Privacy policy
最終更新 2026-10-22
これらの法的文書は英語とドイツ語で提供しています。相違がある場合はドイツ語版が優先します。
1. Controller
The controller for processing personal data on EverySlab (https://everyslab.com) is Manta Technologies GmbH, Erich-Weinert-Str. 10, 10439 Berlin, Germany. You can reach us at info@everyslab.com or by phone at +49 30 75939148.
This policy explains what we process, why, on which legal basis, and which rights you have under the GDPR and the TDDDG. It reflects how the service works today.
2. Language
This policy is provided in English and German. If the versions differ, the German version is legally binding.
3. What we do not do
We do not use advertising networks, tracking pixels or profiling for advertising. We do not sell personal data. We use PostHog for product analytics, web analytics and session recordings only with your consent; without consent we only count visits anonymously (see Analytics). Fonts are self-hosted (@fontsource); we do not load Google Fonts or other third-party webfonts.
5. Analytics (PostHog)
We use PostHog, Inc. (USA) as a processor for product analytics, web analytics and session recordings. Event data is stored in PostHog’s EU cloud (Frankfurt, Germany). Any transfer to the United States relies on the EU-US Data Privacy Framework and, where required, Standard Contractual Clauses.
Without consent: PostHog counts visits with cookieless mode. It uses a daily-rotating server-side hash of IP address, user agent and hostname. Nothing is stored or read on your device (no cookies, no local or session storage). IP addresses are anonymised and not stored. Legal basis: Art. 6 (1)(f) GDPR (reach measurement). Section 25 TDDDG does not apply because nothing is stored or read on the terminal device.
With consent: PostHog stores an identifier in a first-party cookie and localStorage (name ph_<project token>_posthog, lifetime 365 days), records pageviews, clicks and custom events, and records session recordings with all inputs masked (retention 30 days). When you are signed in we link events to your internal account ID (not your email or name). Legal basis: Art. 6 (1)(a) GDPR and section 25 (1) TDDDG. You can withdraw consent at any time via Cookie settings; we then stop recordings, clear PostHog analytics storage and return to cookieless counting.
Server-side service events (for example that an alert or the welcome email was sent, that you unsubscribed from email alerts, that you added or removed a collection item, or that you scanned a photo and how many cards were recognised) are sent to PostHog linked only to the pseudonymous account ID, without creating a person profile on the server. Legal basis: Art. 6 (1)(f) GDPR (operating and improving the service).
6. Account and sign-in
To create an account you sign in with WorkOS, Inc. (USA) as our processor for authentication. WorkOS receives your email address, name and authentication events. Transfers to the United States are based on the EU-US Data Privacy Framework and, where required, Standard Contractual Clauses.
We store: email address, first name, last name, locale, last login time, account status (waitlist, active or disabled), and a WorkOS user identifier. Legal basis: Art. 6 (1)(b) GDPR (account contract) and Art. 6 (1)(f) GDPR for security of the sign-in.
7. Watchlists, alerts and preferences
If you use watchlists we store your alert criteria (card, languages, grade or condition filters, price and discount thresholds, confidence), matching listings, notification history (channel, status, time sent) and your email/Telegram alert preferences. Legal basis: Art. 6 (1)(b) GDPR.
We also keep short operational audit records of watchlist changes (action, before/after values, user id) for the security and integrity of the service (Art. 6 (1)(f) GDPR).
8. Email delivery
Alert emails and a one-time welcome email, sent when your account is activated and explaining how the service works, are sent through Resend (Plus Five Five, Inc.), USA. The sending region is EU (eu-west-1). Every alert email includes an unsubscribe link. We do not send marketing newsletters. Legal basis: Art. 6 (1)(b) GDPR. Transfers: EU-US Data Privacy Framework and Standard Contractual Clauses as applicable.
9. Optional Telegram alerts
If you link Telegram we store your chat ID and username and send alert messages via the Telegram Bot API. Telegram (Telegram Messenger Inc. / Telegram FZ-LLC) then processes the message under its own privacy policy. You can disconnect Telegram in settings. Legal basis: Art. 6 (1)(b) GDPR. We also store a short-lived hashed link token until the link succeeds or expires.
10. Card scanning (Google Gemini)
If you use the scan feature, photos you upload are sent to the Gemini API operated by Google (Google Ireland Ltd. / Google LLC) so the printed card can be recognised. The image is processed in memory. We do not store the photo after recognition: the bytes are deleted. We keep only the recognised card identity, the confidence of that recognition, and the collection item you accept.
According to Google’s terms for the Gemini API, content is not used to train models when using the paid service. Transfers to the United States rely on the EU-US Data Privacy Framework and, where required, Standard Contractual Clauses. Legal basis: Art. 6 (1)(b) GDPR (you requested the feature).
Each scan link is single-use for that session and expires after 30 minutes. We also store the cards you mark as owned, optional purchase price and notes, under Art. 6 (1)(b) GDPR.
11. Hosting, logs and security
The website, API, PostgreSQL database, Redis and background workers are hosted by Railway Corporation (USA) in the EU region europe-west4 (Netherlands). Transfers: EU-US Data Privacy Framework and Standard Contractual Clauses as applicable.
We keep server and application logs (including IP address, requested URL, time and error details) for security, abuse prevention, rate limiting and error analysis. Legal basis: Art. 6 (1)(f) GDPR. Logs are retained for 30 days.
12. DNS, redirects and inbound email
Cloudflare, Inc. (USA) provides DNS, redirects everyslabs.com and www to everyslab.com, and routes inbound mail to info@everyslab.com and alerts@everyslab.com. Transfers: EU-US Data Privacy Framework and Standard Contractual Clauses as applicable.
13. Market data and third-party sites
Fair values, live offers and deals are computed from public marketplace pages and public sales data (in particular Cardmarket, and historical sales from sources such as eBay, Fanatics and Goldin). Card names, set metadata and images are sourced from TCGdex. We do not send your personal data to those platforms.
If you follow an outbound link — for example to a Cardmarket listing — you leave EverySlab and that site’s own privacy policy applies. Purchases are concluded only between you and the third-party seller.
14. Retention and deletion
You can delete your account yourself in Settings. Deletion is immediate and cannot be undone. We erase the account record and everything stored with it: watchlists and matches, notification history, Telegram link tokens, collections and items, and scan sessions including uploaded photos and detections.
Audit logs that referred to you are anonymised: the user link and actor label are removed, and email and name are stripped from the stored snapshots. We keep one account_deleted event with no personal data.
WorkOS (authentication) and PostHog (analytics, if a person existed for your account id) are deleted automatically after the account is erased. We do not add your address to a Resend audience; transactional mail stops because the account is gone.
Copies of the database may persist in backups for a limited period after deletion; we will not restore your personal data from them except where legally required. You can also email info@everyslab.com to exercise your rights or ask about a leftover copy.
If WorkOS notifies us that the user was deleted, we run the same erase path. Repeating the request after the account is already gone has no effect.
Account data is otherwise stored for as long as the account exists. Cookies expire as stated above. Logs are kept for 30 days.
15. Recipients and transfers
Besides the providers named above, personal data is processed only by us and, where needed, by professional advisers who are bound to confidentiality. We do not sell data.
Where providers are in the United States, transfers rely on an adequacy decision (including the EU-US Data Privacy Framework) and/or Standard Contractual Clauses, plus the measures those providers publish.
16. Your rights
You have the rights under Art. 15–21 GDPR: access, rectification, erasure, restriction, data portability, and to object to processing based on Art. 6 (1)(f) GDPR (Art. 21). Where processing is based on consent (analytics and session recordings), you may withdraw it at any time with effect for the future via Cookie settings.
To exercise your rights, email info@everyslab.com. You also have the right to lodge a complaint with a supervisory authority — in particular in your Member State of residence, work or the place of the alleged infringement, or at our seat: Berliner Beauftragte für Datenschutz und Informationsfreiheit.
17. Right to object (Art. 21 GDPR)
You may object at any time, on grounds relating to your particular situation, to processing based on Art. 6 (1)(f) GDPR. We will then stop that processing unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
18. Minimum age
EverySlab is not directed at children under 16. Do not create an account if you are under 16.
19. Changes
We will update this policy when the service or the law changes. The date at the top is the last revision. For registered users we will send a notice by email if a change is material. See also the imprint and the terms of use.