TCG TRADE-IN
Privacy and data processing agreement
Version 2026-10-02.1
Operator and contact
TCG Trade-In is operated by Jonathan Emard (Hobby Developper). Contact jonathanhobbysag@gmail.com for privacy requests or security concerns.
Purpose and minimum data
We process Shopify customer IDs, names and email addresses to identify the customer selected by a merchant, record their trade and issue Shopify store credit. We process selected product details, quantities, prices, payout amounts, timestamps, optional notes, merchant-entered employee names and authenticated staff identifiers for trade records, security and corrections. Customer search results are not copied into a customer database.
Merchant instructions and agreement
The merchant controls the purposes and lawful basis of customer processing. We act as processor for trade data, following the merchant's documented instructions through this app and verified support requests. By accepting this agreement, the merchant instructs us to perform these functions and confirms authority to do so. The merchant supplies required notices, obtains consent where needed, and handles customer requests with our assistance. Do not add unnecessary personal information to trade notes.
Support tickets
We store support subjects, categories, messages, status, shop domain and timestamps to answer merchant requests. Do not include customer personal data, credentials or payment information. Designated support moderators, authenticated as owners of explicitly approved shops, can read and reply to tickets across shops and change their status. This role does not grant access to other shops' trade records. Support access is logged. Tickets inactive longer than the merchant retention period are deleted; shop erasure deletes its tickets and anonymizes its authorship in other tickets. Contact our privacy contact for correction or deletion of personal information inadvertently included in support messages.
Customer choices
We do not sell customer data, use it for advertising, send marketing messages, or profile customers. Offer calculations use card values and merchant-selected rates, not personal characteristics. A merchant confirms every accepted trade. Use a cash walk-in trade when no customer identification is needed. Contact the merchant or our privacy contact to request access, correction, deletion or restriction. A merchant can stop associated processing by using walk-in cash trades or uninstalling the app.
Retention and deletion
Merchants select a retention period from 30 to 2555 days; the default is 365 days. Entire trade records are deleted after this period, including notes and audit history. Export records you must retain before expiry and choose a period appropriate to your obligations. This is a product retention setting, not a statement of statutory retention requirements. Verified Shopify customer-erasure requests remove linked identity, notes, error text, transaction identifiers and audit details. Shop-erasure requests delete the shop's records and sessions. Access logs and completed privacy requests expire after 90 days. Open privacy requests require action within 30 days.
Hosting, access and transfers
The app and its dedicated PostgreSQL database are hosted by Render in Virginia, United States, separately from other apps. Data may be processed outside the merchant's country. Shopify processes platform and store-credit data, and Render processes hosting and storage data under their applicable terms. Jonathan Emard is the developer administrator and accesses data only for necessary support, security or operation. This policy does not claim a third-party security certification.
Security and assistance
We restrict trade data to the authenticated shop and support tickets to their shop and designated support moderators, record access events without search text or customer names, and use authenticated Shopify privacy webhooks. The database and its Render backups are encrypted at rest. The app uses HTTPS and requires TLS for database connections; public database access is blocked. Render provides a three-day point-in-time recovery window on the current workspace plan. Backups are restricted from ordinary use. Any separately created logical export must have a documented deletion date; none is part of the app's normal export workflow. Administrator MFA and strong unique passwords must be enforced before public launch. We assist merchants with requests and incidents, notify affected merchants without undue delay after confirming a breach affecting their data, and provide relevant security information on request. Restored backups must have subsequent deletions reapplied before service resumes.
Subprocessors and changes
The subprocessors are Shopify for platform and credit services and Render for hosting and storage. We will notify merchants before material subprocessor or purpose changes and provide a way to object through the privacy contact. Revised agreements require acceptance in the app. On termination, we delete data under the shop-erasure process; Render recovery copies expire as the three-day recovery window advances and are restricted from ordinary use.