1. Who we are
DiscoverTCG is operated by Stockulate in the United Kingdom. In this notice, “DiscoverTCG”, “we”, “us” and “our” refer to Stockulate when it decides how and why personal information is used for DiscoverTCG.
For privacy questions or rights requests, email support@discovertcg.com.
2. Information we may use
The information involved depends on how you use the website or app.
- Account and contact information: email address, authentication records, display name and communications with us.
- Profile and role information: whether you join as a collector or store, profile preferences and onboarding choices.
- Store information: business name, public address, contact details, opening information, verification materials, product listings, prices and quantities.
- Community content: stock findings, store references, photos, comments, validations, reports and moderation history.
- Listing corrections: if you use the form on a shop’s page to tell us its details are wrong, the name and email address you give us, how you know the shop, the changes you propose and any notes, plus a keyed hash of your network address used only to limit abuse of the form. Corrections are reviewed by a person and are never published as sent.
- Location and map information: an approximate or precise location if you choose to provide device permission, locations attached to findings, and destinations requested for directions.
- Technical and usage information: device and browser type, IP address, app version, diagnostic events, security logs and interactions needed to operate and protect the service. On the website this includes cookieless, aggregate page-view measurement that does not identify you or follow you to other sites.
- Shop activity measurement: so that a shop can see how it is doing on DiscoverTCG, we count the things collectors do around it — opening a shop’s page or shelf in the app or on this website, following it, tapping its phone number, website or directions, opening a card and asking which shops nearby stock it, and the search terms typed into the app. Each record carries a pseudonymous key (your account identifier if you are signed in, otherwise a salted hash of your network address and browser) so that people can be counted once, and any location is rounded to roughly one kilometre before it is stored. Shops only ever see counts — how many collectors, never who — and we show nothing at all below a minimum number of people, so that a small number cannot point at an individual. A shop’s own staff are never counted against their own shop. On this website, a Global Privacy Control or Do Not Track signal from your browser switches this measurement off.
Please do not include other people’s personal information in a photo, comment or report unless you have a lawful reason and their permission where required.
3. Why we use information
UK data protection law requires us to have a lawful basis for each purpose. The bases that are expected to apply are set out below and must be reviewed as features are launched.
| Purpose | Typical information | Lawful basis |
|---|---|---|
| Create and secure your account | Email, authentication and security records | Contract; legitimate interests in preventing misuse |
| Provide role-aware app features | Profile, role, store and community content | Steps before or performance of our contract with you |
| Show nearby stores, findings and routes | Location, map requests and public store data | Consent for device location where required; contract for requested features |
| Moderate content and protect members | Reports, content, account and technical records | Legitimate interests in operating a safe and trustworthy service |
| Reply to enquiries and rights requests | Contact details and correspondence | Legitimate interests; legal obligation where applicable |
| Improve reliability and understand performance | Diagnostics and limited usage information | Legitimate interests; consent where non-essential device storage requires it |
| Show shops how many collectors looked for them and what collectors near them are looking for | Shop activity measurement (pseudonymous, location rounded, counts only) | Legitimate interests in running a useful directory for shops and collectors, with the safeguards described in section 2 |
| Deliver alerts you have asked for, including a shop’s promotions | Your follows and watches, alert preferences, device tokens | Contract (you chose to follow or watch); you can mute, unfollow or switch off pushes at any time |
| Send optional product news | Email and marketing preferences | Consent, or another lawful route where specifically permitted |
Where we rely on legitimate interests, those interests include maintaining service security, responding to members, improving reliability and protecting the quality of community information. We consider the impact on you before relying on this basis.
5. International transfers
Some service providers may process information outside the United Kingdom. Where personal information is transferred internationally, we will use a lawful transfer mechanism and appropriate safeguards, such as a UK adequacy regulation or approved contractual protections, where required.
You can ask us for more information about the safeguards relevant to your information.
6. How long we keep information
We keep personal information only for as long as needed for the purposes described above, including legal, safety, fraud-prevention and dispute requirements. The exact period depends on the record and feature.
- Account and profile information is generally kept while the account is active and for a limited period after closure where needed for security, disputes or legal obligations.
- Community content may remain visible until removed, expired or moderated. Some limited records may be retained after deletion to prevent abuse or document moderation decisions.
- Support and privacy correspondence is retained for an appropriate period to resolve the request and demonstrate the response.
- Listing corrections are kept while they are under review and afterwards as a record of why a shop’s details changed; the network-address hash is removed as soon as a correction is reviewed.
- Security and diagnostic logs are kept for shorter operational periods unless an incident requires longer investigation.
- Shop activity measurement is kept as individual records for 90 days and then only as daily totals per shop, which are not personal information.
We will define and document feature-specific periods before the relevant processing goes live.
7. Your data protection rights
Depending on the circumstances and lawful basis, you may have rights to:
- ask for access to your personal information;
- ask us to correct inaccurate or incomplete information;
- ask us to erase information;
- ask us to restrict how information is used;
- receive certain information in a portable format;
- withdraw consent at any time, without affecting earlier lawful use; and
- complain to the Information Commissioner’s Office.
Your right to object
You may object to processing based on our legitimate interests. You may also object at any time to personal information being used for direct marketing.
To exercise a right, email support@discovertcg.com. We may need to verify your identity. Rights can be subject to legal limits, and we will explain if an exception applies.
You can complain to the Information Commissioner’s Office. We would appreciate the opportunity to address your concern first.
8. Children
DiscoverTCG is not intended for children under 13. A person under 18 should use the service only with the involvement and permission of a parent or guardian where required. We will assess child-access risks and add age-appropriate safeguards before public launch.
If you believe a child has provided personal information inappropriately, contact us so we can investigate.
9. Security
We use proportionate technical and organisational measures designed to protect personal information, including access controls, authenticated sessions, database row-level security and restricted administrative access. No online system is completely secure, so members should use a unique password and keep account credentials private.
10. Changes to this notice
We will update this notice as DiscoverTCG features, providers or legal requirements change. Material changes will be brought to members’ attention through an appropriate channel before new processing begins where required.
11. Contact us
For questions, complaints or rights requests:
DiscoverTCG / Stockulate
support@discovertcg.com
United Kingdom