Cardora Marketplace Privacy Policy

The card is detected and cropped automatically on your device. Photo metadata is removed before upload. If its boundaries cannot be identified clearly, the photo is used only for identification and the submission is excluded from training collection. Its images are deleted after analysis; an unprocessed submission expires within 24 hours. Photograph only one card, without faces or personal information.

The image for identification is sent to Cardora’s server and the RunPod infrastructure used for identification. The submission, results and version of the terms are linked to your account so that you can view and delete your scans. Cropping does not make a submission anonymous.

Only automatically cropped submissions are retained in the private review collection for up to 30 days, accessible only to authorised administrators. Using card images for future training requires a separate review of the image and usage rights, in accordance with the Cardora Scanner section of the Terms of Use.

You can delete a submission from recent scans or contact support to exercise your rights and request a review of any exported copies. Accepting terms does not replace the lawful basis required to process personal data.

VRealm I.K.E., the operator of Cardora, is the controller determining why verification is required and how its result is used for account security and marketplace access. Didit supplies the verification technology and generally processes data on Cardora’s behalf. For certain security, abuse-prevention, legal compliance and claims purposes, Didit may act as a separate controller as described in its Verification Privacy Notice.

The current workflow checks an identity document, liveness, face match and device/IP signals. Didit may process document details and images, facial captures or video, biometric data derived for identification, fraud signals and decisions. Cardora sends an internal user identifier and necessary session information. Its backend receives results and may transiently receive detailed reports through the API or webhooks; it stores only necessary references, status, timestamps and notice/consent evidence. This integration does not store new document images, selfies, videos or biometric templates in Cardora’s database.

Cardora does not currently request proof of address or a separate IBAN document for this verification. An address appearing on an identity document may be processed by Didit with that document. Shipping and delivery addresses remain necessary for fulfilment. Stripe and Stripe Connect continue to operate under their own payment, onboarding and bank-account requirements.

Necessary account and service processing relies on Article 6(1)(b) GDPR; security and fraud prevention rely on Article 6(1)(f), subject to balancing users’ rights. This biometric verification requires separate explicit consent under Articles 6(1)(a) and 9(2)(a). Accepting general terms alone is not biometric consent. Contact Support before starting to discuss available alternative review, or to withdraw consent. Withdrawal does not affect the lawfulness of earlier processing.

Automated checks inform verification status. You may request human review, explain your position and contest an inaccurate result through Support. Features requiring verification may remain unavailable while verification is pending or incomplete. A verified badge is not a guarantee of a person’s reliability or of product authenticity.

Each new Didit session has an annual cycle: verification is valid until one calendar year after the session starts. At expiry, a new verification with current information is required. Cardora schedules deletion of the old Didit session, documents, images and associated biometric data, without retaining a biometric template after deletion. Provider confirmation is checked and failed requests are retried; technical deletion delays do not extend verification validity. Legacy approvals preserved during migration expire one year after migration unless earlier review is required. Cardora retains a limited record of results, consent and deletion actions while necessary for the account, accountability or a specific lawful claim; this is not an identity-document copy. Documents from the former manual process are a separate archive subject to necessity review and applicable erasure rights. Model-improvement settings are reviewed separately from retention.

Processors and international transfers are subject to GDPR Articles 28 and 44 onwards. You may request information about safeguards, access, rectification, erasure, restriction, portability and objection where applicable, or withdraw consent through Cardora Support or the Contact page. You may complain to the Hellenic Data Protection Authority (www.dpa.gr).

VRealm I.K.E., as Cardora’s operator, acts as controller for the personal data required to operate the marketplace, provide support, protect accounts, manage listings and orders, conduct verification and comply with legal obligations.

This policy covers data supplied directly by users, data generated through platform use and data received from integrated providers or the other party to a transaction where necessary for the transaction, dispute handling, fraud review or service security.

Cardora may process identity and contact information such as full name, handle, email, city, biography, avatar, public profile image and profile preferences. It may also process account and access data such as a hashed password, authentication states, security logs and device or session indicators.

Marketplace data also includes listings, favourites, follows, order history, notifications, reviews, support tickets, on-platform messages and moderation results. Checkout and payout processing includes order metadata, payment references, charge, transfer and payout references, connected-account statuses, refund indicators and related audit trails.

Identity verification takes place through Didit as described in the dedicated section. Payment and bank-account information is processed through Stripe and Stripe Connect. No separate proof of address or IBAN document is requested for Cardora verification.

Most data comes from users when they create an account, complete a profile, upload a listing, place an order, send a message, follow other users, submit verification information or contact support. Cardora also creates operational records from service use, such as order state changes, notification history, unread states, moderation flags, release states, shipping states and security logs.

Cardora processes this data to provide accounts and the marketplace experience, complete protected orders, enable payouts, handle disputes and returns, moderate content, detect fraud and abuse, respond to support requests and comply with legal obligations.

The legal basis may be performance of a contract or pre-contractual steps, compliance with a legal obligation, Cardora’s legitimate interests in security, fraud and abuse prevention and transaction documentation, or the user’s consent where specifically requested for optional choices.

Cardora uses providers such as Stripe and Stripe Connect for protected checkout, connected accounts, releases, transfers, payouts and related payment states. When these services are used, Cardora may send the provider data necessary to process payment, check compliance, verify seller readiness and lawfully provide the service.

Didit provides identity verification. Stripe may independently request identity, address, bank-account information or documents during its own onboarding. Cardora does not request proof of address or a bank document in its new verification process and does not encourage bypassing protected payments.

On-platform messages may be processed to deliver conversations, show unread status, associate them with orders, detect abusive or off-platform conduct, apply automatic or manual flags and retain evidence for disputes, fraud investigations, support or enforcement. Cardora may use automated filters, masking or flagging when prohibited contact details, threats, insults or attempts to move a transaction off the platform are detected.

Cardora transfers data to hosting, storage, authentication, notification, analytics, support, security, email, payment, payout and courier-related providers only to the extent necessary to provide the marketplace or comply with legal obligations. The other party to a transaction receives only the information necessary for the transaction, dispatch, receipt or dispute handling.

Where providers or subprocessors process data outside the user’s country or the EEA, Cardora seeks to rely on a lawful transfer mechanism, such as an adequacy decision, Standard Contractual Clauses or another recognised safeguard under the GDPR.

Cardora retains data for as long as reasonably necessary to operate accounts, host listings, support orders, comply with tax and accounting obligations, keep evidence for disputes and fraud reviews and maintain service security. Different record types may have different retention periods depending on their nature and purpose.

Subject to legal limitations, users may request access, rectification, erasure, restriction, portability or objection. They may also contact Cardora about data accuracy, compromised security, verification records or payout-related data. Cardora may request identification before responding.

Users who believe their data is being processed unlawfully may first contact Cardora and may also lodge a complaint with the Hellenic Data Protection Authority or another competent supervisory authority where applicable. Cardora may update this policy to reflect legal or operational changes and will publish the latest version with its update date.