← Back to home

Privacy Policy

Thompson Data Products, LLC · Last updated May 2026

1. Who we are

The Card API is operated by Thompson Data Products, LLC ("we," "us," or "our"). We provide a developer API for accessing trading card transaction data. Questions about this policy can be directed to hello@thecardapi.com.

2. What we collect

We collect only what is necessary to provide the service:

  • Email address — used to issue your API key, send receipts, and contact you about your account.
  • API key hash — we store a SHA-256 hash of your key, never the raw key itself.
  • Usage data — request counts, timestamps, and rate limit state, used to enforce tier limits and detect abuse.
  • IP addresses — logged transiently for security and abuse prevention. Not retained long-term.
  • Payment information — handled entirely by Stripe. We never see or store your card number.

3. How we use your data

  • To provision and manage your API key and account.
  • To process payments and send transaction receipts via Stripe.
  • To send your API key and important account notifications via email (SendGrid).
  • To enforce rate limits and detect abuse of the service.
  • To improve the product based on aggregate usage patterns.

We do not sell your personal data. We do not send marketing emails beyond transactional messages directly related to your account.

4. Third-party services

We use the following third-party processors:

  • Stripe — payment processing and subscription management (stripe.com/privacy)
  • SendGrid — transactional email delivery (sendgrid.com/policies/privacy)
  • Supabase — database hosting (supabase.com/privacy)
  • Vercel — hosting and edge infrastructure (vercel.com/legal/privacy-policy)

5. Data retention

We retain your email address and account data for the duration of your account plus 12 months after deletion or cancellation, for legal and accounting purposes. Usage logs are retained for up to 90 days.

6. Your rights

You may request access to, correction of, or deletion of your personal data at any time by emailing hello@thecardapi.com. We will respond within 30 days.

7. Cookies

We do not use tracking or advertising cookies. We use a single session cookie for the staging preview gate, which is not present on the production site.

8. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email if you have an active account. Continued use of the service after changes constitutes acceptance.

9. Contact

Questions or concerns about this policy: hello@thecardapi.com