Privacy Policy
Last updated: 23 July 2026
This Privacy Policy explains how HoloVault ("HoloVault", "we", "us") collects, uses, and protects your personal data when you use our website atholovault.eu and related services (the "Service"). We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) and applicable national data-protection law.
1. Who we are (Data Controller)
The controller responsible for your personal data is:
- [OPERATOR LEGAL NAME]
- [OPERATOR POSTAL ADDRESS, EU]
- Privacy enquiries: privacy@holovault.eu
- General support: support@holovault.eu
2. The data we collect
We only collect data we need to run the Service:
- Account data (via Discord login). When you sign in with Discord we receive and store your Discord user ID, your display name, and your email address. We do not receive your Discord password.
- Collection & deck data. The cards you record as owned, decks you build, saved decklists, and related notes.
- Card scans & uploads. Images captured with the phone scanner and CSV files you import, processed to identify cards and update your collection.
- AI feature content. The collection context and natural-language queries you submit to our AI recommendation and search features, plus a count of your AI usage (to apply free/Supporter quotas).
- Subscription & payment data. If you subscribe to the Supporter tier, a customer reference and subscription status. Card/bank details are handled directly by our payment processor (see Section 5) — we never see or store your full payment card number.
- Technical data. Server logs including IP address, browser/user-agent, timestamps, and error diagnostics, used for security and reliability.
3. How and why we use your data (legal bases)
Under Article 6 GDPR, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Creating your account, authenticating you, and providing core collection/deck features | Performance of a contract (Art. 6(1)(b)) |
| Processing card scans, CSV imports, and AI recommendations/search you request | Performance of a contract (Art. 6(1)(b)) |
| Processing Supporter subscriptions and payments | Performance of a contract (Art. 6(1)(b)) |
| Keeping invoicing and tax records | Legal obligation (Art. 6(1)(c)) |
| Securing the Service, preventing abuse, and improving reliability | Legitimate interests (Art. 6(1)(f)) |
We do not use your personal data for advertising, and we do not sell your personal data.
4. Cookies
HoloVault uses only strictly necessary cookies to keep you signed in — anaccess_token and a refresh_token session cookie set after you log in with Discord. These are essential to provide the Service you request, so under the ePrivacy rules they do not require a consent banner. We do not use advertising or third-party tracking cookies.
5. Who we share data with (processors & recipients)
We share data only with service providers ("processors") who help us operate the Service, under contracts that require them to protect your data:
- Discord — authentication (sign-in). See Discord's privacy policy for how they process your data.
- Mollie — payment processing for the Supporter subscription (EU-based payment provider). Your payment details are handled by Mollie under their own privacy policy.
- AI model providers — the collection context and queries you submit to AI features are sent to third-party large-language-model providers (currently the models marketed as Gemini) via their APIs to generate recommendations and search results.
- Hosting & infrastructure — Oracle Corporation, where the Service and its database are hosted (eu-milan-1 region).
- ForceTable — only when you explicitly choose to export a deck, the decklist is sent to ForceTable at your request.
We may also disclose data where required by law or to protect our legal rights.
6. International transfers
Some processors — in particular certain AI model providers — may process data outside the European Economic Area (EEA). Where that happens, we rely on appropriate safeguards under Chapter V GDPR, such as an adequacy decision or Standard Contractual Clauses (SCCs). Avoid submitting sensitive personal information to AI features.
7. How long we keep your data
- Account, collection, and deck data: for as long as your account is active.
- Card scan images: processed to identify cards; not retained beyond what is needed to update your collection.
- Payment & invoicing records: retained for the period required by applicable tax and accounting law (8 years under the Hungarian Accounting Act).
- Server logs: retained for a limited period for security and diagnostics (90 days).
When you delete your account, we delete or irreversibly anonymise your personal data, except where we must keep it to meet a legal obligation.
8. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten");
- Restrict or object to certain processing;
- Data portability (receive your data in a machine-readable format);
- Withdraw consent at any time, where processing is based on consent;
- Lodge a complaint with a supervisory authority.
You can delete your account and associated personal data yourself at any timefrom your account settings in the app. To exercise any other right, emailprivacy@holovault.eu. We will respond within one month as required by the GDPR.
You also have the right to complain to your local data-protection authority. Our lead supervisory authority is the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, "NAIH"),naih.hu.
9. Security
We use appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), access controls, and short-lived authentication tokens. No system is perfectly secure, but we work to protect your information and will notify you and the relevant authority of a qualifying data breach as required by law.
10. Children
HoloVault is not directed at children. You must be at least 16 years old (the age of digital consent in Hungary) to create an account. If we learn that we have collected data from a child below that age without appropriate consent, we will delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, for material changes, provide a more prominent notice.
12. Contact
Questions about this policy or your data? Emailprivacy@holovault.eu.