you have given us in a structured, commonly used and machine-readable format (data portability). If processing is based on consent, you can withdraw your consent at any time, for example by turning off push notifications under Account. This does not affect processing that took place before you withdrew it.

You can object at any time to processing that we base on legitimate interest (see section 2), on grounds relating to your particular situation. We will then stop the processing unless we have compelling legitimate grounds that override your interests, or need the data to defend a legal claim. You can always turn off the collection update e-mail under Account.

You delete your account and data yourself under Account. For access, a copy, correction, restriction, objection or other requests, e-mail support@holoinvestor.com with the subject “Privacy”. Write from the e-mail address your account is registered with, so we can see that it is you. We may ask for more information if we are in doubt. We reply without undue delay and in any case within one month. If the request is complex, the deadline can be extended by up to two further months, and we will tell you within the first month if so.

If you believe we process your data in breach of the rules, you can complain to the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no) or to the supervisory authority in the country where you reside. You are welcome to contact us first.

6. Cookies and local storage

We use no cookies for tracking, and no tracking or analytics tools from third parties. Stripe, which takes the payment on its own page, may set its own cookies there. So may the external image services the card images are loaded from (see section 3). We do not control them.

Your browser stores the following locally (localStorage and sessionStorage):

Sign-in: sign-in tokens and a copy of your account details, for as long as you are signed in. The copy holds your e-mail address, your plan and subscription status (with the date the trial ends), whether your e-mail is verified and the choices you made about what you are interested in.
Choices you have made: language, currency, market, catalogue choice (English or Japanese), light or dark display, the category choice on the strategy pages and whether you dismissed the install banner.
What you have viewed and done: the last eight cards you opened, with the date and the price you saw, until you press “Clear the list” on the front page; the trade you set up on the trade page (cards, quantity, cash and currency), until you clear it; drafts of tier lists; and how many slots in a set you had filled last time.
Temporarily, until the tab closes: a copy of which cards you own, wish for and have an alert on.
Cache: a copy of the app and of data you have fetched from the catalogue (cards, sets, strategies and searches), so the site opens faster and can be shown offline.

Of this, the sign-in tokens and your choices of language, currency, market and catalogue are sent to our server as part of requests. The front page also asks the server for the card you opened last, by the card's id, as an ordinary page view does. The strategy pages do the same when they have no candidate to show. The rest stays in your browser and is not sent to us as a list.

You remove the list of opened cards with “Clear the list” on the front page. Signing out removes the sign-in. You remove the rest by clearing the browser data for holoinvestor.com.

The storage belongs to functions you use, and we do not use it for tracking or advertising.

7. Changes

Material changes are announced on this page and by e-mail to users with an account, in good time before they take effect.