Draft. This document hasn't been reviewed by counsel yet and bracketed details still need to be filled in.
Privacy policy
Effective [effective date]
This policy explains how [Legal entity name] (“LGS Nexus”, “we”) handles personal information in the LGS Nexus service: the marketing site at lgsnexus.net, the platform, and every store site and back office we host for game stores (“Stores”).
Two kinds of data, two roles
- Store account data — information about the people who sign up and run a Store (owners and staff): names, email addresses, sign-in activity, billing contacts. For this data, LGS Nexus decides how it is used and is responsible for it.
- Store customer data — information a Store keeps about its own customers: consignors, store-credit customers, buy-in and sale records, newsletter subscribers. The Store decides what to collect and how to use it; we process it on the Store's behalf and only to provide the service. If you're a customer of a Store, contact that Store about your data — we will help them respond.
What we collect
- Account details you give us: name, email, store name and address, phone, and anything you send us in feedback or applications.
- What Stores enter while running their business, including their customers' names, phone numbers, email addresses, consignment items, payouts and transaction history.
- Billing details for subscriptions, handled by Stripe. Card numbers go directly to Stripe and never reach our servers.
- Technical data needed to run and secure the service: IP addresses, request logs, an audit log of significant actions (who did what, when).
- Cookieless page analytics on our marketing site (page views and button clicks, not tied to you personally).
How we use it
- To provide the service: sign-in, the back office tools, store websites, consignor portals and billing.
- To keep it secure: preventing abuse, investigating problems, keeping an audit trail.
- To support you: when you ask for help, an LGS Nexus operator may view your Store's back office in a read-only, time-limited session that is recorded in your Store's audit log with the reason given.
- To tell you about your account and important changes. We don't send marketing email to Store customers, and we don't sell or rent personal information or use it for advertising.
Cookies
We use only cookies needed to run the service — keeping you signed in and protecting sessions. We don't use advertising or cross-site tracking cookies, so there's no cookie banner.
Who we share it with
We use these service providers (“sub-processors”), each bound to protect the data and use it only to provide their service to us:
| Provider | Purpose | Data involved |
|---|---|---|
| Clerk | Sign-in and account security | Names, email addresses, sign-in activity of store staff and consignors |
| Stripe | Subscription payments | Billing contact and payment details of store owners (card numbers never reach our servers) |
| Google Cloud (Cloud SQL, United States) | Database hosting and backups | All data stored in the service |
| Vercel | Application hosting, CDN, cookieless page analytics | Request data such as IP address and pages visited |
| JustTCG | Trading-card market prices | Card names and variants searched — no personal data |
| Ximilar | Card recognition for the camera scanner | Photos of the cards being scanned — no personal data |
| Google reCAPTCHA | Keeping bots out of public forms (contact and newsletter sign-up) | Device and browser signals while the form is used; subject to Google's Privacy Policy and Terms |
| GitHub | Support ticket tracking | Feedback text and the store's address — no store customer data |
We may also disclose information if the law requires it, or to protect the rights and safety of our users or others.
How long we keep it
- While a Store is active, its data is kept so the Store can use it.
- When a Store is closed, its owners can still export their data for 30 days; after that it is permanently deleted from the live system.
- Encrypted database backups are kept for up to 14 days, after which deleted data no longer exists in backups either.
Security
Data is encrypted in transit. Each Store's data is separated from every other Store's both in our application and in the database itself. Staff access within a Store is limited by role, and our own operators' access is limited, read-only for support, and logged.
Your choices and rights
- Store owners can export all of their Store's data at any time and can close their Store.
- You can ask us to access, correct or delete personal information we hold about you, or for a copy of it. Store customers should ask the Store first; we'll help the Store respond.
- Depending on where you live (for example under the GDPR or California law), you may have further rights, including to object to processing or to complain to a regulator. We honor these rights.
Children
The service is for businesses and isn't directed at children under 13. Stores are responsible for how they handle any minors among their own customers.
Changes
We'll post changes here and update the effective date. If a change is significant, we'll tell Store owners by email or in the app before it takes effect.
Contact
[Legal entity name], [Mailing address] · [legal contact email]