In short
- No password: you sign in at CardNexus, which never passes your credentials on to us.
- No advertising, no audience measurement, no trackers: no consent banner is needed.
- Orders and your buyers' data are read from CardNexus to be displayed, never stored.
Data controller
[to be completed: name or company name], [to be completed: postal address]. For any question about your data: [to be completed: email address].
What the application keeps
Your account
Your CardNexus account ID, your username, the permissions you have granted, and the dates on which you connected and revoked access. Why: to open your session and work on the right account. Legal basis: performance of the service you request.
The date of your last visit, to the nearest hour — not what you did there. Why: to know who still uses the application. Legal basis: our legitimate interest in running the service. It is deleted along with your account.
Your settings and seller decisions
Your settings (including the interface language, so that it follows you from one computer to another), the games you choose to display, your pricing rules, your pinned prices and set-aside cards, the time of automatic repricing with your time zone and the summary of its last run, the start and end of your scheduled absence with your time zone (erased when you return), your offer response rules and the decisions they made, the history of your stock's value, and that of your seller rating — its average and number of reviews, one point per day, without the text or author of any review. Why: these features do not exist on CardNexus; the application keeps them for you. Legal basis: performance of the service.
This data is kept until you ask for it to be deleted, even if you withdraw the application's access: when you come back, your settings are still there. Once that access has been revoked from your CardNexus account, the application can no longer read or change anything there. From Settings › Your data, or simply by writing to [to be completed: email address], everything it keeps about you — your account, your settings and decisions, your history and your feedback — is deleted, all at once and permanently. Only the server logs follow their own retention period, given below.
Your feedback
The feedback you send from the application — a bug, an idea or a comment — together with the address of the page you were on, the size of your window, your browser and the application version; then its status and the reply we give you. Why: to understand and fix what you report, and to tell you what became of it. Legal basis: our legitimate interest in improving the service. It is read by the operator and by nobody else; it follows the same retention rules as your settings.
Server logs
Like any web server, ours records every request: IP address, date, page requested and browser. Why: security and troubleshooting. Legal basis: our legitimate interest in protecting the service. Retention: [to be completed: log retention period].
The server's last two hundred warnings and errors, which may name your account, are also kept in memory for the operator to consult. They are not written anywhere and disappear when the server restarts.
To protect sign-in against abuse, the server also counts, in memory, the sign-in attempts from each IP address and the requests from each account. This count is not written anywhere. An address that no longer shows up is removed at the next clean-up, which only happens when a new request arrives, at most once a minute: on a quiet server, the latest addresses stay in memory until then. Everything disappears when the server restarts.
What the application reads without keeping
Your stock, listings, sales and orders, offers and balance are read from CardNexus, with the permissions you have granted, at the moment a screen displays them. They are not stored in our database: CardNexus remains their source.
Orders contain your buyers' names and delivery addresses. The application displays them to help you pack your parcels, on your behalf; you remain responsible for this data towards your buyers.
Cookies and browser storage
cnx_session- Your session: the accounts you have connected in this browser, and the one currently in use. Signed, inaccessible to scripts, thirty days at most.
cnx_connect_state- Protects sign-in through CardNexus against forgery; twenty minutes at most, the time it takes to approve access.
- Local storage (
mintanio.theme,mintanio.locale,mintanio.parcel-sort,mintanio.pick-list,mintanio.stock-page-size,mintanio.stock-columns,mintanio.first-steps.*) - Your display preferences — theme, language (the one chosen in this browser, or a copy of your account's, read by the public site and the sign-in screen), parcel sort order, pick list, stock page size and columns, and the home screen's first steps if you have hidden them (one per account, named after its CardNexus ID). They stay in your browser and are never sent to the server.
All of them are strictly necessary for the service you request: they do not require consent. There are no others.
Who has access
The operator, to run the service. For each account, they see what “Your account” above describes, how many items the application keeps — a number of rules, pinned prices, feedback entries, without their content — and how many requests it sends to CardNexus on your behalf. They also read your feedback.
- Our host, [to be completed: host's name], which runs the server and does not use the data. [to be completed: server location (inside the European Union or not)]
- CardNexus, to which the application sends your requests — publishing a listing, marking a sale as shipped — with the permissions you have granted it.
Your data is never sold, rented out or used for advertising.
Your rights
You can access your data, have it corrected or erased, restrict its processing, object to it or request a portable copy, by writing to [to be completed: email address]. To cut off the application's access to your account, revoke it from your CardNexus account.
If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr).