Privacy policy

Data controller

Controller: Manuele Califfo — CaliffoCustomTCG · Italy · tcg@califfo.dev.

We process personal data needed to operate the shop, fulfil orders, and provide account and tracking features.

What we collect

• Account data — email and authentication identifiers when you create or use an account (via Supabase Auth).
• Order & shipping data — name, email, shipping address, phone (if provided), order contents, amounts, and invoice/billing details when requested.
• Payment data — processed by Stripe; we receive payment status, Stripe customer / session identifiers, and limited receipt metadata. We do not store full card numbers.
• Technical data — standard server/hosting logs (IP, user agent, timestamps) needed for security and delivery of the site (Netlify).
• Support communications — emails or messages you send us about orders or the service.

Purposes & legal bases

• Contract — to process checkout, produce and ship orders, provide tracking, and manage your account (Art. 6(1)(b) GDPR).
• Legal obligation — accounting, tax, and consumer-rights compliance where required (Art. 6(1)(c)).
• Legitimate interests — fraud prevention, site security, and improving fulfilment operations, balanced against your rights (Art. 6(1)(f)).
• Consent — where we rely on optional marketing or non-essential cookies (if enabled); you may withdraw consent at any time.

Processors & third parties

We use service providers that process data on our behalf or as independent controllers for payments:

• Account & database: Supabase
• Payments: Stripe
• Transactional email: Resend
• Hosting & CDN: Netlify
• Shipping labels / logistics partners (e.g. courier / postal / Packlink when enabled)

Some providers may process data outside the EEA under appropriate safeguards (e.g. Standard Contractual Clauses) as described in their documentation.

Retention

Order and invoicing records are kept for the period required by Italian tax and commercial rules. Account data is kept while your account is active and deleted or anonymised on request where no legal retention applies. Support emails are kept as long as needed to resolve the matter and for reasonable follow-up.

Your rights

Under GDPR you may request access, rectification, erasure, restriction, objection, and data portability where applicable, and lodge a complaint with your supervisory authority (in Italy: Garante per la protezione dei dati personali). To exercise rights, email tcg@califfo.dev. We may need to verify your identity before responding.

Cookies

Essential cookies or local storage may be used for cart, country/shipping preference, and authentication. We do not run third-party advertising trackers on this shop by default. If analytics or marketing tools are added later, this notice will be updated and consent obtained where required.