Privacy Policy

1. Who is responsible for your data

The data controller is [TO COMPLETE: company name], Rue Pierre Brossolette, 93160 Noisy-le-Grand, France. For any question about your data, contact us at [TO COMPLETE: e.g. privacy@twincard.fr].

2. What data we collect

• Account data: email address, username, password (stored encrypted, never readable by anyone, including TwinCard staff).
• Activity data: keys purchased and used, draws, cards in your inventory, exchanges, TwinPoints, achievements, subscriptions, last login date.
• Delivery data: name, postal address and phone number, only when you request a delivery.
• Payment data: payments are handled by our payment provider. TwinCard never sees or stores your full card number.
• Technical data: IP address, browser and device type, connection logs.
• Support data: messages you send us.

3. Why we use your data

• To provide the service (account, draws, inventory, deliveries, subscriptions): necessary to perform our contract with you.
• To prevent fraud and abuse (multiple accounts, account trading, stolen payment methods): our legitimate interest in protecting TwinCard and its users.
• To meet legal obligations (invoices, accounting, requests from authorities).
• To send you news and offers: only if you gave your consent. You can unsubscribe at any time using the link in every email.

4. Card certificates and draw verification

Each physical card held by TwinCard has a unique identifier, printed as a QR code on its protective sleeve. Scanning it opens a verification page showing the card's details (extension, rarity, condition) and confirming that it is an authentic TwinCard card. This page shows no personal data about its owner.

To let you check that every draw is fair, we keep a record of each draw linked to your account: the technical values used to generate the result (server seed, your client seed and draw number), the date and the card obtained. You can view your own draw history and verify each result at any time.

5. Who receives your data

Your data is only shared with the service providers we need to run TwinCard:

• payment provider: [TO COMPLETE, e.g. Stripe];
• hosting and database provider: [TO COMPLETE];
• email provider: [TO COMPLETE, e.g. Brevo];
• shipping carrier: [TO COMPLETE], for deliveries only.

Some of these providers may be located outside the European Union. In that case, your data is protected by appropriate safeguards, such as the European Commission's standard contractual clauses.

We never sell your personal data.

6. How long we keep your data

• Account and activity data: as long as your account is open, then [TO COMPLETE] after it is closed.
• Invoices and accounting records: 10 years, as required by French law.
• Delivery data: [TO COMPLETE].
• Connection logs: 1 year.
• Marketing data: until you unsubscribe, or 3 years after your last activity.

7. Your rights

You have the right to access, correct and delete your data, to receive a copy of it (portability), to object to or limit its use, and to withdraw your consent at any time.

To use these rights, contact us at [TO COMPLETE: e.g. privacy@twincard.fr]. We will answer within one month.

If you believe your rights are not respected, you can file a complaint with the CNIL, the French data protection authority: www.cnil.fr.

8. Cookies

TwinCard uses cookies that are necessary for the website to work (for example, to keep you logged in). Other cookies, such as audience measurement or advertising cookies, are only used with your consent, which you can change at any time. [TO COMPLETE: list of cookies and tools used.]

9. Minors

TwinCard is not intended for people under [TO COMPLETE: minimum age]. We do not knowingly collect data from them.

10. Security

We use appropriate technical and organisational measures to protect your data: encrypted passwords, secure connections (HTTPS), and access limited to the staff who need it.

11. Changes to this policy

We may update this policy. You will be informed of any important change.