Privacy you can understand.

Who is responsible

Lukas Haring, operating as Best Grading Tools in Spain, is the controller for the public website and the app data described in this notice. Privacy and data-rights requests can be sent to [email protected].

The product is in pre-launch. The controller’s public service address and, if applicable, tax or registry details must be confirmed before paid public release. Until then, this page remains excluded from search indexing and is not the final release notice.

Release gate: the controller’s public service address and any legally required tax or registry details still require owner confirmation.

What we handle

BGT limits collection to the data needed for the public site, account access, the report you request, purchases and support.

Public website

Requested page, language, basic browser and request information, IP address handled in transit, and performance measurements. Optional Google Analytics 4 is loaded only after consent and receives public page paths without app identity or grading data.

Launch list

Email address, language, web source and consent time when you choose to join. The subscription record does not store your IP address or browser identity.

Account and access

A Firebase user identifier, account type, locale, security status and the versions and server timestamp of your legal choices. Email address and display name are added only when you link the account with email, Google or Sign in with Apple. Social sign-in does not request contacts or files from your provider account.

Notifications

If you enable alerts, BGT uses an installation identifier, APNs/FCM delivery token, permission state, locale, time zone and delivery status to notify you about grading progress or a result you requested. Notification text avoids private card or grade details on the lock screen.

Requested report

The card identity you confirm, private photographic evidence selected for analysis, capture-quality metadata, observations, report result, timestamps and processing status.

G tokens and purchases

Wallet balance, reservation and ledger entries, Apple product and transaction identifiers, purchase status, refunds and revocations. Apple handles the payment method; BGT does not receive full card or bank details.

Support and security

Messages you send, report ID when supplied, authentication and abuse-prevention signals, operational errors and an audit record for restricted administrative actions. Product logs exclude private images and report contents.

What stays on your iPhone

Temporary capture material stays on the iPhone while the app prepares a report. You can also choose Save without grading: the four original photos and their crop bounds then stay only on that iPhone, under the active account, and BGT does not upload them or create a cloud backup.

Photos saved without grading can be lost when deleting the app, losing or replacing the iPhone, or clearing local data. They are uploaded only if you later choose to use a token for grading. The identifier, title, collection and dates sync with your account so the entry can appear on the web, without photos, OCR or scan history.

Why we use it

Provide the service · contract

Create and secure an account, recognise the selected card, process the requested visual estimate, deliver the private report, operate G tokens and restore completed purchases.

Requested notifications · permission and contract

Register the device and deliver operational grading alerts only after you allow notifications in iOS. You can switch them off in iOS Settings at any time without losing access to your reports.

Security and reliability · legitimate interests

Prevent abuse, protect private files, reconcile failed jobs and purchases, diagnose faults and keep an auditable record of restricted administrator actions.

Accounting and disputes · legal obligation

Keep the minimum purchase and transaction information required for tax, accounting, refund, fraud-prevention or legal claims.

Optional site analytics · consent

Measure how public pages are used with Google Analytics 4 only after you choose “Allow analytics”. You can withdraw that choice from Analytics settings in the footer.

Launch and product emails · consent

Send the early-access notice and occasional useful product or grading notes. You can withdraw consent through the unsubscribe route in future messages or by contacting support.

Assisted visual analysis

BGT uses assisted processing to organise visible condition evidence and produce the estimate you request. It does not authenticate a card, establish market value or make a decision with legal or similarly significant effects.

The output is a conservative visual estimate, not an official grade. You choose the card, initiate the analysis and can contact support to ask about a result. BGT does not use report evidence for advertising profiles.

Service providers and transfers

Access is limited to providers needed to operate BGT. We do not sell personal data. Some providers may process data outside the EEA, including in the United States, under their contractual safeguards and recognised transfer mechanisms where applicable.

Google · Firebase infrastructure

Provides authentication, private database and storage, server functions and abuse protection. On the website, App Check uses invisible reCAPTCHA Enterprise risk signals and its necessary cookie solely for security and fraud or abuse prevention; it does not ask you to solve a challenge. Firebase Authentication operates from US data centres; other services may use selected or global Google infrastructure.

OpenAI · assisted visual analysis

Processes private images only to produce the requested analysis through the API. BGT disables response storage and does not enable generative tools. API data is not used to train models unless expressly opted in; limited safety and abuse-prevention logs may generally be retained for up to 30 days.

Apple · account and purchases

Provides Sign in with Apple, the App Store and in-app purchases. Apple processes payment, store, device and fraud-prevention information under its own privacy terms; BGT receives only the transaction information needed to deliver or revoke G tokens.

Cloudflare · public edge services

Serves the website, DNS, security, public card-catalogue requests and the consented launch-list KV. Cloudflare Web Analytics measures page performance without browser storage or cross-site tracking and discards source IP addresses at the nearest data centre before core analytics storage.

Google Analytics 4 · optional public-site analytics

Loads only after you accept analytics. Uses cookies with pseudonymous identifiers for up to 60 days. Measures clean public paths, language, technical information, button clicks and confirmed launch-list signups; never email, Firebase UID, wallet, card searches, evidence or report IDs. Advertising, Google Signals and personalisation remain disabled. You can withdraw consent in Analytics settings; sending stops and these cookies are deleted, without deleting previously sent data.

• Firebase privacy and security ↗
• OpenAI API data controls ↗
• Cloudflare Web Analytics privacy ↗
• Apple App Store privacy ↗

How long we keep it

Unfinished report upload

An abandoned server-side draft and its uploaded evidence expire after 24 hours. Temporary local capture material is removed earlier after selection, cancellation or failure.

Cards saved without grading

Kept only on that iPhone until you delete the card or account, uninstall or clear the app, or lose the device. BGT has no remote copy to restore.

Evidence and reports

Kept privately until you delete that report or delete the account. Deleting a report removes its private evidence, generated report and associated analysis content.

Account and wallet

Kept while the account is active. Account deletion removes private files, reports, jobs, account profile and wallet records; security audit identities may be pseudonymised and legally required transaction records may be retained for the applicable limitation period.

Support

Support correspondence is kept until the request is resolved and for up to 12 additional months, unless a dispute or legal obligation requires longer retention.

Launch list

Kept until you withdraw consent or the pre-launch programme closes. An unsubscribe route must be present before regular campaigns begin.

Public-site analytics

Cloudflare retains unsampled beacon data for 7 days and then aggregates it. If GA4 is activated, BGT will use the shortest configurable user and event retention of 2 months; standard aggregated reports may remain longer. Your consent preference stays in this browser until you change or clear it.

Your choices and rights

Depending on your location, you may ask for access, a copy, correction, deletion, restriction, objection or portability of your personal data. You may withdraw optional analytics consent at any time without affecting earlier lawful processing.

Delete an individual report or the whole account from Settings in the app. For access, portability or another rights request, email [email protected] from the linked account where possible. We may need to verify control of the account before returning private information.

You may also complain to the data-protection authority where you live or work, or where you believe an infringement occurred.

• European data-protection authorities ↗
• Spanish Data Protection Agency ↗

Security, age and changes

Private data is protected in transit, encrypted at rest by the infrastructure provider, isolated by account and served without permanent public file URLs. App and server checks restrict sensitive operations; no method of storage is guaranteed to be risk-free.

BGT is not directed to children. You must be at least 18 to use the grading service or submit evidence for analysis.

We will update this notice when the product, providers or legal requirements change. Material changes will receive a new effective date and, when appropriate, an in-app notice before the new processing begins.