Privacy policy

This English version is provided for convenience. In case of any discrepancy, the German version (Datenschutzerklärung) prevails.

This privacy policy applies to the websites kartenscan.de and kartenscan.com and to the Kartenscan app for Android. It explains which personal data we process, for what purpose and on which legal basis.

Summary

  • The website sets no cookies, uses no tracking and loads no content from third-party servers.
  • The app does not require a user account.
  • To identify a card, the app sends a cropped image of the card and the text recognised on it to our server. The image is not stored afterwards.
  • We do not sell data and do not show personalised advertising.

1. Controller

MARCODES GmbH
Lena-Christ-Str. 2
82031 Grünwald
Germany

Managing director: Marco Hochmuth
Email: hi@marcodes.com
Phone: +49 (0) 89 / 244 19 0 19

For privacy questions about Kartenscan you can also contact us at contact@kartenscan.com.

2. Website

2.1 Hosting and server log files

The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (DE). When a page is requested, the server processes technically necessary data: IP address, date and time, requested address, amount of data transferred, status code, referrer, browser and operating system. This is required to deliver the website and to keep it secure, for example to fend off attacks.

The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Log files are deleted after 14 days unless they are needed longer to investigate a specific security incident. We have a data processing agreement with the provider (Art. 28 GDPR). Server location: Nürnberg (DE).

2.2 No cookies, no tracking

The website uses no cookies, no analytics or marketing tools and no social media plugins. Fonts, graphics and stylesheets are loaded directly from our server. There are no connections to third parties such as Google Fonts or content delivery networks. That is why there is no cookie banner.

If you choose a display mode (light or dark) with the switch in the page header, your browser stores only this setting locally on your device (local storage, entry "ks-theme"). It is not transmitted to us or to third parties and can be deleted in your browser settings. Legal basis is Section 25 (2) no. 2 TDDDG, as storing it is strictly necessary for the function you requested.

2.3 Email contact and beta waitlist

If you send us an email, for example via the "Join the beta waitlist" link, we process your email address, your name if you provide it, and the content of your message. No data is entered on the website itself, the message is sent by your email app.

If you sign up for the beta, we only use your email address to inform you when the beta starts and, if applicable, to invite you to test. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by email to contact@kartenscan.com. For other enquiries, the legal basis is our legitimate interest in answering them (Art. 6(1)(f) GDPR) or, where a contract is concerned, Art. 6(1)(b) GDPR.

We delete waitlist sign-ups when you withdraw your consent, at the latest twelve months after the public release. Other enquiries are deleted once they have been dealt with and no statutory retention obligations apply. Emails are processed by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521 (IE).

3. Kartenscan app

3.1 Camera

The app needs access to the camera so you can scan cards. You grant access through the Android permission prompt and can revoke it there at any time. The live camera image is only analysed on your device to find the card in the picture. No video is transmitted to us.

3.2 Card identification on our server

When you scan a card, the app reads the text on the card directly on the device (text recognition, OCR) and then sends the following data to our server api.kartenscan.com:

  • a cropped and straightened image of the card. If the app could not find the card itself, the captured photo is sent instead and the crop is determined on the server;
  • the text recognised on the device, such as card name, card number and set code;
  • technically necessary connection data such as IP address and time.

The server compares the image and text with our card catalogue and returns the matching cards. The image is only used for this identification, processed in memory and not stored afterwards. The transmission is encrypted (TLS). Please photograph only the card if possible and no people or private items.

The legal basis is Art. 6(1)(b) GDPR, because identification is the function you request with the scan. Connection data in server log files is processed under Art. 6(1)(f) GDPR (secure operation). Log files are deleted after 14 days. Server location: Nürnberg (DE).

We do not use your photos to train our recognition. Should we want to offer this in the future, we will ask for your explicit consent first.

3.3 Card search and prices

When you search for a card or retrieve prices and sales of a card, the app sends the search term or the card identifier to our server. These requests are not linked to a person and not combined into a profile. The legal basis is Art. 6(1)(b) GDPR.

3.4 No account, data on your device

You do not need an account to use Kartenscan. App settings are stored locally on your device only. They are deleted when you uninstall the app or clear the app data in the Android settings. If we introduce features that require an account later, such as syncing a collection, we will update this policy beforehand.

3.5 Text recognition with Google ML Kit

For on-device text recognition the app uses the ML Kit library by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Recognition runs entirely on your device. According to Google, ML Kit may contact Google servers to receive bug fixes and model updates and may send metrics about the performance and use of the APIs to Google. According to Google, camera images and recognised text are not transmitted. The legal basis is Art. 6(1)(f) GDPR (reliable text recognition). More information: developers.google.com/ml-kit/terms.

3.6 Google Play

The app is distributed via Google Play. When you download and update it, Google processes data such as your Google account and device information under its own responsibility. We only receive aggregated statistics from Google, such as install numbers, and crash reports that are not linked to you. For the closed beta, Google Play invites you via the email address of your Google account, which you share with us for this purpose. Google's privacy policy: policies.google.com/privacy.

3.7 Affiliate links

The app is meant to show the cheapest current offer for a card. Such links are affiliate links labelled as ads, for example from the eBay Partner Network. If you open such a link, you are forwarded to the provider's website. The provider may set cookies or similar identifiers there to record that you came from Kartenscan and to attribute a commission to us. The respective provider is responsible for this. We only receive aggregated reports on clicks and commissions, no information about you or your purchases. See the affiliate disclosure for more.

4. Recipients and transfers to third countries

We only share personal data with service providers who process it on our behalf (hosting, email) and are bound by contract under Art. 28 GDPR. We do not sell data. We do not intend to transfer data to countries outside the EU or EEA. Where Google or providers of affiliate programmes transfer data to third countries under their own responsibility, their privacy policies apply.

5. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Just write to us at contact@kartenscan.com. How to have data deleted is also explained on the delete data page.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

6. Children and young people

Kartenscan can be used without an account and without providing personal data. Anyone younger than 16 should only sign up for the beta or write to us with the consent of their parents.

7. No automated decision-making

We do not make automated decisions within the meaning of Art. 22 GDPR and do not create profiles.

8. Changes

When the app or the website changes, we will update this policy. The current version is available at kartenscan.com/privacy/. The German version at kartenscan.de/datenschutz/ prevails.