1. Who we are

Arcane (arcanepacks.com) processes personal data as the data controller for the purposes described in this policy. This policy explains what we collect, why, and what rights you have under UK data protection law.

2. What we collect

Account & seller data: name, email, phone number, address, and store details for sellers running a storefront on Arcane.

Sell-to-Us submissions: name, email, phone number, and postcode, plus details of the cards you're submitting (card, quantity, offer) and any notes you add.

Order data: contact and delivery details needed to fulfil a pack purchase.

Technical data: standard web request data (IP address, browser type, pages visited) and essential cookies needed to keep the site working (for example, keeping you logged in, and remembering if you've dismissed a pop-up).

3. Why we use it

To fulfil pack orders and Sell to Us submissions, including contacting you about the status of either.

To operate seller storefronts and pay out invoices to stores.

To detect and prevent fraud or abuse (for example, of the affiliate program).

To meet our legal and accounting obligations.

4. Legal basis

We process most of this data because it's necessary to perform a contract with you (fulfilling an order, processing a submission, or running your store). Some processing (like fraud prevention) relies on our legitimate interest in running a safe, working service.

5. Who we share it with

Payment processors, to take payment for orders.

Email delivery providers, to send order confirmations, submission updates, and account notifications.

Card pricing data providers, to look up live market prices — this only involves card identifiers, not your personal data.

We don't sell your personal data to third parties.

6. How long we keep it

We keep order, submission, and account data for as long as your account or store is active, and afterwards for as long as needed to meet our legal and accounting obligations (typically up to 6 years for financial records).

7. Your rights

Under UK data protection law, you can ask us to: give you a copy of your personal data, correct inaccurate data, delete your data, or restrict or object to certain processing. To exercise any of these rights, contact us using the details below.

You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you think we've mishandled your data.

8. Cookies

We use essential cookies only — to keep you logged in, protect against cross-site request forgery, and remember simple preferences like dismissing a pop-up. We don't currently use tracking or advertising cookies.

9. Children

Arcane's services are intended for users aged 18 and over. We don't knowingly collect personal data from children.

10. Changes to this policy

We may update this policy from time to time. Significant changes will be reflected by an updated "last updated" date at the top of this page.

11. Contact us

Questions about this policy, or want to exercise one of your rights? Email us at support@arcanepacks.com.