Privacy Policy
How HoloLedger collects, uses, and protects your personal data.
Version 1.1 · Effective 10 October 2026
1. Who we are
HoloLedger is operated by HoloLedger Ltd, a company registered in England and Wales (company number 17475127), whose registered office is at 29 Blackwood Close, West Byfleet, United Kingdom, KT14 6PP (“we”, “us”). We are the data controller for the personal data described below.
2. What we collect, why, and our lawful basis
We only use your data where the law allows it. For most of what we do, that’s because it is needed to provide the service you signed up for (contract). Some things we must do by law (legal obligation), and some we do because we have a genuine need that doesn’t override your rights (legitimate interests). We don’t rely on your consent for any of the processing below.
| Category | What | Why | Lawful basis |
|---|---|---|---|
| Account | Email, password (stored hashed by our authentication provider), username, display name | To create and secure your account | Contract |
| Age declaration | Your answer to “Are you 18 or over?” and when you gave it | HoloLedger is for adults only; buying, selling and trading involve contracts and payments | Legitimate interests |
| Seller declaration | Whether you sell as a private individual or a business, and when you said so | To show buyers who they are dealing with and to meet consumer-law duties | Legal obligation; legitimate interests |
| Agreements | Which version of each policy you accepted, and when | To keep a record of what you agreed to | Legitimate interests (establishing and defending legal claims) |
| Public profile | Username, display name, bio, avatar, general location (never a precise address) | To let other collectors identify you | Contract |
| Collection | Cards you own, condition, photos you upload | The core product: your collection | Contract |
| Card recognition | A photo of a card you ask us to identify | To suggest which card it is (see §3) | Contract |
| Marketplace | Listings, prices, offers, orders | To run the marketplace | Contract |
| Payments | Payment records, fees and Stripe identifiers. Never full card numbers. | To process and record payments and payouts (Stripe handles the card details) | Contract; legal obligation (financial records) |
| Shipping | Delivery address for orders and protected trades | So the other party can post to you. Only they can see it. | Contract |
| Messages | Conversations and message content | To let you talk to other collectors. Moderators may review messages that are reported to us. | Contract; legitimate interests (safety) |
| Reviews | Ratings and review text, tied to a real completed order or trade | Trustworthy reviews and preventing fake ones | Legitimate interests; legal obligation |
| Disputes, reports and moderation | Dispute evidence, reports, moderation decisions and appeals | To resolve disputes, keep the community safe and meet online-safety duties | Legitimate interests; legal obligation |
| Identity verification | Verification status and Stripe session references only (see §4) | To show an “Identity verified” mark | Legitimate interests |
| Privacy requests | Requests and complaints you send us, and our replies | To handle your rights | Legal obligation |
| Notification preferences | Which notifications and emails you've switched on or off | To respect your choices | Contract |
| Security and admin logs | Records of admin actions and security events | Accountability and fraud prevention | Legitimate interests; legal obligation |
| Technical | Standard server logs (for example IP address and browser type) | Security and abuse prevention | Legitimate interests |
Tax reporting. UK law may require online marketplaces to report some sellers’ sales to HMRC, and to collect details such as your full name, address, date of birth and National Insurance number to do so. We don’t collect these details today. If the rules require it for your account, we’ll tell you first and explain why (legal obligation).
We don’t use analytics, advertising or marketing tracking. See our Cookie Policy. We don’t sell your data.
3. Card recognition
When you ask us to identify a card from a photo, we send that photo to OpenAI, which works for us as a processor. We ask OpenAI not to store the request. OpenAI may keep it for up to 30 days to monitor for abuse, and doesn’t use it to train its models. Please photograph only the card, not people or documents.
4. Identity verification
Identity verification is optional and provided by Stripe Identity on Stripe’s own pages. We never receive your identity document image or number, and we don’t ask for a selfie or use facial recognition. We only keep the result and Stripe’s session reference.
If you close your account, we ask Stripe to redact your verification session. Stripe keeps some information for its own legal obligations, as its own privacy policy explains, and this is outside our control.
6. International transfers
Where a provider handles data outside the UK, we rely on the UK’s adequacy regulations (including the UK–US data bridge for certified US companies) or on the UK International Data Transfer Agreement or Addendum, with an assessment of the risks.
7. How long we keep data
| Data | How long |
|---|---|
| Your account, profile, collection, listings and messages | While your account is open. When you close it, deletion happens 30 days later (you can change your mind until then). |
| Orders, payments, refunds and disputes | As long as UK financial and tax law requires (typically 6 years), even after you close your account. Your name is replaced with an anonymous label. |
| Messages in an order or trade conversation | Kept with the order as evidence; other messages are deleted when you close your account |
| Delivery addresses | 180 days after the order or trade ends |
| Read notifications | 1 year |
| Email delivery records | 180 days |
| Card recognition records | 180 days |
| Agreements and declarations | Kept as a record of what was agreed, including after closure |
| Moderation and security records | As long as needed for safety, accountability and legal claims |
Backups are kept for a limited period and then overwritten. If we ever restore one, we delete again anything that had already been erased.
8. Closing your account
You can close your account in Settings → Account. Your public profile and listings disappear straight away, and your data is deleted 30 days later unless you change your mind. Unfinished orders, trades or disputes must be completed first. Some records are kept, as explained in §7.
9. Your rights
Under UK data protection law, you can ask us to:
- give you a copy of your data (you can also download much of it yourself in Settings → Privacy)
- correct inaccurate data
- delete your data, unless we must keep it by law
- restrict or stop some uses of your data, or object to them
- give you data you provided in a portable format
Make a request in Settings → Privacy, or email support@hololedger.co.uk. We reply within one month. For complex requests we can extend this by up to two more months, and we’ll tell you if we do. We may ask you to confirm it’s you.
10. Complaints
If you’re unhappy with how we use your data, please tell us first in Settings → Privacy (choose “Make a privacy complaint”). We’ll acknowledge it within 30 days. You can also complain to the Information Commissioner’s Office (ico.org.uk).
11. Children
HoloLedger is for adults only. Everyone is asked to confirm they are 18 or over when they join. If someone tells us they are under 18, or we find out, we close the account and delete its data.
12. Contact
For any privacy question, contact support@hololedger.co.uk.
Registered office: 29 Blackwood Close, West Byfleet, United Kingdom, KT14 6PP