Privacy Policy
Effective: 2026-11-10
1. Our approach to privacy
株式会社67 (the “Company”) complies with Japan’s Act on the Protection of Personal Information and other applicable laws. This policy explains information handling associated with browsing CardPorter, membership, listings and purchase requests.
2. Information we collect
The Company collects registration and login information, registered email addresses, product information, photographs and certification numbers, listing approvals, transaction and bidding records, messages, inquiries and contact/delivery information provided by users.
Access also involves IP addresses, browser types and access records.
Operator-scheduled batch auctions additionally retain private bid limits, saved items, on-site notifications, payment/payout confirmation records, delivery information and the version/time of acceptance of effective terms. Bid limits are not disclosed to other users.
Dealer screening involves identity information, verification dates, reviewers and review reference numbers; these are not public.
To receive and purchase goods, pay suppliers and arrange returns/refunds, the Company collects necessary supplier identity and bank account information and records of receipt, purchase, payment, return and refund.
For bid deposits and payments, the Company keeps provider-issued transaction identifiers, amounts, capture/refund status, purchase credits and timestamps. Full card numbers and card security codes are entered into the payment provider’s form and are not received or stored by the Company. Supplier bank account information is encrypted at rest; routine account screens display a masked account number.
3. Purposes of use
Information is used for registration and authentication, listing authorization, product listing/management, bidding, purchase requests and transactions, receipt and purchase of goods, payments, delivery and returns, refunds, communication, inquiries, fraud prevention, dispute/outage investigations and legal obligations.
Changes to purposes are notified or published in accordance with law, and consent is obtained where necessary.
4. Public and transaction information
Product information, listing photographs, certification numbers and the sales representative’s username are public. Do not include unnecessary personal information in public photographs or descriptions.
The intended audience for orders and transaction messages is limited to the buyer, the Company-authorized sales representative for that transaction and authorized administrators. Supplier status alone does not grant access to buyer addresses, transaction messages or payment information.
Application photographs are private to the applicant and authorized operators before publication; submission alone does not make them public.
5. Third parties and service providers
The Company does not sell personal information or disclose it to third parties without consent except as permitted by law.
The Service uses Google Cloud for systems and Cloudflare for delivery and security. Outsourced handling of personal information is subject to necessary and appropriate supervision. Overseas handling is addressed as required by law.
Payment, receipts, refunds and delivery may involve external providers handling information to the extent necessary for these purposes.
6. Cookies and external services
Cookies and browser storage maintain login and language/currency preferences. Login cookies last up to seven days and are revoked on logout. Currency cookies are shared between the shop and administration for up to one year. Browser preferences remain until deleted. Clearing them may affect functionality.
Native apps use a device-protected store for login tokens, separately from browser cookies. If that store is unavailable, the current session remains only in app memory and may require signing in again after restart. Tokens are not stored in ordinary preference storage.
Loading externally hosted card images sends access information to the image host. Consult each external service’s policy.
7. Photo-based search
For card recognition, the selected photograph is sent to the Company’s server and processed using Google Cloud Vertex AI (Gemini). Recognition results such as card names, numbers, grades and certification numbers are used for catalog matching. Images of people or other unnecessary personal information should not be included.
Recognition assists selection and does not automatically confirm a card’s identity, edition, grade, authenticity or market value. The user reviews the candidate before submitting. Photographs attached to an auction application are uploaded with the application and handled privately before publication.
8. Security and retention
The Company protects information through encrypted communication, access restrictions and password hashing.
Records and backups are retained as necessary for transactions, inquiries and legal obligations. Withdrawing a listing does not automatically delete photographs. There is currently no uniform automatic deletion period. Deletion requests are addressed individually after checking purposes and legal retention obligations.
9. Requests and amendments
Subject to law, individuals may request disclosure, correction, deletion, cessation of use or third-party disclosure, and disclosure of third-party transfer records. The Company verifies identity before responding and explains legally justified refusals. Contact the office below.
Material changes are announced on the Service, with consent where required by law.
10. Business and contact details
Business: 株式会社67
Representative: 河﨑遣仁
Address: 東京都世田谷区野毛2丁目25番3号 158-0092, Japan
Email: [email protected]
Phone: +81-90-8210-7377
