Privacy policy

<p><strong>Last updated: November 2, 2026</strong></p>
<p>This Privacy Policy explains how Aloha Card Shop LLC ("Aloha Card Shop", "we", "us") collects, uses and shares personal information when you visit www.alohacardshop.com or members.alohacardshop.com, buy from us online or in our stores, submit cards for PSA grading through us, sign up for our emails or text messages, or use our apps (the Aloha Card Shop member app, and ACS Staff for our employees).</p>
<h2>Information we collect</h2>
<ul>
<li><strong>Contact and account details:</strong> name, email address, phone number, shipping and billing address, and your customer account.</li>
<li><strong>Orders and payments:</strong> what you buy, sell or trade with us, order history and pickup store. Card payments are processed by Shopify Payments or our card processor; we do not store full card numbers.</li>
<li><strong>PSA grading submissions:</strong> the cards you submit, fees, status and pickup details.</li>
<li><strong>Text message details:</strong> your mobile number, the text topics you chose, and a record of your consent (date, time, how you signed up and the consent words shown to you), plus any STOP or opt-out.</li>
<li><strong>Device and usage data:</strong> browser, IP address and pages viewed, collected through cookies used by our Shopify store.</li>
</ul>
<h2>How we use it</h2>
<p>To process orders, trade-ins and payments; run PSA grading submissions and tell you when they are ready; operate customer and member accounts and events; send emails or texts you agreed to; prevent fraud; and meet legal obligations.</p>
<h2>Text messages (SMS)</h2>
<p>If you opt in, Aloha Card Shop texts you about your PSA submissions and, only if you separately choose it, about our events and promotions. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help. Consent to texts is never a condition of purchase. Full SMS terms: <a href="https://www.alohacardshop.com/pages/sms-terms">www.alohacardshop.com/pages/sms-terms</a>.</p>
<p><strong>We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Mobile numbers, phone numbers and SMS opt-in data will not be shared with or sold to third parties or affiliates.</strong> Text messaging originator opt-in data and consent are not shared with any third parties. We share your number only with the service providers that deliver our texts or keep our customer records (such as our SMS provider and Shopify), solely for those purposes.</p>
<h2>Who we share information with</h2>
<p>We do not sell your personal information, and we never sell or share mobile numbers or SMS opt-in data (see above). We share other information only with service providers who help us run the business, under contract and only for that purpose: Shopify (online store, accounts and payments), our SMS and email delivery providers, shipping carriers, PSA (for grading submissions you make), eBay (for items we sell there), Anthropic (to turn what you type into our website's “Help me find it” box into search filters; we don't store it), and our hosting and database providers. Our ACS Staff app also uses the providers listed in its section below. We may also disclose information when required by law or to protect our rights.</p>
<h2>How long we keep it</h2>
<p>We keep order, submission and consent records as long as needed for the purposes above and for tax, accounting and legal requirements. Text consent records are kept while you are signed up and for a reasonable time after you opt out, as proof of consent.</p>
<h2>Your choices and rights</h2>
<p>You can unsubscribe from emails with the link in any email, stop texts by replying STOP, and ask us to access, correct or delete your personal information by contacting us below. Depending on where you live you may have additional rights, which we will honor as required by law.</p>
<h2>Aloha Card Shop member app</h2>
<p>The member app shows your account from members.alohacardshop.com. If you tap Check in at an event, the app uses your location once to confirm you are at the venue. We do not store your location, and the app never tracks it in the background. If you turn on notifications, we keep your device's push token to send them. You can also add your member card to Apple Wallet. You can turn location and notifications off at any time in iPhone Settings.</p>
<h2>ACS Staff app (for our employees)</h2>
<p>ACS Staff (the iPhone app and staff.alohacardshop.com) is only for our employees, with accounts our admins create. There is no sign-up.</p>
<h3>What it collects about employees</h3>
<ul>
<li><strong>Account and work:</strong> name, email or username, role, stores, permissions, and what you do in the app and when. Passwords are held by our sign-in provider; PINs are stored only hashed.</li>
<li><strong>Devices:</strong> your signed-in devices (type, browser, last used) and, if you turn alerts on, push tokens and the alerts sent. The app keeps IP addresses only hashed, except for consignment signatures and the shop's label-printer computers.</li>
<li><strong>Consignment (only if you consign):</strong> your agreement, items, sales, statements, checks, receipts, personal email and mailing address, and, for each signature or drop-off receipt, how it was confirmed, IP address and browser.</li>
</ul>
<h3>What employees enter about customers</h3>
<p>Name, email and phone, ID and trade-in photos, trades, payouts, store credit, gift cards, discount codes, PSA submissions, counter text consent (PSA pickups and, if chosen, events), member and event details, notes, and which emails and texts were sent. Staff also see Shopify and members-site customer details and eBay buyers' usernames. ID photos are private: in the app only staff at that store and our managers and admins can open them, and each view is recorded.</p>
<h3>Device permissions</h3>
<p>The app uses the camera only when you scan or take a photo (barcode images stay on the device; photos are uploaded, and item photos may appear on our listings), saves to Photos only when you choose, and sends notifications only if you turn alerts on. You can turn these off in iPhone Settings → ACS Staff or your browser settings.</p>
<h3>How it is used</h3>
<p>To run the shop (trade-ins, payouts, inventory, labels, PSA, consignment, events, members), send the texts and emails customers agreed to, keep accounts secure, prevent fraud and keep required records. No ads, analytics or tracking; we do not sell this information.</p>
<h3>Who gets it</h3>
<p>Supabase (database, sign-in, files); Vercel (hosting); Shopify (customer accounts, store credit, gift cards, discount codes, listings, PSA register items, and orders for eBay sales with the buyer's eBay username); Resend or Postmark (email); Twilio (texts); Apple (iPhone alerts, which may show a trade name as typed, amounts and employee names); browser push services (encrypted alerts); Discord (team alerts without customer contact details; they can name employees and amounts owed to consignors). Card lookups send only certificate, order or product numbers or links (PSA, CGC, CardHedge, Firecrawl, TCGplayer, Waxstat, Lunar). Each provider gets only what its job needs, and we use only providers whose contracts or terms require the same or equal protection as this policy.</p>
<h3>Keeping and deleting it</h3>
<p>We do not delete these records on a schedule; we keep them, including ID photos, as shop records and at least as long as tax, accounting and legal rules require. Hosting and database providers may keep technical logs, such as IP addresses.</p>
<p><strong>Employees:</strong> ask an admin (or admin@alohacardshop.com) to turn off or delete your account. It then cannot sign in, its PIN is deleted, its devices are signed out and alerts stop. We keep your name, email, sign-in, device, alert and consignment records and work history, and an admin can restore it.</p>
<p><strong>Customers and others:</strong> email admin@alohacardshop.com to see or correct what staff entered about you, or to ask us to delete it. We delete or de-identify what we need not keep; trade, payout, ID-check and PSA records may need to be kept for tax and legal reasons. Reply STOP to stop texts.</p>
<h2>Cookies</h2>
<p>Our online store uses cookies set by Shopify to keep your cart and login working and to understand how the site is used. You can control cookies in your browser settings.</p>
<h2>Children</h2>
<p>Our websites and apps are not directed to children under 13, and we do not knowingly collect personal information online from children under 13.</p>
<h2>Changes</h2>
<p>We may update this policy and will post the new version here with a new date.</p>
<h2>Contact</h2>
<p>Aloha Card Shop LLC, 320 Ward Avenue, #200, Honolulu, HI 96814 · admin@alohacardshop.com · 808-591-9955</p>