Cart Optimizer for Cardmarket: privacy policy

Who we are

Cart Optimizer for Cardmarket ("the extension") finds a cheaper cart for your Cardmarket wants list and, when you ask it to, applies it to your Cardmarket cart. It is made by Considered Software, the data controller for what its server receives. Contact: support@considered.software. It is not made by or affiliated with Cardmarket.

What the extension reads

It reads pages on www.cardmarket.com in your own browser, using the session you're already logged in with: your shopping cart, the wants list you pick, your list of wants lists, sellers' offers for your wanted cards, and those cards' public pages. If your cart is empty, it also reads your account's Addresses page, only to learn which country your default shipping address is in. It reads no other website. It never asks for or sees your password, and never touches payment.

What it sends, and to whom

To show how many of your wants your cart fills, as soon as you open its panel, and to work out the cheapest cart, it sends the pages above to the extension's own server (cart-optimizer-api.considered.software), over an encrypted (HTTPS) connection. Before any page leaves your browser, the extension removes your name, street and city, your account name, your account balance, and the page's security tokens. The server removes them again before it stores anything. What remains is what the optimizer needs: the cards, prices, sellers and their shipping, your wants list's rules, the currency you pay in, and the country you ship to.

Those pages also show what Cardmarket shows every visitor about the sellers on them: their usernames, the country they ship from, their ratings and their listings. Some sellers are private individuals. The extension uses this only to compare their offers and shipping, and keeps it only as long as the pages (below).

It also watches for Cardmarket's own cart requests (adding, removing or clearing cards), to update its count of your wants when your cart changes. It only notes that such a request finished, never what was in it, and sends nothing about it.

The server is hosted by Amazon Web Services (AWS) in Frankfurt, Germany. AWS stores and runs it for us and has no other use of it. Email you send to support@considered.software, and our replies, pass through Cloudflare, which forwards our mail, and Microsoft, whose Outlook service holds our inbox; both may handle it outside the UK and EU, under their own safeguards for international transfers. Nothing is sent to anyone else: no analytics, no advertising, no trackers.

What the server keeps, and for how long

The server doesn't know who you are: there are no accounts, and nothing it keeps holds your name, address or Cardmarket account name.

• The pages it was sent, with the personal details above removed: 14 days, for checking that plans were right and fixing problems. Then they're deleted.
• A record of each run: when it ran, the game, your wants list's id, the options you chose, how many pages it read, the totals before and after, and whether you applied it: 30 days.
• Feedback you send from the extension: your message, your email if you give one, and, if you leave "include details" ticked, the run's reference and a summary of it (the extension's version, your browser's name and version, where the run got to, and its totals): 90 days.
• Server logs: each request's time, address (URL) and the IP address it came from, used to keep the service running and to limit abuse: 30 days. The service also holds recent IP addresses in memory for up to an hour, to limit how often each can use it, and never writes them anywhere else.
• Backups of the server's database (run records and feedback): daily copies kept 30 days, and the occasional manual copy 90 days, then deleted, so a deleted record is gone from backups within 90 days too.

Everything is stored with AWS in Frankfurt, Germany, in the European Union, encrypted at rest.

Who looks at it

The service works on its own: no person reads your pages or run records to plan your cart. We look at a run's pages or record only when you send feedback about it with "include details" ticked, which ties your message to that run, to answer you and fix the problem; when it's needed to keep the service secure (for example, investigating abuse); or when the law requires it. Feedback messages are read, since that's what they're for.

What stays in your browser

Your settings (the wants list you picked, your seller filters and options), and a feedback message you've started writing (with the email you typed, if any), are saved in your browser's extension storage so they're there next time. A run in progress is kept in the browser's session storage until the browser closes. The account name the page shows is used only in memory, to notice when you log out or switch account, and is never saved or sent.

Why we're allowed to use it (the legal basis)

• The pages and run records: to provide the service you ask for when you open the panel, press Find savings or Apply, and our legitimate interest in checking its results are right (UK and EU GDPR Article 6(1)(b) and (f)).
• Server logs: our legitimate interest in keeping the service secure and working (Article 6(1)(f)).
• Feedback and your email: your choice to send them, so we can read and reply (Article 6(1)(a)). You can ask us to delete them at any time.

What we don't do

We don't sell or share your data, use it for advertising, or use it for anything other than finding and applying a cheaper cart and improving the extension. We make no automated decisions about you.

The use of information received by the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Your rights

Under the UK and EU GDPR you can ask to see the data we hold about you, to correct it, to delete it, to restrict or object to our use of it, or to receive a copy. Because we don't know who you are, we can find your data only from a run's or a feedback message's reference, or the email you gave with feedback: email support@considered.software with it, and we'll answer within a month. You can also complain to your data protection authority: in the UK, the Information Commission, still known as the ICO (ico.org.uk).

You can stop at any time by removing the extension, which also deletes what it saved in your browser.

Children

The extension isn't intended for children under 13 (under 16 in some EU countries).

What the extension asked you to agree to (version 1)

Added when this version was frozen: the agreement card in extension 0.1.0, which asked for "Agree and continue" before anything was read.

Cart Optimizer finds a cheaper cart from your own Cardmarket pages. To do that it:

• Reads, in this browser, your Cardmarket cart, your wants lists, and sellers' offers and card pages for your wants (and your default shipping country, if your cart is empty).
• Sends those pages to Cart Optimizer's server to work out the plan, after removing your name, address, account name and balance.
• Keeps the pages 14 days and a record of each run 30 days, to check its plans. Nothing is sold or used for ads.
• Changes your cart only when you press Apply.

Changes

If this policy changes, the new version will be posted here with a new date. If the extension starts reading, sending or keeping anything new, it will tell you in the extension itself first.