Privacy Policy

Overview

This Privacy Policy describes how The Card Doc LLC(“The Card Doc,” “we,” “our,” or “us”) collects, uses, shares, and protects personal information when you interact with us through our website at thecarddoc1.com, our Instagram account @the_card_doc, or through our automated Instagram and Messenger Direct Message (DM) assistant (our “Messenger App”).

This is our ownpolicy. It is not Meta’s policy, ManyChat’s policy, or any other party’s policy. The Card Doc LLC is the publisher of and data controller responsible for this policy. Where we reference Meta’s own privacy policies it is as a supplementary reference only—those third-party policies govern Meta’s separate data practices, not ours.

By sending us a message, placing an order, or visiting our website, you agree to the practices described in this Privacy Policy.

1. Information We Collect

A. Information You Provide Directly

When you send us a message on Instagram or Messenger, or place an order on our website, we collect:

• Message content: the full text of every message you send us, including questions, order inquiries, complaints, and any other content you choose to include
• Photos, videos, and attachments: any media files you send us (for example, photos of your cards for damage assessment)
• Contact and order details: your name, email address, phone number, shipping address, order number, and any other information you provide in the course of placing or tracking a restoration order
• Card details: for each card you send, its name, set, year, number and variation, grading company, grade and certification number, known defects, the value you declare, the services you choose, and the photos you upload
• Order history: your past and current orders, purchases, gift cards, subscriptions, problem reports and our messages about them
• Signing records: when you sign our Terms of Service or a card-specific agreement (such as a Slab Removal Authorization), we record your typed full name, the exact document and version you signed, the date and time from our server, your email address and whether it was verified, and the IP address and browser and device information (user agent) of the device you signed from. We also record the choices you make at checkout: your consent to electronic records, any optional photo or tagging permission, and whether you bought or declined shipping insurance
• Payment references: payments are processed by Stripe. We receive references to your payment (such as Stripe payment and session IDs, amounts and refunds), never your full card number

B. Information Received from Meta via the Instagram and Messenger APIs

When you message us through Instagram Direct or Facebook Messenger, Meta provides us with certain information about you through the Instagram Graph API and Messenger Platform API, including:

• User identifier: your Instagram-scoped user ID or Page-scoped user ID (a unique, non-human-readable number assigned by Meta to identify your account within our app)
• Username and display name: your Instagram username and/or Facebook display name as shown on your profile
• Profile picture: the publicly available profile photo associated with your account
• Message metadata: timestamps of messages, message delivery status (sent, delivered), and read receipts where the API makes these available

We receive only the data Meta’s API provides through the permissions our Messenger App has been granted. We do not request or store permissions beyond what is necessary to operate the DM assistant. For details on how Meta collects and uses your data, see Meta’s Privacy Policy.

C. Information Collected Automatically

When you use our website or our messaging integrations, we may automatically collect:

• Server logs: IP addresses, request times, pages visited, HTTP status codes, and error reports
• Messaging usage information: which automated replies were sent, which message flows were triggered, and response times
• Device and browser information: browser type, operating system, device type, and language settings when you visit our website

2. How We Use Your Information

We use the information we collect only for the following purposes. Each purpose is listed with the type of data used and the reason it is necessary:

• Replying to your messages: message text, user ID, username, and message metadata are used to generate and send automated or human replies to your questions and requests. This is the core function of our Messenger App.
• Routing to a human team member: message content including photos and attachments is routed to a human when the automated system cannot handle the request, or when the message relates to a damage assessment, refund, complaint, or other matter requiring personal attention.
• Providing restoration and order services: name, email, phone, shipping address, and order details are used to process your card restoration order, communicate its status, ship completed cards, and issue receipts and refunds.
• Keeping signed records: your signing records and checkout choices are used to show what you agreed to and when, to make sure no work starts on a card before the required signatures are in place, to send you signed copies, and to handle questions, disputes, chargebacks and legal claims.
• Improving reply accuracy: aggregated and anonymized data about which automated replies were triggered and whether they were helpful is used to improve the quality and relevance of future responses.
• Security and abuse prevention: server logs, user IDs, and usage data are used to detect spam, fraud, and policy violations, and to maintain the integrity of our services.
• Legal compliance: we retain certain records as required by applicable law (for example, transaction records for tax purposes) and may use your information to respond to lawful requests from courts or government agencies.

We do not sell your personal information. We do not use your messages or personal information for advertising, or send you promotional messages that you have not consented to receive.

3. AI-Generated Replies

Some replies you receive from our Instagram or Messenger DM assistant may be generated, in whole or in part, by an artificial intelligence (AI) language model. When this occurs:

• The content of your message (text, and in some cases photos) is sent to Anthropic’s API (the provider of the Claude AI model) solely for the purpose of generating a reply. See Section 5 (Service Providers) for more details.
• Your messages are not used to train AI models.Anthropic’s API terms prohibit using customer API inputs and outputs to train their models without explicit opt-in consent, and we have not provided such consent.
• If you would prefer to speak with a human at any time, simply reply “human” or “agent,” or contact us directly at thecarddoc1@gmail.com.

4. Cookies and Analytics

Our website uses Google Analytics (via Google Tag Manager) to collect aggregate information about site usage such as page views, traffic sources, and session duration. This data is collected using cookies and similar tracking technologies. Google Analytics data is anonymized and used only to understand how visitors use our site.

We use session cookies necessary for authentication (for example, to keep you logged in to your account). We do not use cookies for cross-site advertising tracking.

5. Who We Share Your Information With

We share personal information only with service providers who help us operate our business, under contractual obligations to protect it, and only to the extent necessary. We do not sell data. Our current service providers are:

• Meta Platforms, Inc. — we use the Instagram Graph API and Messenger Platform API to send and receive messages. Meta processes message metadata in accordance with Meta’s Privacy Policy.
• ManyChat — we use ManyChat as our messaging automation platform. ManyChat stores conversation data, contact information, and message flows on our behalf. ManyChat Privacy Policy.
• Anthropic PBC— message content is sent to Anthropic’s Claude API to generate automated replies. Anthropic processes this data subject to their API usage policies and does not use it to train models. Anthropic Privacy Policy.
• Railway— we host our backend automation services on Railway’s cloud infrastructure. Railway may process data in connection with hosting and running our server.
• Supabase— we use Supabase as our database and backend-as-a-service provider. Order records, customer information, and message-related data are stored in Supabase’s managed PostgreSQL database.
• Stripe processes card payments, refunds and subscriptions.
• Resend delivers our emails (order confirmations, signed copies, notices and password links).
• Netlify hosts our website and the server code that runs it, including the logs of requests to it.
• Shippo and the shipping carriers (such as USPS, UPS and FedEx) receive the names and addresses needed to create labels and tracking, and the insurer behind any shipping insurance you buy receives what it needs to cover and settle a claim.
• Google suggests addresses as you type at checkout (Google Maps Platform), in addition to Google Analytics described above.
• Pushover — we use Pushover to send internal push notifications to our team when certain events occur (for example, a new order or a message requiring human review). Limited message content may be included in these notifications.
• Legal disclosures: we may disclose personal information if required by law, court order, or government request, or to protect the rights, property, or safety of The Card Doc LLC, our customers, or others.
• Business transfers: if The Card Doc LLC is acquired, merged, or its assets are transferred to another entity, personal information may be transferred as part of that transaction. We will notify users by posting a notice on our website before data is transferred and becomes subject to a different privacy policy.

6. Data Retention

We retain personal information for the following periods:

• Conversation data (message text, contact identifiers, message metadata): 12 months after your last message to us.
• Server and error logs: 90 days.
• Order records: retained for at least 7 years as required for tax and accounting compliance, regardless of the conversation retention period.
• Signed agreements and signing records:kept with the order record, for at least 7 years and for as long as any question, claim or dispute about the order is open. They cannot be changed, and we can’t delete them on request during that time, because they are the record of what was agreed.
• Exceptions: we retain data longer when required by applicable law, when there is an open order, unresolved dispute, active legal proceeding, or regulatory requirement that prevents deletion.

When retention periods expire, we delete or anonymize the data. Note that deleting our records does not remove messages from your own Instagram or Messenger inbox — those remain in your Meta account and are governed by Meta’s policies.

7. How to Request Data Deletion

You have the right to request that we delete your personal information. To submit a deletion request:

1. Email us at: thecarddoc1@gmail.com
2. Subject line: use exactly Data Deletion Request
3. Include in your message: your Instagram username or Facebook display name so we can locate your records. If you have an order number, include that too.

We will process your request within 30 days of receipt and send a confirmation email when deletion is complete. In some cases (for example, where we are required by law to retain records, or where there is an open order or active dispute), we may be unable to delete certain data immediately; we will explain any such limitations in our response.

Important: deleting your records from our systems does not remove the conversation thread from your own Instagram or Messenger inbox. Those messages remain in your Meta account and must be deleted there separately.

8. Your Privacy Rights

Depending on where you live, you may have the following rights regarding your personal information. We will not discriminate against you for exercising any of these rights.

• Access: request a copy of the personal information we hold about you, including copies of anything you signed with us.
• Correction: request that we correct inaccurate or incomplete information.
• Deletion: request that we delete your personal information (see Section 7 above for how to submit a deletion request).
• Stop messaging / block:you can stop receiving messages from our DM assistant at any time by replying “STOP,” blocking our account, or using Instagram’s or Facebook’s built-in controls to restrict or block our account.
• Request a human:at any time you may request to speak with a human team member rather than the automated assistant. Reply “human” or “agent” in the chat, or email us directly.

New Jersey Residents

If you are a resident of New Jersey, the New Jersey Data Privacy Act (NJDPA) grants you additional rights, including the right to opt out of targeted advertising, the right to opt out of the sale of personal data (we do not sell personal data), the right to appeal a decision we make regarding your request, and the right to data portability. To exercise these rights or to file an appeal, contact us at thecarddoc1@gmail.com.

Other State Laws

Residents of California, Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws may have similar rights. We honor access, correction, and deletion requests from all users regardless of location. Contact us using the information in Section 11 to exercise your rights.

9. Security

We implement commercially reasonable administrative, technical, and physical safeguards to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These include:

• Encrypted connections (HTTPS/TLS) for all data transmission
• Access controls limiting who on our team can view customer data
• Secure database hosting with row-level security policies
• API keys and credentials stored as environment variables, never in source code

No method of electronic transmission or storage is 100% secure. If you believe your information has been compromised, please contact us immediately at thecarddoc1@gmail.com.

10. Children’s Privacy

Our services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected personal information from a child under 13, we will delete it promptly in accordance with the Children’s Online Privacy Protection Act (COPPA). If you believe we may have collected information from a child under 13, please contact us at thecarddoc1@gmail.com.

11. Data Processing Location

The Card Doc LLC is based in New Jersey, USA. All personal information we collect is processed and stored in the United States. Our service providers (Supabase, Railway, Anthropic, ManyChat) also process data in the US or in jurisdictions with data protection agreements. By using our services from outside the United States, you consent to the transfer and processing of your information in the US.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will:

• Update the “Effective Date” at the top of this page
• Post a notice on our website or send a message through our DM channels

We encourage you to review this page periodically. Continued use of our services after a policy update constitutes acceptance of the revised policy.

13. Contact Us

If you have questions about this Privacy Policy, want to exercise your rights, or need to report a concern, contact us by any of the following means:

• Email: thecarddoc1@gmail.com (monitored; we reply within 1 business day)
• Instagram DM: @the_card_doc
• Legal name: The Card Doc LLC
• State of formation: New Jersey, USA