CardFlow Labs, LLC ("CardFlow Labs," "we," "us," or "our") builds and operates software for trading card and specialty retail businesses. This Privacy Policy explains how we collect, use, protect, and delete personal information, including personal information we access on behalf of a merchant through connected platforms such as TikTok Shop, Shopify, and other e-commerce services.
1. Who We Are
CardFlow Labs, LLC is a limited liability company registered in Oregon, United States (registry no. 254849897), with its principal place of business at 3 Centerpointe Dr, Ste 190, Lake Oswego, OR 97035. We can be reached at privacy@cardflowlabs.com.
2. Scope of This Policy
This policy applies to personal information processed through CardFlow Labs software and integrations. When we access data from a connected platform (for example, order and customer-service data from a merchant's TikTok Shop or Shopify store), we act as a service provider to that merchant and process the data solely to provide the requested service. The merchant remains the controller of its customers' data, and the platform's own privacy policy also applies.
3. Information We Collect
Depending on the services in use, we may process:
- Order and transaction data — order IDs, items, amounts, and fulfillment status.
- Customer-service content — messages between a merchant and its buyers, including the buyer's display name and the contents of the conversation.
- Limited contact and shipping details — only as needed to answer inquiries or support fulfillment.
- Account and configuration data — authorized shop identifiers, API tokens, and settings.
We collect only the minimum data necessary to deliver the service and do not use it to build advertising profiles.
4. How We Use Information
- To provide, operate, and improve the software and integrations a merchant has authorized.
- To draft, route, and (with human review or merchant configuration) send customer-service responses on the merchant's behalf.
- To support order management, inventory synchronization, and reporting.
- To maintain security, prevent abuse, and comply with legal obligations.
We do not sell personal information, and we do not share it with third parties except the subprocessors described below or as required by law.
5. Data Sharing & Subprocessors
We use a limited set of infrastructure providers to run our services, including Oracle Cloud Infrastructure and Railway (hosting) and the AI model providers that power drafting and classification features. These providers process data only on our instructions and under contractual confidentiality and security obligations. We do not otherwise disclose personal information.
6. Data Location & Security
All personal information we process is stored and processed in the United States. We protect it with the controls described in our internal Information Security & Data Protection Policy, including encryption in transit (TLS 1.2+) and at rest, least-privilege and need-to-know access controls, multi-factor authentication on administrative accounts, network segregation, endpoint protection, and routine patching. We maintain an incident-response process and notify affected merchants and platforms of confirmed personal-data breaches without undue delay and no later than 72 hours after confirmation.
7. Data Retention & Deletion
We retain personal information only as long as needed to provide the service or as required by law. Upon termination of a merchant relationship, we delete collected customer data in our possession within 30 days, except where retention is legally required. We will also assist merchants and connected platforms in fulfilling end-user requests to access, correct, update, or delete personal data.
8. Your Rights
Depending on your jurisdiction, you may have rights to access, correct, delete, or restrict the processing of your personal information. Because we typically process data on behalf of a merchant, please direct requests to the merchant you interacted with, or contact us at privacy@cardflowlabs.com and we will assist the responsible merchant in honoring your request.
9. Platform-Specific Notes
When CardFlow Labs software connects to a merchant's TikTok Shop account, we access only the data necessary to provide the authorized service (such as customer-service conversations and order context) and use it solely for that purpose, consistent with TikTok Shop's developer terms and data-protection requirements. We do not retain TikTok Shop data beyond what is needed to deliver the service, and we honor deletion requests as described above.
10. Changes to This Policy
We review this policy at least annually and update it when our practices change. Material changes will be reflected by the "Last updated" date above.
11. Contact
Questions about this policy or our data practices can be sent to privacy@cardflowlabs.com or by mail to CardFlow Labs, LLC, 3 Centerpointe Dr, Ste 190, Lake Oswego, OR 97035.