Kontora legal
Privacy Policy
We collect the personal information we need to run the marketplace, and nothing for advertising. This policy follows Canada's PIPEDA and Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25).
1. Person in charge of personal information
Ce document est offert en français : version française. The French version is presented to you first. You may choose to be bound by this English version instead, by ticking the box provided for it before you pay or set up payouts.
[LEGAL ENTITY NAME] is responsible for the personal information described here. The person in charge of the protection of personal information is:
President, [LEGAL ENTITY NAME]
Email: privacy@kontoramarket.com
Phone: 438-874-5056
Mail: 1605 avenue de Queylus, Montréal, QC H2M 1E2
Contact this person for any question, request or complaint about your personal information.
How we govern personal information
- Who can see it inside Kontora. Only the people who run support, and only what a task needs (an order, a claim, a report, a tax record). Their access is personal, needs a two-step sign-in with an authenticator app, and is limited by rules in the database. Sellers see a buyer's name and shipping address for their own orders only. Our service providers (section 6) act under written contracts.
- How long we keep it. Each kind of information has its own period, listed in section 8. At the end, we delete it or make it anonymous.
- How to make a request. Download or delete your data yourself from your account, correct your name and email there, or write to privacy@kontoramarket.com for anything else (section 11). We answer within 30 days.
- How to complain. Write to our person in charge first. If you are not satisfied, you can complain to the Commission d'accès à l'information du Québec, cai.gouv.qc.ca (section 12).
- Incidents and changes. We keep a register of privacy incidents (section 13), and we assess the privacy impact of any new system or transfer outside Quebec before using it (section 7).
2. What we collect
| Information | From whom | Why |
|---|---|---|
| Email address, name, and your confirmation that you are 14 or older | You, when you create an account (we use a 6-digit email code or Google to sign you in: Kontora has no password to store) | Sign-in, account security, order emails, the minimum age |
| Name and shipping address, province | You, at checkout | Delivery by the seller, sales tax by province |
| Order history, messages with sellers, Guarantee claims, reviews | You and sellers | Providing orders, support, disputes, tax records |
| Comments on our articles, the public name you pick for them, your likes, upvotes and reports | You, when you comment, like, vote or report | Showing your comments with the name you chose (never your email or real name unless you type it), keeping the discussion safe |
| Payment details | You, entered on Stripe's page | Payment. Stripe handles card data; we receive only limited details such as card brand, last 4 digits and payment status. With your consent, Stripe keeps the card for up to an hour to pay the other sellers of the same cart |
| Seller identity and banking (legal name, date of birth, address, tax number, bank account) | Sellers, entered with Stripe during Stripe Express onboarding | Identity verification, payouts, fraud prevention, platform tax reporting |
| Photo of a card you scan with "Scan a card" | You, with your camera or a photo you choose | Finding that card in the catalogue. The photo is matched by computer, then deleted by the scanner; the scanner never stores it, and no one looks at it. If you then tap "Sell this card", the same photo is offered as your listing's first photo: it stays on your device and is stored only if you keep it and create the listing; it is then shown on your listing like your other photos (you can remove it first). Which suggested card you then choose is kept, without the photo, your account or your address, to measure and improve the scanner |
| IP address, device and browser type, pages requested, error logs | Your browser, automatically | Security, fraud prevention, fixing problems |
We do not collect social insurance numbers from buyers. We do not buy personal information from data brokers.
3. How we use it
- to create and secure your account;
- to process orders, payments, refunds and Guarantee claims;
- to let a seller ship your order (the seller receives your name and shipping address for that order only);
- to send transactional emails such as order confirmations, shipping notices and account security messages;
- to send the Kontora Weekly newsletter to people who asked for it (section 15);
- to prevent fraud, counterfeits and abuse;
- to meet legal duties, including tax records and platform-operator reporting to the Canada Revenue Agency and Revenu Québec;
- to answer your questions, including in the help chat: what you type there, and the details of your own order when you ask about it, is sent to our AI provider to write the answer, and is not stored by Kontora.
We do not sell personal information, and we do not use it for advertising profiles.
4. Consent and legal basis
We use your information for the purposes above with your consent, which you give when you create an account or place an order, or where the law requires or allows it (for example, tax records). We ask for separate, express consent for anything optional: visit counts (off until you accept them, section 5), and the Kontora Weekly newsletter (section 15). You may withdraw consent at any time, subject to legal or contractual limits; if you withdraw consent needed to run an order, we may be unable to complete it.
5. Cookies and local storage
Everything Kontora stores in your browser is needed for the site to work, except visit counts, which stay off until you accept them. Nothing we use identifies, locates or profiles you for advertising, and we use no advertising or cross-site tracking cookies or pixels. You can change your choice at any time with Cookie settings at the bottom of every page.
| Name | Kind | What it is for | Kept |
|---|---|---|---|
| sb-…-auth-token | Browser storage, necessary | Keeps you signed in | Until you sign out |
| portage.cart, portage.saved | Browser storage, necessary | Your cart, and your watchlist when you are not signed in | Until you empty them |
| portage.lang, portage.currency, portage.theme, portage.prov, portage.view, portage.listPer | Browser storage, necessary | Language, currency, light or dark display, delivery province and how lists are shown | Until you change them |
| portage.orderLinks | Browser storage, necessary | The private links to orders you placed as a guest on this device | Until you clear it |
| portage.age14, portage.consent | Browser storage, necessary | That you confirmed you are 14 or older, and your choice about visit counts | Until you clear it |
| portage.k2s | Browser storage, necessary | Card page addresses already looked up, so pages open faster | Until you clear it |
| portage.scanRecent | Browser storage, necessary | The last cards you scanned (name and number only, never the photo), to find them again; never sent to us | Until you clear them (Clear recent scans) |
| kt_lang | Cookie, necessary | Opens the home page in the language you chose with EN/FR | 1 year |
| kt_cc | Cookie, necessary | Your country, read from your connection (never a city or an exact location), to show prices in your currency | 30 days |
| portage.checkoutForm, portage.lastOrder, portage.helpLog, kt.viewed and similar | This tab only (session storage), necessary | The checkout address, the order summary after payment, the help chat conversation, and which listings you saw (to count each view once, without knowing who you are) | Until you close the tab |
| Offline copies | App cache, necessary | If you install Kontora as an app: a few files so it opens offline | Until the app updates |
Third parties: the Stripe payment page sets its own cookies for payment security and fraud prevention; Cloudflare's bot checks (including Turnstile at checkout) run in your browser to block automated abuse; Cloudflare Web Analytics counts visits only if you accept it in the privacy bar or in Cookie settings: it sets no cookie and stores no identifier, and we see only totals (pages, countries, referring sites, load times), never who visited; some card images may be loaded from external image servers. These services receive your IP address when your browser contacts them.
6. Who we share it with
- Sellers: your name, shipping address and order details, for orders with that seller only. Sellers may use this information only to fulfil and support your order.
- Service providers who process information on our behalf under contract, with security obligations:
| Provider | Role | Where data is stored or processed |
|---|---|---|
| Supabase | Database and sign-in | Canada (AWS region ca-central-1, Montreal) |
| Stripe | Payments, seller identity verification and payouts | Canada and other countries, including the United States |
| Cloudflare | Website hosting, content delivery, bot protection at checkout (Turnstile), cookieless visit counts (Web Analytics) and the card scanner (matches a scanned photo, then deletes it); serves pages from the data centre nearest you; receives IP addresses in its logs | Global network, including Canada and the United States |
| Resend | Sending transactional emails and the newsletter | United States |
| Anthropic | Answers in the help chat (the messages you type there and, when you ask about it, your own order); the French translation of what sellers write publicly (listing notes, store pages, lots), without the seller's name | United States |
- Authorities, where the law requires it, such as tax authorities or a court order.
- A buyer of our business, if Kontora is sold or merged, under an agreement that protects your information.
7. Transfers outside Quebec and Canada
Our main database is in Canada. Some providers listed above process information outside Quebec or outside Canada, where local laws may allow authorities to access it. Before we send personal information outside Quebec, we carry out a privacy impact assessment that considers the sensitivity of the information, the purpose, the protection measures and the legal regime of the destination, and we sign a written agreement with the provider. You can ask our person in charge for more information about these transfers.
8. How long we keep it
| Information | Kept for |
|---|---|
| Orders, payments, refunds, invoices | 6 years after the end of the tax year of the order, as tax law requires (Income Tax Act s.230(4), Quebec Tax Administration Act s.35); in practice up to 7 years after the order date |
| Account (profile, preferences) | Until you delete it, then 30 days before final deletion |
| Server, security and error logs | 12 months |
| Emails we sent you (copies and delivery status) | 12 months |
| Photos of cards you scan | Not kept by the scanner: deleted as soon as the card is found (a few seconds). Kept only if you add it to a listing: it then stays with that listing like your other photos |
| Which scanner suggestion you chose (the cards shown and the one picked; no photo, account or address) | 12 months |
| Questions to sellers before buying, and their answers | 12 months after the last message |
| Comments on articles, your public name, likes, upvotes and reports | Until you delete them or your account. Comments are public: anyone can read them. A deleted comment that has replies keeps its place as "Comment deleted", with nothing of yours left in it |
| Checkouts never paid (name, email, address) | 90 days |
| Newsletter sign-up never confirmed (email, language, games, consent record) | 30 days |
| Newsletter subscription (email, language, games, consent record) | Until you unsubscribe, then 30 days (so the undo link works). After that we keep only a one-way code of the address (SHA-256), so it is never added again by mistake |
| Seller platform-reporting information | As long as tax law requires |
When a retention period ends, we delete the information or make it anonymous.
9. How we protect it
We use encryption in transit (HTTPS), access controls in the database that limit each user to their own data, restricted staff access, and providers with recognised security certifications. No system is perfectly secure; if something goes wrong, see Privacy incidents.
10. Your rights
You have the right to:
- access the personal information we hold about you;
- correct information that is inaccurate, incomplete or out of date;
- withdraw consent, subject to legal or contractual limits;
- delete your account and the information we are not required to keep;
- data portability: if you live in Quebec, receive the information you provided in a structured, commonly used technological format, or have it sent to another organisation;
- ask that information be de-indexed where Quebec law allows it.
Decisions made automatically. Some decisions are made by rules, with no person involved at that moment:
- a new seller's payouts are held for a set number of days, and their first sales must ship tracked, until they have enough completed sales;
- a seller Stripe has not verified yet can list only a limited number of items, and buyers cannot pay them until Stripe verifies them;
- listing notes, shop descriptions and messages that contain a phone number, an email, a link or a request to pay outside Kontora are refused or flagged;
- a listing above a set price is hidden until it has a photo;
- an unshipped package can be cancelled after the shipping deadline, and offers expire after their time limit;
- the number of checkouts and help chat questions per hour is limited, and Stripe and Cloudflare screen payments and checkouts for fraud and bots, which can decline them.
You can ask for a person at Kontora to review any of these decisions, and to know the main reasons and factors behind it, by writing to privacy@kontoramarket.com. We answer within 30 days.
11. How to make a request
You can do these yourself, from your account page (Account, then Profile): correct your name and email (a new email is confirmed from both inboxes; an account signed in with Google keeps Google's email); and Download my data gives you a copy of your account's information in a structured file (JSON); Delete my account deletes it 30 days after you confirm, unless you sign in and cancel before then. Deletion waits until your open orders, sales, claims and payouts are finished. It removes your profile, saved cards, alerts and sign-in, and your name, address and email from your orders; the orders themselves are kept for the periods in section 8 without them.
Until a package ships, you can fix its shipping address yourself from your order page (the seller sees the corrected address); once it has shipped, the order keeps the address it was shipped to. For anything else, including correcting an address on an order, write to our person in charge of the protection of personal information at privacy@kontoramarket.com. We may ask you to confirm your identity. We answer every request within 30 days of receiving it. Access and correction are free.
12. Complaints
Please contact our person in charge first, at privacy@kontoramarket.com. If you are not satisfied, you can complain to:
- in Quebec, the Commission d'accès à l'information du Québec (CAI);
- anywhere in Canada, the Office of the Privacy Commissioner of Canada (OPC).
13. Privacy incidents
We keep a register of every confidentiality incident involving personal information, and act quickly to reduce the risk of harm. If an incident presents a risk of serious injury (Quebec) or a real risk of significant harm (federal law), we notify the people affected, the Commission d'accès à l'information and the Office of the Privacy Commissioner of Canada as required, and any organisation that can help reduce the harm.
14. Children and teens
People under 14 may not create an account, and we do not knowingly collect their personal information. Buyers aged 14 to 17 may use Kontora only with the permission of a parent or guardian. Selling requires being 18 or older. If you believe a child under 14 has given us information, contact us and we will delete it.
15. Emails and Canada's anti-spam law
- Transactional emails (order confirmation, shipping, claims, security, changes to these documents) are not marketing; we send them because they are needed to provide the service.
- Marketing emails (newsletters, promotions) are sent only if you have given express consent, for example by ticking an unchecked box. Every marketing email identifies Kontora, gives our contact details and has a working unsubscribe link.
- Kontora Weekly is our newsletter: one email a week with new guides and news, trending cards and sealed products, and marketplace news. You subscribe by entering your email address and ticking a box that is not ticked in advance, then by clicking the link in the confirmation email we send you; nothing else is sent before that click. We keep the record of your consent: when, on which page and which wording you agreed to. We collect only your email address, your language and the games you chose. The newsletter has no tracking pixel and no tracked links: we do not know whether you open it. Links to our site carry a label (utm) so our own visit counts show which visits came from it.
- Unsubscribe requests are honoured without delay, and in any case within 10 business days.
16. Changes to this policy
We will post any change here with a new date. If a change affects how we use information you already gave us, we will tell you in advance and ask for consent where required.