Privacy Policy

Lotus Index, operated by an individual based in Portugal (“we”, “us”), is the data controller for the personal data described here, under the EU General Data Protection Regulation (GDPR) and Portuguese law (Lei 58/2019).

For anything about your data, write to privacy@lotusindex.com. We answer within one month, as the GDPR requires.

Your account

Your username, email address and password (stored only as a one-way hash by our authentication provider), when you joined, your plan, and your display settings (such as hiding your Index value or which price-change period to show).

Your collection

The cards you add to Your Index by hand: printing, quantity, condition, language, finish, the price you entered or the market price we recorded, and any notes you write.

Marketplace connections

If you connect a Cardmarket account, we store its username, the optional comment tag that marks which offers are yours, and the status and timing of each import. We then import the offers publicly listed by that account on Cardmarket: card, condition, language, finish, price, quantity and the offer’s comment. We keep diagnostic records of each import, including error details when one fails, for a short time — see How long we keep it.

Payments

If you subscribe to Pro, Stripe collects your name, billing address, payment card and tax location. We never see or store your card details; we keep only your Stripe customer and subscription identifiers, your plan status and its renewal date.

Technical data

When you use the site, our hosting and authentication providers process your IP address, browser details and the pages you request, to deliver the site and keep it secure (for example, sign-in logs to detect account abuse). We also measure visits and page speed without cookies, see Cookies and storage.

Emails

We send only service emails: confirming your address, resetting your password, confirming an email change. We don’t send marketing emails; if we ever do, we will ask first.

We don’t sell your data, show ads, or build advertising profiles. Lotus Index is not meant to process special categories of data; please don’t put sensitive information in card notes.

We use a small number of service providers, each bound by a data processing agreement that only lets them use your data to provide their service to us:

Card images and symbols come from Scryfall, but they are fetched by our servers, so your browser never contacts Scryfall and your IP address isn’t shared with them.

Our data is stored in the EU. Vercel, Stripe, Supabase and Resend are US-based companies, so some data (for example support access or Stripe’s payment processing) may be transferred to the United States. Those transfers rely on the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses (GDPR art. 45 and 46). Ask us for a copy of the safeguards at privacy@lotusindex.com.

• Account, settings and collection — until you delete your account.
• Imported offers — kept in step with Cardmarket on every import; deleted when you delete your account (unless another active member connection uses the same Cardmarket account).
• Import diagnostics — run summaries 90 days; error details from failed imports 30 days.
• Payment records — as long as tax law requires (currently up to 10 years in Portugal), even after you delete your account.
• Server and sign-in logs — short-lived, rotated by our providers within days to weeks.
• Backups — deleted data may remain in our provider’s backups until they are overwritten in the normal cycle.

Under the GDPR you can:

• Access and take your data (art. 15, 20) — download it any time from Account → Profile → Export.
• Correct it (art. 16) — edit your name and email in Account, or ask us.
• Delete it (art. 17) — Account → Profile → Delete account removes your account and everything tied to it, apart from the payment records the law makes us keep.
• Restrict or object (art. 18, 21) — including to processing based on our legitimate interests.
• Complain to a data protection authority. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD); you can also contact the authority where you live.

For anything not covered by the account tools, email privacy@lotusindex.com. We may ask you to confirm the request from your account’s email address.

We don’t make decisions about you based solely on automated processing.

We only use cookies that are strictly necessary for the site to work, which don’t need your consent. We have no advertising, social-media or tracking cookies, and no cookie banner because there is nothing to opt into.

Visit statistics (Vercel Web Analytics) and page-speed measurement (Vercel Speed Insights) use no cookies and store nothing on your device. They count page views by page, referrer, country, browser and device type; a visitor is recognised only by a temporary hash that is discarded within 24 hours, and your IP address isn’t stored.

When you pay or manage billing you are taken to Stripe’s own pages, which set their own cookies under Stripe’s privacy policy.

You must be at least 13 to create an account. If you are under 18, you need a parent’s or guardian’s permission, and only they can buy Pro. If you believe a child under 13 has given us data, email privacy@lotusindex.com and we will delete it.

Data travels over HTTPS, passwords are stored as hashes, and database access is limited by per-member access rules so members can only read their own data. Only the operator has administrative access. If a breach puts your data at risk, we will notify the authority within 72 hours and tell you without undue delay where the law requires.

We will update this page when our processing changes and change the date at the top. For significant changes we will also tell signed-in members on the site or by email.