PRIVACY POLICY

AI BOSS PTY LTD operates hobbycards.com.au. This policy describes how we handle personal information relating to website visitors, customers, users of our card valuation and collection management tools, and people who contact us.

We comply with privacy laws that apply to us and follow the commitments in this policy.

Contact our Privacy Officer at support@hobbycards.com.au.

Depending on how you interact with us, we collect your name, email, telephone number, billing and delivery addresses, account details, order and transaction records, communications, return requests and marketing preferences.

Website systems may collect IP addresses, browser and device information, pages viewed and security logs.

When using our card valuation and collection management tools, we may also collect and process:

• Photographs or images of trading cards uploaded for identification or valuation.
• Card information, including brand, series, year, edition, card number, condition and grading details.
• Valuation requests and estimated valuation results.
• Card photographs, descriptions and associated information saved to digital albums or personal collections.
• Information associated with your account or valuation activity where required to provide the relevant service.

Uploaded images may contain personal information, including information visible in the photograph or associated image metadata. We encourage users to upload only images and information necessary for the requested service.

Payments are processed through Stripe. Payment details are collected through the Stripe payment flow. We receive transaction information needed to manage orders, refunds and reconciliation, which may include payment status, transaction identifiers, card brand and last four digits. Our systems do not access or store your full card number.

We do not ask for sensitive information unless it is necessary and lawful to do so.

We collect information when you place an order, create an account, contact us, request support, subscribe to marketing, upload card photographs, request a card valuation or save cards to a digital album.

We also receive information from payment providers, delivery services and other providers involved in your transaction, and from website technologies described in the Cookies Policy.

Where practical, you may make a general enquiry anonymously or using a pseudonym. We need sufficient accurate details to process a purchase, deliver goods and resolve order issues.

To use our valuation and collection tools, you may need to provide card photographs or associated card information. Without these details, we may be unable to generate a valuation or provide the requested functionality.

We use information to process payments and orders, deliver goods, manage accounts and returns, answer enquiries, maintain records, meet legal obligations, investigate suspected fraud and keep the website secure.

We also use appropriate website information to understand performance and improve the shopping experience.

For our card valuation and collection management tools, we use uploaded photographs and associated information to:

• Identify trading cards and their relevant characteristics.
• Generate estimated card valuations using automated or AI-assisted technology.
• Display valuation results to users.
• Save and manage cards in digital albums or personal collections when requested.
• Support the operation, security and troubleshooting of these services.

We send marketing where we have the consent or other lawful basis required for that communication.

We do not use payment or delivery information for unrelated purposes without an appropriate lawful basis.

You can unsubscribe from promotional emails using the unsubscribe link or by contacting us. We will action requests within the applicable legal timeframe, including within five working days for Australian commercial electronic messages.

Opting out of marketing does not stop essential order, security or service messages.

We do not make marketing consent a condition of completing a purchase.

We disclose information only as reasonably needed for the purposes described above, including to hosting and commerce providers, payment processors including Stripe, delivery and fulfilment providers, customer support and email providers, technology development and support personnel, professional advisers and authorities where required or authorised by law.

For card valuation services, we use third-party artificial intelligence service providers, including OpenAI, to process uploaded card photographs and associated card information.

Our authorised technology development, maintenance and support personnel located in Vietnam may also access or process information where reasonably necessary to operate, maintain, secure, troubleshoot and improve our website and services.

Such information may include account information, technical logs, valuation requests, uploaded card images and saved collection information, depending on the access required for their duties.

Access is limited to authorised personnel for legitimate business purposes and is subject to appropriate security and confidentiality requirements.

If we use analytics or advertising providers, the relevant information and choices are described in our Cookies Policy.

We do not sell customer personal information.

AI-powered card valuation and image processing

Our card valuation tools use artificial intelligence technology provided by OpenAI, a third-party AI service provider based in the United States.

When you submit a card photograph for valuation, the image and relevant card information are transmitted through our application infrastructure to OpenAI for processing.

OpenAI processes this information to support card identification, analysis and generation of valuation-related results.

The information transmitted may include:

• Uploaded card photographs or images.
• Card descriptions or identifying characteristics.
• Technical instructions and information necessary to process the valuation request.

We aim to limit the information transmitted to what is reasonably necessary to provide the requested valuation service.

Temporary valuation images are not intentionally retained in Hobby Cards' permanent image storage after processing unless you separately choose to save the image to your collection.

OpenAI's processing and retention of information are governed by its applicable service agreements, data controls and policies.

Information submitted through OpenAI's API is not used to train its models by default unless the customer explicitly opts in. OpenAI may retain certain information for abuse monitoring, safety, legal compliance or other purposes permitted by its applicable terms and retention settings.

Further information: https://developers.openai.com/api/docs/guides/your-data

Stripe payments

When you pay using Stripe, information such as your contact, billing, order and transaction details may be provided to Stripe as needed to process payments and help prevent fraud.

Stripe also handles information for its own purposes described in its Privacy Policy at https://stripe.com/privacy.

Stripe processes payments for us in Australia.

Our policy explains our handling of information; Stripe's policy explains its handling.

For purchase and refund requests, contact us.

Hobby Cards is operated by AI BOSS PTY LTD, an Australian company. However, certain business operations and technology services involve personnel and service providers located outside Australia.

Personal information may be accessed, processed or stored in the United States, Vietnam and other countries where our service providers operate.

Relevant overseas processing arrangements include:

United States — AI processing

We use OpenAI, a United States-based AI service provider, to process card photographs and related information submitted through our card valuation tools.

This processing supports card identification, image analysis and generation of estimated card values.

OpenAI may process or retain information in accordance with its applicable service agreements, data controls and retention policies.

Vietnam — Technology development and operational support

We work with authorised technology development and support personnel based in Vietnam who assist with the development, maintenance, administration, security, troubleshooting and operation of our website and digital services.

Where necessary for their responsibilities, these personnel may have access to personal information, including customer account information, technical and operational records, card valuation information and collection images.

Access may occur remotely from Vietnam, even where the underlying information is stored on servers located in another country.

We do not represent that all such information is stored in Vietnam. Any storage or transfer of personal information to Vietnam-based infrastructure will depend on our actual technical arrangements.

Personnel and service providers are expected to handle information only for authorised business purposes and in accordance with applicable confidentiality, security and privacy requirements.

Other overseas service providers

Other providers, including payment processors, hosting services, authentication providers and communication platforms, may process or access personal information outside Australia.

Relevant providers and their known locations include:

• OpenAI — United States: AI-powered card identification, image analysis and valuation processing.
• Authorised technology development and support personnel — Vietnam: Website development, technical administration, maintenance and support.
• Stripe — Australia: Payment processing and transaction management.
• Amazon Web Services and Cloudflare — United States: hosting, storage, authentication and technology services.

We take reasonable steps required by applicable Australian privacy law to protect personal information handled overseas, including implementing appropriate access controls, confidentiality requirements and service provider arrangements.

Where an overseas disclosure occurs, we will comply with applicable requirements concerning cross-border disclosure and accountability.

Buying from us or using our services does not, by itself, constitute a waiver of protections or accountability required by applicable law.

You may contact us at support@hobbycards.com.au for further information about overseas handling of your personal information.

We take reasonable technical and organisational steps appropriate to the information we hold to protect it from unauthorised access, misuse, loss and disclosure.

These measures may include access restrictions, authentication controls, secure transmission, confidentiality requirements and limitations on access by authorised personnel and service providers, including those located in Vietnam.

No internet system is completely secure.

Different categories of information may be retained for different periods depending on their purpose.

Temporary card valuation images

When you upload a card photograph solely for an AI-generated valuation, the image is processed for that request.

Our valuation application is designed so that these temporary images are not permanently stored by Hobby Cards after the request has been completed.

Temporary images are used for processing the valuation request and are not intentionally retained in permanent image storage unless you separately choose to save them.

Authorised technical personnel in Vietnam may access relevant request information where necessary for troubleshooting, security or operational support, subject to applicable access controls.

Such access does not, by itself, mean that the images are permanently stored in Vietnam.

OpenAI may retain submitted content or related information in accordance with its applicable data retention settings, safety requirements, service terms and legal obligations. Under standard API arrangements, certain abuse-monitoring information may be retained for up to 30 days, subject to applicable exceptions and configurations.

Saved album and collection images

If you choose to save card photographs to your digital album or personal collection, those images and their associated card details are stored to provide the collection management functionality.

Saved images may remain available while the relevant collection or account remains active, unless you delete them or request their removal.

Authorised personnel, including technical support personnel in Vietnam, may access saved images and associated account information where reasonably necessary for maintenance, security, troubleshooting or customer support.

When you delete a saved image or request account closure, we will delete or de-identify relevant information within a reasonable period, subject to legitimate technical, security, backup and legal retention requirements.

Copies may remain temporarily in backups or other systems until deleted under applicable retention processes.

Other personal information

We retain other personal information for as long as reasonably needed for the purposes described in this policy, including legal, accounting, security and dispute-resolution requirements.

When information is no longer required, we take reasonable steps to securely destroy or de-identify it where appropriate and lawful.

If a data breach occurs, we will assess it and notify affected people and regulators when required.

Contact our Privacy Officer to request access to, or correction of, your personal information.

You may also request removal of saved collection images or account-related information.

We may verify your identity using proportionate methods.

We will respond within a reasonable period and explain any lawful refusal and available complaint options.

There is no fee to make a request. If a lawful access charge may apply, we will explain it before proceeding.

You may request account closure; we may retain records where needed for legal obligations or legitimate unresolved matters.

Please send privacy concerns to support@hobbycards.com.au, describing what happened and your preferred resolution.

We aim to acknowledge complaints within five business days and provide a substantive response within 30 days.

If we need more time, we will explain why and give an updated timeframe.

If unresolved, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au where it has jurisdiction, or another relevant regulator.

This process does not prevent you from using any other remedy available by law.

Purchases must be made by an adult or through a parent or guardian.

We do not knowingly seek personal information directly from children for marketing.

A parent or guardian may contact us about a child's information.

External websites linked from our site have their own privacy practices; review their policies before providing information.

We will publish the current policy and its effective date on the website.

If a material change requires notice or consent under applicable law, we will provide that notice or obtain that consent.

A policy update does not, by itself, authorise an incompatible new use of information already collected.