Privacy Policy

1. What we collect

To run WaxEngine we collect: your account email and password hash; the card photos you upload; listing, order, and sales data pulled from your connected eBay account; the authorization tokens eBay issues when you connect (never your eBay password); your app settings; and basic usage data such as scan counts for quota metering. Order data from eBay includes your buyers' names, usernames, and shipping addresses, which we hold so you can print envelopes and manage fulfillment; buyer contact details are automatically redacted 120 days after the order, and sooner if eBay tells us the buyer closed their account. If you join the waitlist or use the contact form, we store the message and email you provide. If you answer the short feedback question on this site, we store your selected reason and any free-text comment you choose to add; the survey does not ask for or store your name or email.

2. How it's used

Your data is used to provide the product you signed up for: photos are processed by automated identification systems (AI) to recognize cards; your sales history powers your own pricing and profit reports; your eBay tokens let the app perform the actions you trigger. Some features also send listing titles and prices to an AI provider to generate market commentary and selling advice for you (Market Intel and Pulse); the context we assemble for these features never includes buyer names, addresses, or messages. (What you type into the Pulse chat yourself is sent to the AI provider as typed, so don't paste information you wouldn't share.) One thing is shared in de-identified form: when your cards sell, the card title, sale price, and date (never your name, store name, buyer, or any account link) join a pooled comparable-sales database that powers pricing suggestions for all WaxEngine subscribers, the same way your pricing suggestions draw on other subscribers' anonymous sales. We do not sell your data and we do not share it with advertisers or data brokers.

3. Who processes it

WaxEngine runs on established providers, each receiving only what it needs: Supabase (database and file storage), Railway (application hosting), Cloudflare (site hosting and traffic routing), Stripe (payments; we never see full card numbers), eBay's APIs (your marketplace data), Google and Anthropic (AI processing: card-photo identification, and the listing/sales context described in section 2), Resend (the emails we send you), Crisp (the support chat in the app and on this site; it stores the messages you send and sets a cookie so an open conversation follows you between pages), and PostHog (product analytics keyed to an internal account ID, with no names, emails, or card data in the events). This marketing site also uses PostHog to measure page views and button clicks in aggregate.

4. Cookies and tracking

The app uses cookies to keep you signed in. The app and this site also load a Google Ads conversion tag so we can tell Google when an ad click led to a signup; it reports the signup event to Google and may set Google cookies, but we send it no names, emails, card data, or eBay data. Beyond that there is no third-party ad tracking. This site uses first-party analytics to understand which pages people visit and which buttons they use, stored in your browser's local storage rather than cookies, along with a small record of how you first arrived (the landing page, referring site, and any campaign tags on the link). When you follow a signup link, that arrival record travels with the link so we know which page earned the signup. We never sell this data, it contains no name or email, and automated visitors are excluded rather than counted. If we ever enable session replay on this site to understand usability problems, everything you type is masked before it reaches us. If you want to be excluded from analytics on this site, email us and we will tell you how, or simply use your browser's tracking protections. If you visit from the EU, the EEA, the UK or Switzerland, nothing above loads until you choose Accept all or Reject all in the cookie banner; the choice is kept for 12 months in one cookie shared by this site and the app, and the "Cookie choices" link in the footer lets you change it. The live chat is the one exception: if you reject cookies and then open the chat yourself, it loads because you asked for it.

5. Retention and deletion

Your data is kept while your account is active, with two automatic exceptions: buyer names and shipping addresses are redacted 120 days after each order, and cached eBay active-listing data expires after 30 days. Deleting your account from Settings removes your photos, scans, listings data, orders, eBay connection, and settings from our systems; billing records are kept as long as tax and accounting law requires. Anonymized pooled sale records (card title, price, date; see section 2) contain no link back to your account and remain in the pool. If eBay notifies us that a buyer closed their eBay account, we erase that buyer's personal data right away. You can also request deletion or a copy of your data by email.

6. WaxEngine apps in ChatGPT

WaxEngine offers free tools inside ChatGPT: Card Price Check, Card Sales Lookup, Card Listing Writer, Pokemon Bulk Value, and Card Fee Calculator. They need no WaxEngine account. When you use one, ChatGPT sends us only what the tool needs: the card's details (such as player or card name, year, set, number, parallel, and grade), the marketplace (US or Canada), and for the fee calculator the prices and costs you enter. ChatGPT may also attach technical hints such as your language setting and approximate location, which we do not use or store. We never receive your name, email, ChatGPT account, or conversation. We use these details only to answer that request: we look up recent sales in our sales database and, when needed, ask our licensed sales-data providers (The Card API, CardSight, and JustTCG for Pokemon and Magic prices) using the card's details alone. When a provider is asked, the sales it returns (listing title, price, date, and the card search we sent) are saved to our shared sales database for future lookups, with nothing that identifies you, and a provider's answer may be held in server memory for up to 12 hours so a repeat question does not ask again. Beyond that we keep a daily count of how many times each tool was used, and our hosting providers keep routine server logs (the time, the tool used, and any error) for up to 30 days, after which they are deleted automatically. OpenAI's handling of your ChatGPT conversation is covered by OpenAI's own privacy policy.

7. Your rights and contact

WaxEngine is operated from Ontario, Canada and handles personal information in line with Canadian privacy law (PIPEDA). You can access, correct, export, or delete your personal information at any time. Questions or requests: hello@waxengine.com. If we ever change this policy in a meaningful way, we'll tell you by email or in the app first.

8. If you are in the European Union, EEA, United Kingdom or Switzerland

This section adds to everything above wherever the EU GDPR, the UK GDPR or Swiss data protection law applies to you. The controller of your personal data is WaxEngine, operated by Christopher Loubert in Ontario, Canada, reachable at hello@waxengine.com.

Why we may process your data. To provide the service you signed up for, including your trial (performance of a contract). To keep the service secure, measure how it is used, prevent abuse and improve it (our legitimate interests, which we have weighed against your rights). To keep the billing records Canadian tax and accounting law requires (our legitimate interest in meeting those duties). For anything else, such as marketing email, only with your consent, which you can withdraw at any time without affecting what happened before.

Where your data goes. Your data is stored and processed in Canada by a business covered by PIPEDA, which the European Commission and the UK recognise as providing adequate protection. Some of the providers in section 3 process data in the United States. Each of them is bound by a data processing agreement, and transfers to them rely on the EU-US Data Privacy Framework and its UK Extension where the provider is certified, or on the European Commission's Standard Contractual Clauses with the UK Addendum.

Your buyers' data. For the names, addresses and messages of people who buy from your eBay store, you are the controller and WaxEngine is your processor. This paragraph is our data processing agreement with you. Subject matter and duration: the buyer data eBay sends for your orders, for as long as you have an account, with the 120-day redaction in section 5. Nature and purpose: storing it and showing it to you so you can ship, message and manage orders. We act only on your instructions, which are the features you turn on and the actions you trigger. Everyone with access is bound by confidentiality. Our sub-processors are the providers in section 3; we will tell you by email or in the app before adding one, and you may object. We help you answer buyers' requests about their data, and we tell you without undue delay if we learn of a breach involving it. When you delete your account we delete it. On request we will provide the information needed to show we meet these obligations.

Your rights. You can ask us to access, correct, erase or restrict your personal data, object to processing based on our legitimate interests, receive your data in a portable format, and withdraw any consent you gave. Deleting your account from Settings erases your service data right away; billing records stay as described in section 5. For everything else, email us and we will act on your request without undue delay and within one month, or tell you within that month if the law allows us up to two more. We do not make decisions about you by automated means that have legal or similarly significant effects. If you believe we have handled your data unlawfully, you can complain to the data protection authority where you live, for example the data protection authority of your German state (Landesdatenschutzbehörde) or the Information Commissioner's Office in the UK, although we would welcome the chance to resolve it with you first.

Security and breaches. Data is encrypted in transit and at rest with our providers, access is limited to what the service needs, and eBay tokens are held only to perform the actions you trigger. If a personal data breach is likely to put people's rights at risk, we notify the relevant authority without undue delay and, where feasible, within 72 hours of becoming aware. If the risk to you is high, we tell you without undue delay. For your buyers' data, where we are your processor, we tell you without undue delay.