Infinity Binder Privacy Policy

1. Introduction

This Privacy Policy describes how Infinity Binder, LLC ("Infinity Binder," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with its website, applications, and related services (the "Services").

By using our Services, you acknowledge that you have read and understood this Privacy Policy.

Infinity Binder is headquartered in Harrisonville, Missouri, USA, and operates primarily within the United States. However, we recognize the rights of individuals under international data protection regulations, including the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR.

2. Information We Collect

We collect personal and business information that you voluntarily provide or that is automatically collected when you use our Services, including:

• Account Data: Name, email address, and password.
• Shop Data: Shop name, business address, and related identifiers.
• Stripe Identifiers: Customer and subscription IDs for billing.
• ManaPool Integration Data: If you enable the optional ManaPool integration, your ManaPool account email address and ManaPool API access token, used to synchronize your inventory and pricing with ManaPool at your direction. See Section 5a.
• Device & Security Data: IP address, user agent, login timestamps, and device identifiers.
• Usage Data: Interactions with the Services, analytics, and error logs.
• Transactional Records: Orders, subscriptions, and payments.
• Communication Data: Messages and notifications sent through Amazon SES.

We do not directly collect or store credit card information. All payments are securely processed by Stripe, Inc.

3. How We Use Personal Information

We process personal information for the following purposes:

• To operate and improve the Infinity Binder platform.
• To authenticate and manage user accounts.
• To process payments and subscriptions via Stripe.
• To send administrative and transactional communications through Amazon SES.
• To synchronize your inventory and pricing with ManaPool where you have enabled that optional integration.
• To provide customer support.
• To ensure system integrity and prevent fraud.
• To comply with applicable laws and regulations.

4. Legal Bases for Processing (GDPR)

For individuals in the European Economic Area (EEA), the United Kingdom, and similar jurisdictions, Infinity Binder relies on the following lawful bases under Article 6 of the GDPR:

Performance of a Contract: To provide and manage your account, process transactions, and deliver the Services you have subscribed to.

Legitimate Interests: To maintain platform security, detect and prevent fraud, improve our Services, and conduct analytics. We balance these interests against your rights and ensure they do not override your fundamental rights and freedoms.

Consent: For optional communications, non-essential cookies, or analytics where required by law, and for enabling optional integrations such as the ManaPool integration. You may withdraw consent at any time by contacting [email protected] or, for the ManaPool integration, by disabling it in your account settings.

Where we process your data to comply with applicable legal requirements (such as tax reporting or responding to valid legal requests), we do so under the appropriate legal basis as required by law.

5. Third-Party Processors and Service Providers

Infinity Binder uses trusted third-party partners to provide key components of our Services:

All third parties listed above act as data processors under written agreements that require GDPR-compliant safeguards.

Privacy Policies:

• AWS: https://aws.amazon.com/privacy/
• Stripe: https://stripe.com/privacy
• DigitalOcean: https://www.digitalocean.com/legal/privacy-policy
• Scryfall: https://scryfall.com/docs/api

5a. Optional ManaPool Integration

If you enable the optional ManaPool integration (available on a per-shop, opt-in basis), Infinity Binder will transmit your ManaPool account email address and your ManaPool API access token to Mana Pool, Inc. ("ManaPool") in order to synchronize your inventory and pricing with the ManaPool marketplace at your direction.

Unlike the service providers listed in Section 5, ManaPool does not act as a processor on Infinity Binder's behalf. ManaPool operates its own marketplace, with which you hold a separate account, and it acts as an independent data controller with respect to any information it receives. ManaPool processes that information under its own Privacy Policy (https://manapool.com/privacy) and Terms of Service (https://manapool.com/terms), which form a direct relationship between you and ManaPool.

This integration is optional and disabled by default. You may disable it at any time in your account settings, and you may revoke Infinity Binder's access by regenerating or deleting your ManaPool API token in your ManaPool account. Where consent is the applicable legal basis, enabling the integration constitutes your consent to this transfer, and you represent that you are authorized to provide the information transmitted.

The integration synchronizes inventory and pricing data only. It does not transmit payment card data and does not process payments or payouts.

6. Cookies and Tracking

We use essential cookies to:

• Maintain session authentication,
• Store user preferences,
• Enable basic analytics and performance monitoring.

Non-essential cookies are only used where permitted by law and, if applicable, with your consent.

7. Data Retention

• Account data is retained for as long as your account remains active.
• Upon closure, Infinity Binder retains data for up to 90 days for backup, legal, or auditing purposes before permanent deletion.
• Financial and security records may be stored longer to meet legal requirements.

8. International Data Transfers (GDPR Article 46)

As a U.S.-based company, Infinity Binder may transfer personal data from the EEA, UK, or other regions to the United States.

Where such transfers occur, we implement appropriate safeguards such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Technical and organizational measures to protect the integrity and confidentiality of personal data.

By using our Services, you acknowledge that your data may be transferred and processed in the United States.

9. Data Security

We employ industry-standard technical and organizational measures to protect your information, including:

• TLS/HTTPS encryption in transit.
• Encrypted password storage and access restrictions.
• Continuous monitoring and security event tracking.

While we take reasonable precautions, no method of transmission or storage is completely secure.

10. Your Rights (GDPR, CCPA, and Similar Laws)

Depending on your jurisdiction, you may have the following rights:

• Access: Obtain confirmation of whether we process your data and receive a copy.
• Rectification: Correct inaccurate or incomplete data.
• Erasure ("Right to be Forgotten"): Request deletion of your personal information.
• Restriction: Request limits on how we process your data.
• Portability: Receive data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdrawal of Consent: Withdraw previously given consent at any time.

To exercise these rights, contact us at [email protected].

We will respond within the timeframes required by applicable law (typically within 30 days).

11. Children's Privacy

Our Services are not intended for individuals under 18. We do not knowingly collect data from minors. If we discover that a child has submitted personal information, we will delete it immediately.

12. Changes to This Policy

We may update this Privacy Policy periodically. The updated version will be posted on our website with a revised effective date. Continued use of the Services constitutes acceptance of the updated terms.

13. Contact Information / Data Protection Officer

For privacy questions or to exercise your rights under this Policy:

[email protected]

If you are located in the European Union or United Kingdom, you may also contact your local data protection authority for concerns that are not resolved directly with us.

14. Governing Law

This Privacy Policy shall be governed by the laws of the State of Missouri, USA, without regard to conflict-of-law principles, except where mandatory data protection law provides otherwise.