COLLECTR VAULT
Privacy Policy
Last updated: August 4, 2026
Collectr Vault ("we", "us", "our") operates the online store at www.collectrvault.com, selling trading card game products in the Kingdom of Bahrain and the GCC. This policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have over it. It applies to our website and to any of our official sales channels on social media platforms (including Meta platforms such as Instagram and Facebook).
1. Who is responsible for your data
Data controller: Collectr Vault, Kingdom of Bahrain
Contact: collectrvault@gmail.com
Website: www.collectrvault.com
2. What we collect
| Category | Data | When |
|---|---|---|
| Account | First and last name, email address, phone number, password (stored only as a salted cryptographic hash — never in plain text). If you sign in with Google: your name, email and Google account identifier. | When you create an account or sign in with Google |
| Orders & shipping | Recipient name, phone number, delivery address, items purchased, order totals, and a payment gateway order reference. | When you place an order |
| Payment | We never receive or store your card number, CVV, or wallet credentials. All payments are processed by CrediMax B.S.C. on the Mastercard Payment Gateway (including Apple Pay). We receive only a masked card reference (e.g. last 4 digits), the payment status, and amount for verification. | When you pay |
| Newsletter | Email address. | When you subscribe |
| Seller applications | Name, contact details, and the message you submit. | When you apply to sell to us |
| Product ratings | Your rating linked to your account. | When you rate a product |
3. What we do NOT collect
- We do not use advertising trackers, analytics pixels, or fingerprinting scripts on our website.
- We do not set tracking cookies. Your browser's local storage holds only your login session token, cart contents, and currency preference — none of which are shared with third parties.
- We do not sell, rent, or trade your personal data to anyone. Ever.
4. Why we use your data (purposes and legal basis)
- To fulfil your orders — process payment verification, arrange delivery, send order confirmations (performance of a contract).
- To operate your account — authentication, saved addresses, order history (performance of a contract).
- To prevent fraud — every payment is independently verified with the payment gateway before an order is confirmed (legitimate interest / legal obligation).
- To send you marketing — only if you subscribed to the newsletter; every message includes a way to unsubscribe (consent, withdrawable at any time).
- To respond to you — support requests and seller applications (legitimate interest).
5. Who we share data with (processors)
We share personal data only with the service providers required to run the store, and only the minimum each one needs:
| Provider | Purpose | Data involved |
|---|---|---|
| CrediMax B.S.C. / Mastercard Payment Gateway Services | Payment processing (cards, Apple Pay) | Order amount and reference; card data is entered directly on their secure page and never touches our servers |
| Supabase | Secure database hosting | Account, order, address, newsletter and rating records |
| Resend | Transactional email delivery | Your email address and order confirmation content |
| Optional "Sign in with Google" | Google verifies your identity to us; governed by Google's own privacy policy | |
| Shippo | Shipping rate calculation | Delivery destination details |
| Cloudflare | Website hosting, security and DDoS protection | Standard connection logs (IP address, user agent) processed to serve and protect the site |
If you purchase or interact with us through Meta platforms (Instagram or Facebook Shops, Messenger, or Instagram Direct), the data you provide on those platforms is also processed by Meta Platforms, Inc. under Meta's Privacy Policy. We receive from Meta only what is necessary to fulfil your order or answer your message.
6. How we protect your data
- All traffic is encrypted with HTTPS/TLS, enforced by HSTS.
- Passwords are stored only as salted PBKDF2 (SHA-256, 100,000 iterations) hashes — we cannot read your password.
- Card payments are handled end-to-end by a PCI DSS–compliant payment gateway; Apple Pay transactions are additionally device-encrypted and tokenised, so your real card number is never transmitted to us or the merchant page.
- Every payment is verified server-to-server with the gateway before an order is accepted, preventing tampering.
- Administrative access to order data is restricted and authenticated.
7. How long we keep data
- Order records — kept as long as required for accounting, warranty and dispute-resolution obligations.
- Account data — kept until you ask us to delete your account.
- Newsletter emails — kept until you unsubscribe.
8. Your rights
In line with the Bahrain Personal Data Protection Law (Law No. 30 of 2018) and, where applicable, the GDPR, you may at any time request:
- Access — a copy of the personal data we hold about you;
- Correction — fixing inaccurate or incomplete data;
- Deletion — erasure of your account and personal data (subject to records we are legally required to keep, e.g. tax records of completed orders);
- Objection / withdrawal of consent — including unsubscribing from marketing;
- Portability — your data in a machine-readable format.
To exercise any of these rights, email collectrvault@gmail.com from the address linked to your account. We respond within 30 days. You also have the right to lodge a complaint with the Personal Data Protection Authority of the Kingdom of Bahrain.
9. Children
Our store is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us personal data, contact us and we will delete it.
10. International transfers
Some of our processors (Supabase, Resend, Google, Cloudflare, Shippo) may store data on servers outside Bahrain. We only use providers that apply recognised safeguards for international data transfers.
11. Changes to this policy
We will post any changes on this page and update the "Last updated" date above. Material changes affecting how your data is used will be communicated by email where we hold one.