Verdict
SPTTCGNON
PlansSign in

Transparency

Sub-Processors

Last updated June 2026

To deliver Verdict, we use a small set of third-party service providers (“sub-processors”) that may process user data on our behalf. This page lists each one, what they do for us, what data they receive, where they process it, and a link to their published data-processing terms.

This disclosure is required for users covered by the GDPR (Article 28) and the UK GDPR. We publish it for all users because it’s the right baseline. We’ll update this page before adding, removing, or replacing a sub-processor that touches personal data. If you’d like email notification when this page changes, email support@verdict.cards and we’ll add you to the notice list.

Currently in Use

Vercel, Inc.

  • Purpose: Application hosting, edge delivery, performance monitoring (Speed Insights).
  • Data processed: IP address (truncated for analytics), request URL, user-agent, response timing. Speed Insights is cookieless.
  • Location: United States (primary), global edge network for static assets.
  • Terms: Vercel DPA · Privacy Policy

Supabase, Inc.

  • Purpose: Authentication (email + password and magic-link sign-in) and database for your Collection, Watchlist, Player Collections, sales-history caches, rate-limit events, and Stripe subscription records.
  • Data processed: Email address, salted-and-hashed password (Verdict never sees the plaintext), session cookies, card queries, your saved entries, hashed IP for rate limiting, and Stripe customer/subscription identifiers.
  • Location: United States (US-East region).
  • Terms: Supabase DPA · Privacy Policy

Functional Software, Inc. (Sentry)

  • Purpose: Application error monitoring. Helps us find and fix bugs.
  • Data processed: Uncaught exceptions, stack traces, request URL, user-agent. Session Replay is explicitly disabled. The SDK does not set cookies in our configuration.
  • Location: United States.
  • Terms: Sentry DPA · Privacy Policy

Anthropic PBC

  • Purpose: Vision provider for the Grade Tool (grade prediction), Lot Calculator multi-card identification, AI bounds detection, and cert-label OCR / cert scan. Also handles AI Snap photos for any category CardSight doesn’t identify (Yu-Gi-Oh, Lorcana, One Piece, Bo Jackson Battle Arena, non-sport, etc.) and as a fallback when CardSight can’t identify a supported-category card.
  • Data processed: Photos you upload to those features and text prompts derived from your inputs. Anthropic does not train on data sent through the commercial API.
  • Location: United States.
  • Terms: Commercial Terms · Privacy Policy

CardSight, Inc.

  • Purpose: Primary catalog and pricing data source. Vision provider for AI Snap identification on the search page for supported categories (sports, Magic, Pokémon).
  • Data processed: Card query text and, for AI Snap on supported categories, the card photo. AI Snap for other categories routes to Anthropic instead. No Collection, Watchlist, account, or contact information is sent. CardSight is not used for Grade Tool, Lot Calculator bulk identification, or cert scanning — those flows go to Anthropic.
  • Location: United States.
  • Terms: Privacy Policy

GemRate, Inc.

  • Purpose: Population reports for PSA, BGS, SGC, CGC, and CSG.
  • Data processed: Card query text and, when used, certification numbers entered by the user. No personal data.
  • Location: United States.
  • Terms: Privacy Policy

TCGplayer, Inc.

  • Purpose: Trading card game raw-market pricing reference.
  • Data processed: Card query text only. No personal data.
  • Location: United States.
  • Terms: Privacy Policy

eBay Inc. (Browse / Marketplace APIs)

  • Purpose: Public sold-listing data and active-listing retrieval. Verdict is not affiliated with, endorsed by, or sponsored by eBay.
  • Data processed: Card query text. No personal data, no account access, no order history.
  • Location: United States.
  • Terms: eBay User Privacy Notice

Apify Technologies s.r.o.

  • Purpose: Server-side eBay listing retrieval for Lot Calculator URL imports and as a fallback for eBay comp data when the official Browse API is rate-limited or unavailable.
  • Data processed: The eBay listing URL or card query you submitted. No personal data, no account access.
  • Location: European Union (Czech Republic), with global edge infrastructure.
  • Terms: Apify DPA · Privacy Policy

SerpApi, LLC

  • Purpose: Fallback eBay sold-listing search when CardSight and the eBay API are both unavailable.
  • Data processed: Card query text only.
  • Location: United States.
  • Terms: Privacy Policy

Stripe, Inc.

  • Purpose: Payment processing, subscription billing for Pro and Founders tiers, customer portal, and tax calculation/remittance via Stripe Tax.
  • Data processed: Billing email, name, address, and payment-card information (collected directly by Stripe; never stored on Verdict servers). For tax purposes, Stripe also records the buyer’s country.
  • Location: United States, with regional sub-processors per Stripe’s DPA for EU/UK card processing.
  • Terms: Stripe DPA · Privacy Policy

Resend Inc.

  • Purpose: Transactional email delivery — sign-in magic links, password reset emails, and account/billing notifications. Configured as Supabase Auth’s custom SMTP provider.
  • Data processed: Recipient email address and message content.
  • Location: United States.
  • Terms: Resend DPA · Privacy Policy

Not Yet in Use (Listed Now for Transparency)

We’ll add a provider here when we know its name in advance of a feature shipping. There are no pending sub-processors at this time.

International Data Transfers

Every sub-processor above either operates from the United States or publishes a DPA that incorporates the European Commission’s Standard Contractual Clauses (SCCs) and the corresponding UK and Swiss addenda. For users in the EEA, UK, and Switzerland, those SCCs are the legal basis for transfer of personal data to the United States. See each linked DPA above for the specific clauses and supplementary measures the vendor has in place.

Notification of Changes

We will update this page before engaging a new sub-processor that processes personal data. The “Last updated” date at the top of the page is authoritative. Email support@verdict.cards if you would like to be added to the notification list, or if you object to a new sub-processor — under GDPR Article 28(2), you have the right to do so.

Questions

Anything about how data flows through Verdict: support@verdict.cards, or write to the address on the Contact page.