Privacy Policy
Last updated: November 2, 2026
Introduction
This Privacy Policy explains how NeoGen Solutions GmbH processes personal data when you use NeoSatoshi. We are a Swiss company and primarily comply with the Swiss Federal Act on Data Protection (FADP/revDSG). Where applicable (for example in the EU/EEA/UK), we also process personal data in accordance with the GDPR. This Policy applies to our website and Service.
Controller
Data controller: NeoGen Solutions GmbH, c/o Hub Bern AG, Spitalgasse 28, 3011 Bern, Switzerland. Contact: info@neosatoshi.com.
Collection and Processing of Personal Data
We process the following categories of personal data: account data (such as email address and user ID), subscription and payment data (processed by our payment provider, for example Stripe), usage and analytics data (for example events and device/app information), marketplace integration data (such as shop domain, marketplace settings, and OAuth tokens stored securely), user content (such as uploaded card photos and listing notes), and support communications.
Purposes of Data Processing and Legal Bases
We process personal data to provide and operate the Service (including card detection and exports), manage accounts, process payments and subscriptions, provide customer support, prevent abuse and ensure security, improve and develop the Service, and comply with legal obligations. Depending on the context and applicable law, processing is based on contract performance, consent, legitimate interests, and/or legal obligations.
Cookies / Tracking and Other Technologies
We use essential cookies and similar technologies to provide the Service (for example authentication and security). We may use analytics (for example Firebase Analytics) to understand how the Service is used and to improve it. Depending on your location and applicable law, we may request consent before enabling non-essential analytics. You can control cookies in your browser settings and change your choices anytime via 'Cookie settings' in the footer or dashboard. When you create an account, we also store on it how you first found us: the first page of our website you visited, the website that linked to it (address and path only, without query parameters), and campaign parameters contained in the link (utm_source, utm_medium, utm_campaign). This happens without cookies, contains no IP address, and serves only to understand which channels (for example search engines, AI assistants or partner links) bring new customers. The legal basis is our legitimate interest in directing our marketing effectively. The information is deleted together with your account.
Data Sharing and Data Transfer Abroad
We share personal data with service providers that help us operate the Service (processors), such as hosting and cloud providers (for example Google/Firebase and AWS) and our payment provider (for example Stripe). For the optional AI support assistant we use Anthropic PBC (USA); details are in the section on the AI support assistant. We also use Anthropic for the automated analysis described in the section on operations monitoring. If you connect marketplace integrations (such as eBay or Shopify), data is exchanged with those services as needed to perform the actions you request. Some providers may process data outside Switzerland (for example in the EU/EEA or the USA). For the USA we rely on the EU-US or Swiss-US Data Privacy Framework where the recipient is certified, otherwise on EU standard contractual clauses adapted for Switzerland; you can ask us for a copy. To recognise sports cards we send your photo to eBay Inc. (USA) for an image search, to Google for reading the text and, when the result is unsure, to Anthropic PBC (USA), which chooses between the candidates. Please photograph only the card. Catalog images that other users take into their listings go to their marketplaces and are public there.
Duration of Personal Data Storage
We retain personal data as long as necessary for the purposes described in this Policy, including the duration of your account and any applicable legal retention periods. You can delete certain data within the Service (for example listing archive entries). We may retain security logs for a limited period and longer where required by law or to enforce our Terms.
Data Security
We take appropriate technical and organizational security precautions to protect your personal data against unauthorized access and misuse, such as IT and network security solutions, access controls and restrictions, encryption of data carriers and transmissions, and monitoring.
Obligation to Provide Personal Data
As part of our business relationship, you must provide the personal data that is necessary for the establishment and implementation of a business relationship and the fulfillment of the associated contractual obligations (as a rule, you have no legal obligation to provide us with data).
Profiling
We do not use automated decision-making that produces legal effects about you. We may use aggregated usage analytics to improve the Service.
Rights of the Data Subject
Subject to applicable law (FADP/revDSG and, where applicable, GDPR), you may have rights such as access, correction, deletion, restriction, objection, and data portability. To exercise your rights, contact us at info@neosatoshi.com. You may also have the right to lodge a complaint with a competent supervisory authority.
Changes
We may amend this Privacy Policy at any time without prior notice. The current version published on our website shall apply. If the Privacy Policy is part of an agreement with you, we will notify you by e-mail or other appropriate means in the event of an update.
Advertising performance measurement (ChatGPT Ads)
We advertise through ChatGPT Ads (OpenAI). To see which ads actually bring new customers, we report two events to OpenAI: that an account was created, and that a subscription was taken out. This report is sent from our server and contains only the kind of event and a timestamp. It contains no e-mail address, no name, no customer number and no IP address. For deduplication we use a computed identifier from which your account cannot be derived. In addition we may load a script from OpenAI in your browser that connects an ad click to a later registration. That script is loaded only if you explicitly agree to the Marketing category, and never without your consent. You can withdraw that consent at any time in the cookie settings, after which no further events are transmitted. The legal basis for the script is your consent; for the server-side measurement without personal data it is our legitimate interest in spending advertising budget effectively.
AI support assistant
In the dashboard, registered users can use an optional AI assistant. It answers questions about NeoSatoshi and, if you ask it to, forwards feedback, bug reports and feature requests to us. The assistant is a language model (Claude by Anthropic), not a human, and its answers can be wrong. You can hide it under Settings > Account and contact us by e-mail instead. What is processed: your messages, the conversation so far, and context we add so that the answer fits your account (plan, remaining scan credits, interface language, connected marketplaces, the selected trading card game, the page you are on and its state, for example the listing step, the number of cards in your batch and the last error message shown). When you ask about a problem with your own account, the assistant can also read its status (plan, connections, the automated price sync, the stock sync, your recent direct listing runs and the analytics sync, without passwords, access tokens, e-mail addresses or buyer data) and uses it for the answer. When you ask it to prepare a change, it also reads your listing templates and price rules; a change is only saved when you apply it. If you use "Share view", "Screenshot" or "Image" in the assistant, the content you confirmed in the preview is processed as well, for example the cards of your current listing batch with their prices, your analytics totals and profit estimate, or a picture of your screen. Screenshots blur API keys, e-mail addresses and shop domains; please check the preview anyway. We do not send your name or e-mail address to Anthropic; to prevent abuse, Anthropic receives a pseudonymous identifier computed from your user ID. Please do not enter passwords, API keys or personal data of other people, such as your buyers' names or addresses. Recipient and transfer abroad: the language model is provided by Anthropic PBC, USA, which processes these data as our processor under a data processing agreement. The transfer to the USA is based on the EU Standard Contractual Clauses including the Swiss addendum. Under its commercial terms Anthropic does not use these data to train its models and generally deletes them within 30 days, unless longer retention is needed to investigate misuse or is required by law. Storage periods: conversations are stored in our database (Google Firebase) and deleted automatically 90 days after each message; you can delete a conversation earlier in the chat menu. Shared views and screenshots are part of the conversation; screenshots are kept in our file storage (Google Firebase) and deleted with the conversation, at the latest after 91 days. Feedback you ask the assistant to forward and answers you report are stored with your user ID, e-mail address and plan and sent to our team by e-mail so that we can get back to you; we delete them after 24 months. Questions the assistant could not answer are logged with your user ID for 12 months to improve our help content. Usage counters (number of messages and cost per month) are kept for 13 months, the confirmation of the one-time notice for 12 months after its last update. When you delete your account, all of these data are deleted. Legal basis: performance of the contract for answering support questions and handling feedback; our legitimate interest in improving the Service and preventing abuse for the log of unanswered questions, the usage limits and the pseudonymous identifier. We also analyse conversations automatically for problems and feature requests, see the section on operations monitoring and product improvement.
Technical error reports
If the app runs into a technical error in your browser (for example a script error or a failed request to our servers), it sends us a short report so we can find and fix the problem: the error message, the page, the browser type and version, and the app version. E-mail addresses, access tokens and URL parameters are removed before sending. We do not store your IP address or your user ID with it, only a value that changes daily and cannot be traced back to you, to count how many sessions were affected. We keep these reports for 30 days. If you use the AI support assistant, the last technical errors of your browser tab can also go with your question to Anthropic, and with a bug report you ask it to forward to us. Legal basis: our legitimate interest in a working and secure service. We also analyse error reports automatically by cause, see the section on operations monitoring and product improvement.
E-mails aux clients, opposition et liste d'exclusion
Nous t'envoyons des e-mails liés à l'utilisation du Service, par exemple concernant ton compte, ton abonnement, les paiements ou tes demandes d'assistance. Si tu souscris un abonnement payant, nous utilisons également l'adresse e-mail indiquée pour t'informer de temps en temps de fonctionnalités et d'offres similaires de NeoSatoshi, par exemple de nouvelles fonctionnalités ou peu avant la fin d'un abonnement résilié. La base juridique est notre intérêt légitime à entretenir la relation client (art. 6, par. 1, let. f RGPD ; art. L34-5 du Code des postes et des communications électroniques ; art. 3, al. 1, let. o LCD en Suisse ; et les règles correspondantes d'autres pays). Tu peux t'opposer à cette utilisation à tout moment, sans frais autres que ceux liés à la transmission : une courte réponse à l'un de nos e-mails ou un message à info@neosatoshi.com suffit. Nous te le rappelons lors de la souscription et dans chacun de ces e-mails. Si tu as expressément accepté de recevoir des nouvelles par e-mail (préférences e-mail de ton compte), nous t'informons sur cette base ; tu peux retirer ton consentement à tout moment dans ton compte ou par e-mail. Si tu t'opposes ou demandes la suppression de tes données, nous conservons uniquement une empreinte (hash) de ton adresse e-mail, et non l'adresse elle-même, dans une liste d'exclusion afin de ne pas te recontacter par erreur. La base juridique est notre intérêt légitime à respecter durablement ton opposition (art. 6, par. 1, let. f, art. 17, par. 3, let. b et art. 21, par. 3 RGPD). Nous utilisons cette liste uniquement à cette fin.
Operations monitoring and product improvement
So that we notice problems early and can improve NeoSatoshi, we additionally analyse some data that we already hold, automatically: (1) Conversations with the AI support assistant (see the section on the AI support assistant): we detect whether a conversation points to a problem, a malfunction or a feature request, and summarise recurring topics. (2) Technical error reports (see the section on technical error reports): we group them by cause. (3) Emails to us (for example to info@neosatoshi.com or contact@neosatoshi.ch): we detect whether an email needs a reply and whether it contains a feature request or a bug report. For this analysis we use a language model (Claude by Anthropic PBC, USA) as a processor, with the safeguards described in the section on the AI support assistant. Before anything is sent, we automatically remove names, email addresses, phone numbers, postal addresses and shop domains or replace them with placeholders. The model receives no credentials and cannot change anything in your account. Only the result is stored (category, urgency and a short summary), for 13 months; the original texts stay where they are already stored, with the retention periods stated there. There is no automated decision-making that has legal effects on you or similarly significantly affects you; only we read the results. The legal basis is our legitimate interest in a functioning, secure service and in improving it (Art. 6(1)(f) GDPR; Swiss FADP). You can object to this analysis at any time by emailing info@neosatoshi.com.
Catalog images
We cut confirmed sports card photos to the card, remove embedded metadata and the background, and use them to recognise cards, including training and testing our recognition, and as catalog images for other users. The legal basis is the licence you grant us under section 7 of the terms (Art. 6(1)(b) GDPR) and our legitimate interest in recognising cards reliably and in showing what a card looks like (Art. 6(1)(f) GDPR). They are shown without your name. We store the images with Amazon Web Services in the EU (Frankfurt, eu-central-1). We keep a pseudonymous reference on a private copy, and a pseudonymous record of your click (versions of the terms and of the dialog, language, time, time of an objection) without your name or e-mail address, so that we can prove the licence and act on an objection, also after you delete your account. You can object at any time by e-mail to info@neosatoshi.com (Art. 21 GDPR); we then stop using your new scans and remove your images from the catalog within 30 days. Other users may take catalog images into their listings, where they are public. We keep the images while the card is in the catalog or until you object. If a catalog image shows a photo or other content you hold rights in, write to info@neosatoshi.com; we check it and remove the image if it infringes your rights.