Cart Optimizer for Cardmarket: privacy policy

Who we are

Cart Optimizer for Cardmarket ("the extension") finds a cheaper cart for your Cardmarket wants list and, when you ask it to, applies it to your Cardmarket cart. It is made by Considered Software, the data controller for what its server receives. Contact: support@considered.software. It is not made by or affiliated with Cardmarket.

What the extension reads

It reads pages on www.cardmarket.com in your own browser, using the session you're already logged in with: your shopping cart, the wants list you pick, your list of wants lists, sellers' offers for your wanted cards, and those cards' public pages. If your cart is empty, it also reads your account's Addresses page, only to learn which country your default shipping address is in. It reads no other website. It never asks for or sees your password, and never touches payment.

What it sends, and to whom

To show how many of your wants your cart fills, as soon as you open its panel, and to work out the cheapest cart, it sends the pages above to the extension's own server (cart-optimizer-api.considered.software), over an encrypted (HTTPS) connection. Before any page leaves your browser, the extension removes your name, street and city, your account name, your account balance, and the page's security tokens. The server removes them again before it stores anything. What remains is what the optimizer needs: the cards, prices, sellers and their shipping, your wants list's rules, the currency you pay in, and the country you ship to.

Those pages also show what Cardmarket shows every visitor about the sellers on them: their usernames, the country they ship from, their ratings and their listings. Some sellers are private individuals. The extension uses this only to compare their offers and shipping, and keeps it only as long as the pages (below).

It also watches for Cardmarket's own cart requests (adding, removing or clearing cards), to update its count of your wants when your cart changes. It only notes that such a request finished, never what was in it, and sends nothing about it.

The server is hosted by Amazon Web Services (AWS) in Frankfurt, Germany. AWS stores and runs it for us and has no other use of it. Email you send to support@considered.software, and our replies, pass through Cloudflare, which forwards our mail, and Microsoft, whose Outlook service holds our inbox; both may handle it outside the UK and EU, under their own safeguards for international transfers. Nothing is sent to anyone else: no analytics, no advertising, no trackers.

What the server keeps, and for how long

The server doesn't know who you are: there are no accounts, and nothing it keeps holds your name, address or Cardmarket account name.

• The pages it was sent, with the personal details above removed: 14 days, for checking that plans were right, fixing problems and improving the optimizer (below). Then they're deleted. When the check after Apply finds a seller's shipping came out higher than predicted, the server learns that seller's shipping methods from the cart page it was sent and plans again from the pages it already has, reading nothing new. What it learned is kept with the run's pages, and deleted with them.
• A record of each run: when it ran, the game, your wants list's id, the options you chose, how many pages it read, the totals before and after, whether you applied it, and the version of the agreement it was made under: 30 days.
• Feedback you send from the extension: your message, your email if you give one, the version of the agreement the extension was under, and, if you leave "include details" ticked, the run's reference and a summary of it (the extension's version, your browser's name and version, where the run got to, and its totals): 90 days.
• Server logs: each request's time, address (URL) and the IP address it came from, used to keep the service running and to limit abuse: 30 days. The service also holds recent IP addresses in memory for up to an hour, to limit how often each can use it, and never writes them anywhere else.
• Backups of the server's database (run records and feedback): daily copies kept 30 days, and the occasional manual copy 90 days, then deleted, so a deleted record is gone from backups within 90 days too.

Everything is stored with AWS in Frankfurt, Germany, in the European Union, encrypted at rest.

Improving the optimizer

Runs made under version 2 or later of the agreement (below) are also used to improve the optimizer. This is done automatically, by scripts and as counts across runs: for example, how often a seller's shipping came out higher than predicted, or running a changed optimizer on the pages a past run read, to check it still finds a plan at least as cheap.

Each run records the version of the agreement it was made under. Runs made under version 1, including any made before you agreed to version 2, aren't used for this.

Who looks at it

The service works on its own: no person reads your pages or run records to plan your cart, or to improve the optimizer, which works from counts across runs. We look at a run's pages or record only when you send feedback about it with "include details" ticked, which ties your message to that run, to answer you and fix the problem; when it's needed to keep the service secure (for example, investigating abuse); or when the law requires it. Feedback messages are read, since that's what they're for.

What stays in your browser

Your settings (the wants list you picked, your seller filters and options), and a feedback message you've started writing (with the email you typed, if any), are saved in your browser's extension storage so they're there next time. A run in progress is kept in the browser's session storage until the browser closes. The account name the page shows is used only in memory, to notice when you log out or switch account, and is never saved or sent.

Why we're allowed to use it (the legal basis)

• The pages and run records: to provide the service you ask for when you open the panel, press Find savings or Apply (including the new plan made by itself when the check after Apply finds a seller's shipping higher than predicted), and our legitimate interest in checking its results are right (UK and EU GDPR Article 6(1)(b) and (f)).
• Improving the optimizer from runs: our legitimate interest in finding and fixing what it gets wrong, so it finds cheaper carts (Article 6(1)(f)). It uses only runs made under version 2 or later of the agreement, and works by scripts and from counts across runs, with no person reading a run. You can object to it at any time (below).
• Server logs: our legitimate interest in keeping the service secure and working (Article 6(1)(f)).
• Feedback and your email: your choice to send them, so we can read and reply (Article 6(1)(a)). You can ask us to delete them at any time.

What we don't do

We don't sell or share your data, use it for advertising, or use it for anything other than finding and applying a cheaper cart, and improving the extension and its optimizer. We make no automated decisions about you.

The use of information received by the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Your rights

Under the UK and EU GDPR you can ask to see the data we hold about you, to correct it, to delete it, to restrict or object to our use of it, or to receive a copy. Because we don't know who you are, we can find your data only from a run's or a feedback message's reference, or the email you gave with feedback: email support@considered.software with it, and we'll answer within a month. You can also complain to your data protection authority: in the UK, the Information Commission, still known as the ICO (ico.org.uk).

You can stop at any time by removing the extension, which also deletes what it saved in your browser.

Children

The extension isn't intended for children under 13 (under 16 in some EU countries).

What the extension asks you to agree to (version 2)

Before it reads anything, the extension shows this card and waits for "Agree and continue". This is version 2 of the agreement. If you agreed to an earlier version, it shows what changed since, then the card, and asks again.

Cart Optimizer finds a cheaper cart from your own Cardmarket pages. To do that it:

• Reads, in this browser, your Cardmarket cart, your wants lists, and sellers' offers and card pages for your wants (and your default shipping country, if your cart is empty).
• Sends those pages to Cart Optimizer's server to work out the plan, after removing your name, address, account name and balance.
• Keeps the pages 14 days and a record of each run 30 days, to check its plans and improve the optimizer. Nothing is sold or used for ads.
• Changes your cart only when you press Apply.

Changes

If this policy changes, the new version will be posted here with a new date, and the earlier one kept at its own address. If the extension starts reading, sending, keeping or using anything new, it will tell you what changed in the extension itself, and ask you to agree again, first.

Earlier versions:

• Version 1, from 1 October 2026 to 4 October 2026.