Legal
Privacy Policy
Last updated: July 2026
WHO WE ARE
Paniffo (paniffo.com) is a collector-run platform for vintage football cards, operated from the Netherlands. For any privacy question, contact us at info@paniffo.com.
WHAT WE STORE AND WHY
Account: your email address and a hashed password, so you can sign in (legal basis: performance of a contract). Portfolio: the PSA cards you add, prices you enter and value snapshots — this is the product working as intended. Contact form: the name, email and message you send us, so we can reply. Newsletter: your email address, only if you subscribe, so we can tell you about new cards (legal basis: consent — unsubscribe anytime).
WHAT WE DON'T DO
We do not sell or share your personal data with third parties for marketing. We do not track you across other websites. We do not store payment details — sales are settled directly via PayPal or bank transfer.
THIRD-PARTY PROCESSORS
We rely on a small set of processors to run the site: Vercel (hosting, USA/EU), Supabase (database & authentication, EU region), Resend (transactional email). Card market data is retrieved from the official PSA and eBay APIs; those lookups do not include your personal data.
PUBLIC PROFILES
Your portfolio is private by default. Only if you explicitly enable a public collector profile do your chosen username, bio and card list (never your purchase prices or values) become visible to others. You can switch this off at any time.
RETENTION & YOUR RIGHTS
We keep your data for as long as you have an account; delete your account and it goes with it. Under the GDPR you can request access, correction, export or deletion of your data at any time via info@paniffo.com. You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens.
COOKIES
We use only functional cookies: a session cookie to keep you signed in. No advertising or cross-site tracking cookies.