Privacy Policy

Summary (the short version)

• Who we are: Binderim (binderim.com and the Binderim iOS/Android apps) is operated by Croone LTD, a company registered in England and Wales. Croone LTD is the controller of your personal data (in Turkish law: veri sorumlusu).
• What we use your data for: to run your account, your collection, the marketplace (orders, payments, shipping), the Café community feed, the Binderim AI assistant and card scanning, and to keep the platform safe.
• We do not sell your personal data. We only use analytics and advertising cookies on the website if you agree to them.
• Where your data lives: our main server and database are in Türkiye, on a virtual server that Croone LTD manages itself. Some trusted providers (for example Stripe, Google and Cloudflare) process data in other countries, including the United States, as described in Section 9.
• Card Scan: photos you take with Card Scan are sent to Google Gemini to recognise the card and are not stored permanently by us (Section 7).
• Your rights: you can ask to access, correct, delete or export your data, object to some uses, and withdraw consent at any time. Which rights apply depends on where you live: if you live in the United Kingdom you can complain to the Information Commissioner's Office (ICO); if you live in Türkiye, to the Personal Data Protection Authority (KVKK). See Section 12.

1. Who we are and how to contact us

This policy applies to everyone who uses Binderim: visitors, registered users, collectors, buyers, sellers and Café members, on the website and in the apps. It is written to meet both the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and the Turkish Law No. 6698 on the Protection of Personal Data (KVKK). Because we run a single account system for all users, the same protections apply to everyone, wherever you use Binderim from.

Our role in the marketplace. Croone LTD provides the marketplace as an intermediary service provider. Cards are sold by independent individual or business sellers, not by Croone LTD. Binderim operates the Türkiye market today (sellers and buyers in Türkiye, delivery within Türkiye, prices and payments in TRY); once the United Kingdom market launches, it will operate separately (sellers and buyers in the United Kingdom, delivery within the United Kingdom, prices and payments in GBP). Orders are placed with sellers in the same market. When you buy from a seller, that seller receives the information needed to complete your order (Section 8.2) and becomes responsible for how they use it for that order.

2. The personal data we collect

2.1 Data you give us

• Account data: name, e-mail address, username, password (stored only as a secure hash), and — if you sign in with Google or Apple — the identifier and basic profile information that provider shares with us.
• Profile data: information you choose to show on your profile (display name, profile photo, bio, visibility settings).
• Collection data: the cards, binders, sets, favourites and watch lists you record.
• Marketplace data — Buyers: delivery name, phone number and delivery address (in the market you buy in: province/district in Türkiye; once the United Kingdom market launches, a postcode-based address in that market — address line(s), town/city and postcode, with no province/district equivalent), order history, messages with sellers, reviews, complaints and returns.
• Marketplace data — Sellers: seller profile, contact phone and contact e-mail, listings, prices and stock, sales history, shipping details, payout information; billing details (name or company name, Turkish national ID number or tax number and tax office, address, phone), the bank account you are paid to (bank name, IBAN, account holder) and — for sellers in the United Kingdom — a National Insurance (NI) number for HMRC reporting purposes (stored encrypted).
• Payment data: payments, subscriptions and seller payouts are processed by Stripe. We receive limited details (for example payment status, amount, the last digits and brand of a card, and failure reasons) but we do not store your full card number. In-app purchases in the mobile apps are processed by Apple or Google Play. For orders paid by bank transfer, the seller's bank details (bank name, IBAN, account holder) are shown to the buyer at checkout.
• Wallet data: balance, credits, refunds and payout records in your Binderim wallet.
• Pro subscription data: plan, billing period, invoices/receipts and subscription status.
• Café content: posts, photos, comments, likes, follows, hashtags and card mentions.
• Binderim AI assistant data: the messages you send to the assistant and its replies (Section 7.2).
• Communications: messages you send to us (e-mail, support requests, reports and complaints).
• Promotions: participation in campaigns or monthly draws, where offered.
• Consent records: what you agreed to, when, and the wording and version you saw. This covers your marketing e-mail consent, your cookie choices, and — for subscribers in the United Kingdom — your confirmation at the payment step that the subscription should start immediately and that you therefore lose the 14-day cancellation right.

2.2 Data we collect automatically

• Device and app data: device type, operating system, app version, language, and a device or installation identifier; push notification tokens if you allow notifications.
• Usage data: pages and screens viewed, searches, clicks and interactions — for analytics only with your consent on the website (Section 10) and, in the apps, as described in Section 10.1.
• Log-in records: for every sign-in we record the IP address, country (derived from the network), browser/device (user-agent) and sign-in method (password, Google, Apple).
• Registration country: when you create an account we store the country code provided by our network provider (Cloudflare) for that request.
• Security and fraud-prevention data: see Section 6.
• Cookies and similar technologies: see Section 10 and our Cookie Policy.

2.3 Camera and Card Scan

When you use Card Scan in the mobile app, we ask for access to your device camera so we can recognise your trading cards. Camera access is optional, used only while you actively scan, and can be turned off at any time in your device settings. Card photos are used only to recognise the card, are sent to Google Gemini for that purpose, and are not stored permanently on our servers.

2.4 Data from third parties

• Google / Apple sign-in: identifier, e-mail and name (as permitted by you in that provider's screen).
• Stripe, Apple, Google Play: payment, subscription and payout status.
• Shipping providers: shipping label, tracking and delivery status — Kargonomi for orders in the Türkiye market; Sendcloud for orders in the United Kingdom market.
• Other users: for example when a buyer leaves you a review, a user reports your content, or someone mentions you in Café.

2.5 Special category data

We do not ask for special category data (for example health, religion or biometric data). Please do not include such information in Café posts, messages or AI conversations.

3. Why we use your data and our legal bases

UK GDPR requires us to rely on a lawful basis (Article 6) for each use; KVKK requires a processing condition (Article 5). The table below shows both.

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for more information about this balancing and you can object (Section 12).

Where we rely on consent, you can withdraw it at any time — for cookies on our cookie preferences page, for marketing e-mails by using the unsubscribe link or your account settings. Withdrawing consent does not affect processing that already took place.

If you do not provide data that we need to perform our contract with you (for example a delivery address for an order), we will not be able to provide that part of the service.

4. Public information

• Public profiles: if your profile is set to Public, your profile information and collection may be seen by other users. You can change this in your account settings.
• Café: posts (text and photos), comments and the public parts of your profile (display name, profile photo, follower counts) can be seen by all Binderim users and, on the website, by visitors who are not signed in. Do not include personal information you do not want to share (phone number, home address, financial details) in Café posts.
• Marketplace: your seller name, listings, ratings and reviews are public.

5. Café community and content moderation

5.1 What Café is

Café is a social feed on the website and in the app where users share their collections, pack openings and thoughts about trading card games. You can post, comment, like, follow users and use hashtags and card mentions.

5.2 How we moderate

To keep the community safe (including under Apple App Store Review Guideline 1.2 and Google Play's user-generated content policy) we use several layers:

• AI image moderation: every photo you upload to Café is checked by Google's AI service before it is published. If nudity, violence, hate or unlawful content is detected, the photo is not published and goes to a manual review queue.
• Text moderation: post and comment text is checked against Turkish and English profanity/hate-speech word lists; if there is a match the content is not published.
• User reports: you can report any post or comment (Spam, Harassment, Adult content, Hate, Violence, Copyright, Child safety, Self-harm, Other). We aim to review reports within 48 hours.
• Blocking: you can block a user; their posts will not appear in your feed and they cannot mention or follow you. Your block list is private.
• Human review: reported and flagged content is reviewed by human moderators. Content that breaks our Community Guidelines is removed, and accounts may be suspended temporarily or permanently.

By posting in Café you agree to follow our Community Guidelines.

5.3 Keeping and deleting Café data

Your posts, comments and photos are kept until you delete them. You can delete your own posts and comments at any time. If you delete your account, your Café posts and messages are detached from your account and kept in anonymised form (they no longer show your name or profile). Content removed by moderators is kept, unpublished, so that the decision and any appeal can be reviewed.

6. Security, fraud prevention and automated decision-making

6.1 What we do for everyone

• Encrypted connections (TLS), firewalls and bot protection (Cloudflare, including Cloudflare Turnstile).
• Passwords stored as secure hashes; restricted, role-based staff access.
• Log-in records (IP address, country, user-agent, sign-in method) kept for 365 days.
• A session security key (bndr_sk) that ties your signed-in session to your browser.

No internet service is 100% secure, but we work to protect your data and will notify you and the relevant authority of a personal data breach where the law requires it.

6.2 Enhanced monitoring of accounts suspected of fraud

If there is a suspicion of fraud or a threat to account security (for example a complaint, a disputed payment or unusual activity), a member of our team may place the account under enhanced monitoring. While an account is monitored we may additionally record:

• detailed activity records (pages and actions, times, IP address, country, user-agent);
• limited device signals: time zone, screen size, language, platform and a random device key stored in a cookie/local storage (bndr_dk, up to 2 years). We do not use canvas/audio fingerprinting or request your location;
• related order and transaction records.

We use this to investigate fraud, protect other users and to establish, exercise or defend legal claims. Monitoring records are deleted 90 days after monitoring ends, unless we need them longer for an ongoing investigation, a legal claim or a request from an authority.

6.3 Automated decisions

• Accounts: decisions to place an account under monitoring, and any resulting suspension or closure, are made by people, not solely by automated systems.
• Café moderation: our automatic image and text checks can stop a post from being published. This is not a decision with legal or similarly significant effects on you, and flagged images are reviewed by a person. If you think content was blocked by mistake, contact us at [email protected] and a person will review it.
• Card Scan and AI assistant: AI results are suggestions only; they are not used to make automatic decisions such as purchases or account closures, and you should check them before accepting.

Under UK GDPR Article 22 and KVKK Article 11(1)(g) you have the right not to be subject to decisions based solely on automated processing that significantly affect you, and the right to object to an outcome against you that results exclusively from automated analysis.

7. Artificial intelligence features

7.1 Card Scan

Card Scan uses Google Gemini API (a generative AI service) to recognise trading cards. The photo is sent to Google only for recognition; the AI extracts the game, set, card name and number. Photos are not used for any other purpose and are not stored permanently by us. Results may be wrong — please review and correct them before accepting.

7.2 Binderim AI assistant

The Binderim AI assistant answers questions about cards, prices, your collection and the marketplace, and — where the feature is enabled (currently on the website) — can carry out certain actions on your account that you request: it can add or remove cards from your collection, wishlist or watch list (these actions can be undone) and, after you confirm, send a support request on your behalf.

• What is sent to Google: your messages, the conversation context and the information the assistant needs to answer (for example card data or relevant parts of your collection or orders). Do not share passwords, payment card numbers or other sensitive data with the assistant.
• Provider: Google Gemini API, acting as our processor.
• How long we keep it: AI usage records 180 days; records of actions performed by the AI on your account 90 days; cards mentioned in AI conversations 30 days.
• AI answers can be inaccurate. They are not financial or investment advice.

For information on how Google processes data, see the Google Privacy Policy and the Gemini API Terms.

8. Who we share your data with

We do not sell your personal data.

8.1 Service providers (processors / sub-processors)

We have contracts with our processors that require them to protect your data and use it only on our instructions.

8.2 Other users

• Sellers receive the buyer's name, delivery address, phone number and order details needed to fulfil and ship an order.
• Buyers see the seller's public profile, and receive the shipping and tracking information for their order.

Public information is visible as described in Section 4.

8.3 Legal requirements

We may disclose information where required by law, a court order, or a request from a public authority, or where necessary to establish, exercise or defend legal claims, prevent fraud, or protect the safety of our users.

8.4 Business transfers

If Croone LTD or the Binderim business is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction. We will tell you before your data becomes subject to a different privacy policy.

9. International transfers and where your data is stored

Storage location. Croone LTD is based in the United Kingdom, but our main server and database are located in Türkiye, on a virtual server that Croone LTD manages itself. Türkiye does not currently have a UK “adequacy” decision. The server is operated by Croone LTD itself: your data stays within Croone LTD and is not handed to another company, and the hosting provider does not access the content of the service. On that basis we do not treat this as a restricted transfer requiring separate transfer documents. Images, documents and backups are stored on Cloudflare R2.

Who your data reaches outside your own country, and why. The list below is for your information; the full provider list, with the data involved, is in Section 8.1.

• Croone LTD (United Kingdom) — as controller, our own team accesses the data from the UK to run the service and answer support requests.
• Stripe (EU / United States) — payments, escrow (“secure payment”), subscriptions, seller payouts and fraud checks.
• Google (United States and other countries) — Google Sign-In, the Gemini API behind Card Scan, the AI assistant and Café image moderation, Google Analytics 4 and Firebase Analytics (analytics only as described in Section 10), and Google AdSense on the Turkish website with your consent.
• Cloudflare (global network) — CDN, web application firewall and bot protection, and storage of images, documents and backups.
• Apple and Google Play (United States) — in-app purchases; Expo (United States) — delivery of push notifications.
• Shipping providers in the market you buy in — Kargonomi for deliveries in Türkiye; Sendcloud (Netherlands) for deliveries in the United Kingdom.

Wherever your data is stored or processed, we apply the same protections: access controls, encryption in transit, application-level encryption of certain sensitive fields (for example UK National Insurance numbers and integration access tokens), and contracts that require our providers to protect the data and use it only on our instructions.

If you have questions about how your data is handled abroad, write to [email protected].

10. Cookies and similar technologies

We use cookies and similar technologies (such as local storage) on the website. Strictly necessary cookies are always on; analytics and marketing cookies are only used if you agree. You can change or withdraw your choice at any time on the cookie preferences page. Full details, including a list of cookies, are in our Cookie Policy.

10.1 Mobile apps

The mobile apps do not use browser cookies but use similar technologies: secure storage for your sign-in, a device/installation identifier, push notification tokens and Firebase Analytics. Firebase Analytics only runs if you allow it in the app; you can change your choice at any time in the app's Settings > Privacy.

11. How long we keep your data

We keep personal data only as long as we need it for the purposes above, and then delete or anonymise it.

12. Your rights

Which set of rights applies to you depends on where you live — your country of residence, not the IP address you connect from. If you live in Türkiye, Turkish law and KVKK apply to you. If you live in the United Kingdom, UK GDPR and the Data Protection Act 2018 apply to you. In practice we apply the protections in this policy to all users, whichever country they are in.

Under UK GDPR (users living in the United Kingdom) you have the right to:

• Access — get a copy of your personal data;
• Rectification — correct inaccurate or incomplete data;
• Erasure — ask us to delete your data;
• Restriction — ask us to limit how we use your data;
• Data portability — receive data you gave us in a structured, machine-readable format, or have it sent to another provider;
• Object — to processing based on legitimate interests, and at any time to direct marketing;
• Withdraw consent — at any time, where we rely on consent;
• rights relating to automated decision-making (Section 6.3).

Under KVKK Article 11 (users living in Türkiye) you have the right to: learn whether your personal data is processed; request information about processing; learn the purpose of processing and whether data is used for that purpose; know the third parties in Türkiye or abroad to whom data is transferred; request correction of incomplete or inaccurate data; request deletion or destruction under the conditions in Article 7; request that correction/deletion be notified to third parties to whom data was transferred; object to an outcome against you arising exclusively from automated analysis; and claim compensation for damage caused by unlawful processing.

How to exercise your rights. E-mail [email protected] from the e-mail address linked to your account (or tell us your username). We may need to verify your identity. We will respond within one month (UK GDPR; extendable by two further months for complex requests, in which case we will tell you) and in any case within 30 days for KVKK requests. Requests are free of charge unless they are manifestly unfounded or excessive.

Complaints. If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the supervisory authority of the country you live in:

• if you live in Türkiye: the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) — kvkk.gov.tr (under KVKK, after first applying to us);
• if you live in the United Kingdom: the Information Commissioner's Office (ICO) — ico.org.uk/make-a-complaint, telephone 0303 123 1113.

13. Marketing communications

We send marketing e-mails (news, campaigns, offers) only if you have given us your consent:

• When you register, you can agree by ticking a box that is unticked by default. Registering does not depend on this choice.
• Existing users who registered before 17 September 2026 will be asked to give consent again; we will not send marketing e-mails to users who do not agree.
• We keep a record of your consent (date and time, how and where it was given, and the wording you agreed to) so that we can prove it, and a record of when you withdraw it.
• You can withdraw consent at any time, free of charge, using the unsubscribe link in every marketing e-mail or in your account settings.

Service messages about your account, orders and security are not marketing and will still be sent.

14. Third-party links

Binderim may contain links to third-party websites (for example store pages or card databases). This policy applies only to Binderim. We are not responsible for the privacy practices of other sites.

15. Children and age limits

Binderim has two age limits:

• 13 and over — account and community features. You must be at least 13 to create an account and to use the collection features, Café and messaging. We do not knowingly collect personal data from anyone under 13. If we learn that an account belongs to someone under 13, we delete the data and close the account.
• 18 and over — buying, selling and subscriptions. Marketplace purchases and sales, wallet transactions and Pro/Pro+ subscriptions are only for people aged 18 and over.

These limits are set out in our Terms of Service; we do not ask you to tick a separate age box when you register. If you believe a child under 13 is using Binderim, please contact [email protected].

16. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it last changed. If we make important changes, we will tell you in the app or on the website, or by e-mail, before they take effect. Where a change requires your consent, we will ask for it.

17. Contact

If you have questions about this policy or want to exercise your rights:

18. Applicable law and language

• Applicable law. Which law applies to you depends on where you live, not on the IP address you connect from or the language of the interface. If you live in Türkiye, Turkish law — including KVKK — applies to your relationship with us, and Turkish consumer arbitration committees and courts are available to you. If you live in the United Kingdom, UK law — including UK GDPR and the Data Protection Act 2018 — applies to you. This is explained in more detail in our Terms of Service.
• Language. This policy is published in Turkish and in English. If the two versions differ, the Turkish text is the reference for users living in Türkiye and the English text is the reference for users living in the United Kingdom.