Privacy Policy
Last updated: 25 August 2026
This Privacy Policy explains how HoloVault ("HoloVault", "we", "us") collects, uses, and protects your personal data when you use our website atholovault.eu and related services (the "Service"). We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) and applicable national data-protection law.
1. Who we are (Data Controller)
The controller responsible for your personal data is:
- [OPERATOR LEGAL NAME]
- [OPERATOR POSTAL ADDRESS, EU]
- Privacy enquiries: privacy@holovault.eu
- General support: support@holovault.eu
2. The data we collect
We only collect data we need to run the Service:
- Account data (via Discord login). When you sign in with Discord we receive and store your Discord user ID, your display name, and your email address. We do not receive your Discord password.
- Collection & deck data. The cards you record as owned, decks you build, saved decklists, and related notes.
- Card scans & uploads. Images captured with the phone scanner and CSV files you import, processed to identify cards and update your collection.
- AI feature content. The collection context and natural-language queries you submit to our AI recommendation and search features, plus a count of your AI usage (to apply the free allowance). We retain your Deck Coach conversation transcripts and any generated Deck Report, so you can return to them.
- Purchase data. If you buy a Deck Report or a bundle of Deck Coach messages, a customer reference and a record of the purchase (what was bought, which deck where one applies, amount, date, payment status). Card/bank details are handled directly by our payment processor (see Section 6) — we never see or store your full payment card number.
- Technical data. Server logs including IP address, browser/user-agent, timestamps, and error diagnostics, used for security and reliability.
3. How and why we use your data (legal bases)
Under Article 6 GDPR, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Creating your account, authenticating you, and providing core collection/deck features | Performance of a contract (Art. 6(1)(b)) |
| Processing card scans, CSV imports, and AI recommendations/search you request | Performance of a contract (Art. 6(1)(b)) |
| Processing Deck Coach purchases and payments | Performance of a contract (Art. 6(1)(b)) |
| Keeping invoicing and tax records | Legal obligation (Art. 6(1)(c)) |
| Securing the Service, preventing abuse, and improving reliability | Legitimate interests (Art. 6(1)(f)) |
We do not use your personal data for advertising, and we do not sell your personal data.
4. Cookies
HoloVault uses only strictly necessary cookies to keep you signed in — anaccess_token and a refresh_token session cookie set after you log in with Discord. These are essential to provide the Service you request, so under the ePrivacy rules they do not require a consent banner. We do not use advertising or third-party tracking cookies.
5. Analytics
We use a self-hosted instance of Umami, an open-source, cookieless analytics tool, to understand how the Service is used. Umami runs on the same EU infrastructure as the rest of HoloVault — there is no third-party analytics provider, no third-party script loaded in your browser, and no analytics data leaves that infrastructure.
Analytics does not use cookies or any other client-side storage — no localStorage, no sessionStorage — and it honours your browser's Do Not Track setting. The page URLs we collect never include query strings.
- Collected. The page you visited (without query strings), the referring site, your browser, operating system, device type, and country, plus a small set of named product events — for example scanning a card, importing a CSV, adding a card to your collection, listing a card for sale, saving a deck, saving a recommended deck, exporting a deck, completing a login, opening the deck coach, starting a checkout, and browser performance metrics.
- Not collected. Your IP address (Umami combines it with your browser's user agent into a rotating identifier used only to distinguish visits, and does not store the address itself), cross-site identifiers, and any card, deck, or account content. Event payloads are limited to counts and short category labels — for instance, listing a card for sale reports only the currency and whether an expiry date was set, never the price.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — understanding which features are used so we can improve the Service. Analytics data is kept only for as long as it remains useful for that purpose and is not retained indefinitely.
6. Who we share data with (processors & recipients)
We share data only with service providers ("processors") who help us operate the Service, under contracts that require them to protect your data:
- Discord — authentication (sign-in). See Discord's privacy policy for how they process your data.
- Mollie — payment processing for one-off Deck Coach purchases (EU-based payment provider). Your payment details are handled by Mollie under their own privacy policy.
- AI model providers — the collection context, decklists, and the messages you send to AI features — including deck coach conversations — are sent to third-party large-language-model providers (currently the models marketed as Gemini) via their APIs to generate recommendations, search results, coaching replies and Deck Reports.
- Hosting & infrastructure — Oracle Corporation, where the Service and its database are hosted (eu-milan-1 region).
- ForceTable — only when you explicitly choose to export a deck, the decklist is sent to ForceTable at your request.
We may also disclose data where required by law or to protect our legal rights.
7. International transfers
Some processors — in particular certain AI model providers — may process data outside the European Economic Area (EEA). Where that happens, we rely on appropriate safeguards under Chapter V GDPR, such as an adequacy decision or Standard Contractual Clauses (SCCs). Avoid submitting sensitive personal information to AI features.
8. How long we keep your data
- Account, collection, and deck data: for as long as your account is active.
- Card scan images: processed to identify cards; not retained beyond what is needed to update your collection.
- Payment & invoicing records: retained for the period required by applicable tax and accounting law (8 years under the Hungarian Accounting Act).
- Server logs: retained for a limited period for security and diagnostics (90 days).
When you delete your account, we delete or irreversibly anonymise your personal data, except where we must keep it to meet a legal obligation.
9. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten");
- Restrict or object to certain processing;
- Data portability (receive your data in a machine-readable format);
- Withdraw consent at any time, where processing is based on consent;
- Lodge a complaint with a supervisory authority.
You can delete your account and associated personal data yourself at any timefrom your account settings in the app. To exercise any other right, emailprivacy@holovault.eu. We will respond within one month as required by the GDPR.
You also have the right to complain to your local data-protection authority. Our lead supervisory authority is the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, "NAIH"),naih.hu.
10. Security
We use appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), access controls, and short-lived authentication tokens. No system is perfectly secure, but we work to protect your information and will notify you and the relevant authority of a qualifying data breach as required by law.
11. Children
HoloVault is not directed at children. You must be at least 16 years old (the age of digital consent in Hungary) to create an account. If we learn that we have collected data from a child below that age without appropriate consent, we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, for material changes, provide a more prominent notice.
13. Contact
Questions about this policy or your data? Emailprivacy@holovault.eu.