Last updated 10 September 2026
What we collect, why we collect it, and what we do not do with it. It is a short list, and this page is written to stay that way.
Resku Solutions Limited (registered in England and Wales, company number 15482235) operates CardBuyer and is the data controller for the information described here. You can write to us at:
71-75 Shelton StreetCovent GardenLondon WC2H 9JQ
For anything about your data, email hello@cardbuyer.app. That address reaches a person, not a ticketing system.
Browsing CardBuyer requires no sign-up, no name and no email address. You can read every dealer profile and every card on the site without telling us anything about yourself, and we do not try to work out who you are.
Your email address, if you ask for updates. The newsletter form stores your address and the date you gave it, and nothing else. We rely on your consent, and you can withdraw it at any time by emailing hello@cardbuyer.app — we will delete the address rather than merely suppress it. We keep it until you ask us to remove it. There is no mailing service connected yet, so nothing has been sent to anyone.
Which dealer links are clicked. When you press a “Sell to” button we record the dealer, the card if there was one, which button you pressed, the page you came from, and the identification string your browser sends with every request. We use it to tell dealers how much interest their listing generates and to tell automated crawlers apart from real people, so those figures are honest. Our lawful basis is legitimate interests — running a referral directory means being able to show a dealer what it is getting. We keep these records for 24 months and then delete them.
How many people visit. We use Cloudflare Web Analytics to count visits and see which pages are read. It sets no cookies, stores nothing on your device, and cannot follow you to other sites. It reports totals to us, never individuals. Lawful basis: legitimate interests in knowing whether the site works.
An anonymous reference for people who have sold cards. Purchase records carry a one-way cryptographic hash instead of a seller’s identity. It reaches this site already hashed — the site never receives the original — and it exists only so we can count how many different people have sold to a dealer and how many came back. It is never displayed, never linked to a name, and cannot be reversed into one.
We do not store your IP address. We set no advertising or tracking cookies of any kind. We do not build a profile of you, do not track you across other websites, and do not sell, rent or share your data with anyone for marketing. There is no advertising on CardBuyer, and no third party is paid for what it learns here.
The site sets one cookie, and only for whoever is signed in to our own internal statistics page. It is strictly necessary to keep that person signed in and is set on nobody else. As an ordinary visitor you receive no cookies from us at all, which is why this site has no cookie banner asking you to click through.
The sale itself does not happen on this site. When you press “Sell to” you go to the dealer’s own submission flow on cardbuyer.app, which we also operate, and whatever you send — photographs, contact details, payment information — is handled there under that service’s terms and the dealer’s own arrangements with you. This site receives only the completed sale: the card, the price, the date, and the hashed reference described above. It never receives your name, your email address or your photographs.
We keep the site and its database with a small number of suppliers who process data on our instructions and for no purpose of their own: Supabase, which hosts the database in London; Railway, which runs the site itself; and Cloudflare, which provides the domain, the visit counts and image storage. Nobody else has access, and we do not transfer your data outside the UK or Europe except to the extent these suppliers operate global networks under safeguards approved for UK transfers.
Newsletter addresses: until you ask us to remove them. Dealer-click records: 24 months. Purchase records and the hashed seller reference: kept for as long as CardBuyer runs, because they are the site’s public record of what dealers have actually bought and removing them would misstate it.
CardBuyer is not aimed at children, and browsing needs no personal details from anyone. If you are under 13, please ask a parent or guardian before giving us your email address.
You can ask what we hold about you, ask for it to be corrected or deleted, ask us to restrict or stop using it, ask for a copy in a portable form, and withdraw any consent you have given. Email hello@cardbuyer.app and we will action it — normally within a few days, and within one month at the latest. We will not charge you and we will not ask why.
One honest limitation: the anonymous seller reference cannot be reversed, so if you have sold a card we have no way to find your records from your name or email address. That is the point of hashing it, but it does mean a request about purchase data is one we may be unable to fulfil from this site — the dealer platform is where those records are.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, or by calling 0303 123 1113. We would rather you told us first so we can put it right.
If what we collect changes, this page changes with it and the date at the top moves. We do not make changes quietly: anything that materially affects what we do with data already held will be explained here rather than absorbed into a new version.
