Privacy Policy

Effective Date: April 27, 2026

Last Updated: April 27, 2026

This Privacy Policy describes how Izzet Labs LLC d/b/a TCG Dealflow (“Company,” “we,” “us,” or “our”), a Florida limited liability company, collects, uses, discloses, and protects personal information when you use TCG Dealflow (the “Service”).

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.

1. Who We Are

The Service is owned and operated by Izzet Labs LLC d/b/a TCG Dealflow, a Florida limited liability company. For privacy-related questions, contact us at:

Email: legal@tcgdealflow.com

2. Information We Collect

We collect information that you provide directly, information collected automatically, and information from third parties.

2.1 Information You Provide Directly

• Account Information: Email address, password (stored as a hash, never in plain text), display name (optional), and account preferences.
• Subscription and Billing Information: Subscription tier, billing period, and payment status. We do not store full payment card numbers. All payment information is collected and processed by Stripe, Inc. (see Section 4.1).
• User-Submitted Content (“User Content”): Listing details, asking prices, photos, descriptions, negotiation notes, seller names, seller platforms, seller contact details, message history, deal outcomes, and any other information you enter into the Service.
• Communications: Email replies, in-app feedback, and any messages you send to us at legal@tcgdealflow.com or other support channels.
• Waitlist Submissions: If you submit your email on our landing page before signing up, we collect your email address to notify you of launch and product updates.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, actions taken within the Service, timestamps, session duration, and similar telemetry.
• Device and Connection Data: IP address, browser type, operating system, device identifiers, referring URLs.
• Cookies and Similar Technologies: Session cookies for authentication, persistent cookies for preferences, and analytics-related identifiers. See Section 7.

2.3 Information from Third Parties

• Payment Confirmation Data: From Stripe, we receive subscription status, payment success/failure events, and the last four digits and brand of your payment card (for display purposes only).
• Authentication Providers: If you sign in via a third-party provider (e.g., Supabase Auth), we receive basic profile information necessary to create or authenticate your account.

3. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Authenticate users and protect account security
• Process subscription payments and manage billing
• Generate AI-powered analyses, draft messages, and recommendations based on User Content you submit
• Communicate with you about your account, subscription, product updates, and support requests
• Send you emails about new features, important changes, or marketing (you can opt out of marketing emails at any time — see Section 8)
• Improve, debug, and optimize the Service
• Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service
• Comply with legal obligations and enforce our agreements

We do not sell your personal information. We do not use your User Content to train any AI model.

4. How We Share Information

We share information only with the third parties necessary to operate the Service, as required by law, or with your consent.

4.1 Stripe (Payment Processing)

Subscription payments are processed by Stripe, Inc. When you subscribe, your payment information is collected and processed directly by Stripe under their privacy policy. We receive subscription status, billing events, and limited card metadata (brand, last four digits) from Stripe. We do not store full payment card numbers.

Stripe’s privacy policy: https://stripe.com/privacy

4.2 Anthropic (AI Provider)

The Service uses AI services provided by Anthropic, PBC to generate analyses, recommendations, and draft messages. When you submit User Content for AI processing, that content is transmitted to Anthropic’s API for the sole purpose of generating the requested output.

Anthropic does not use your data to train its models when accessed through the API under our commercial agreement. Anthropic’s privacy policy: https://www.anthropic.com/legal/privacy

4.3 Resend (Email Delivery)

We use Resend to deliver transactional emails (account confirmation, password reset, billing notifications, product updates). Resend processes your email address and the contents of any email we send to you.

Resend’s privacy policy: https://resend.com/legal/privacy-policy

4.4 Supabase (Database and Authentication)

We use Supabase to host our database and manage authentication. Your account credentials, User Content, and other data are stored on Supabase infrastructure.

Supabase’s privacy policy: https://supabase.com/privacy

4.5 Vercel (Hosting)

The Service is hosted on Vercel. Vercel processes server logs and connection metadata necessary to deliver the Service.

Vercel’s privacy policy: https://vercel.com/legal/privacy-policy

4.6 Legal Requirements

We may disclose your information when required by law, subpoena, court order, or other legal process; to protect our rights, property, or safety, or the rights, property, or safety of our users or others; or to investigate fraud, abuse, or violations of our Terms.

4.7 Business Transfers

If Izzet Labs LLC is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you (e.g., via email or in-app notice) before your information becomes subject to a different privacy policy.

4.8 With Your Consent

We may share information for any other purpose disclosed to you and with your consent.

5. Information About Third Parties (Sellers, Counterparties)

The Service allows you to log information about sellers and other counterparties as part of your negotiation workflow. This information is submitted by you and stored as part of your private User Content. We do not share this information publicly or with the individuals it describes.

You are responsible for the lawfulness of the seller and counterparty information you collect and store. You represent and warrant that you have the right to collect, store, and use this information under all applicable laws (including, where relevant, U.S. state privacy laws and the laws of other jurisdictions). If a seller or counterparty contacts us directly to request the deletion of information you have stored about them, we may, at our discretion, comply with that request and notify you.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

• Account Information: Retained while your account is active. Deleted within 30 days of account closure, except as needed for legal compliance.
• User Content: Retained while your account is active. Upon account closure, deleted within 30 days unless retention is required by law.
• Billing Records: Retained for at least seven (7) years to comply with tax and accounting obligations.
• Waitlist Emails: Retained until you unsubscribe or request deletion.
• Logs and Analytics: Retained for up to 24 months for security, fraud prevention, and operational analysis.

You may request deletion of your account and data at any time (see Section 8).

7. Cookies and Tracking

We use cookies and similar technologies for:

• Essential Functions: Authentication, session management, security. These cannot be disabled.
• Preferences: Remembering your settings and preferences.
• Analytics: Understanding how the Service is used (anonymized where possible).

You can control cookies through your browser settings, but disabling essential cookies will prevent the Service from functioning properly. We do not use cookies for cross-site advertising or behavioral tracking by third parties.

8. Your Rights and Choices

Depending on where you reside, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Portability: Request your data in a portable format
• Opt Out of Marketing: Unsubscribe from marketing emails at any time using the unsubscribe link in any marketing email, or by contacting us
• Withdraw Consent: Where processing is based on consent, withdraw that consent at any time

To exercise any of these rights, email us at legal@tcgdealflow.com. We will respond within 30 days. We may need to verify your identity before fulfilling certain requests.

8.1 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act, including the right to know what personal information we collect, the right to delete, the right to correct, and the right to opt out of “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under California law.

8.2 Florida Residents

If you are a Florida resident, you have certain rights under the Florida Digital Bill of Rights (FDBR), including the right to access, correct, delete, and request a portable copy of your personal information. To exercise these rights, contact us at legal@tcgdealflow.com.

8.3 European Economic Area, United Kingdom, and Other Jurisdictions

If you are located outside the United States, you may have rights under your local data protection laws (e.g., GDPR in the EEA/UK). We will honor valid requests to the extent required by applicable law. The legal bases on which we rely are: performance of our contract with you (to provide the Service), legitimate interests (to operate, secure, and improve the Service), consent (where applicable), and legal obligation.

If you are in the EEA or UK and have a complaint about how we handle your data, you have the right to lodge a complaint with your local data protection authority.

8.4 International Data Transfers

The Service is operated from the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. By using the Service, you consent to that transfer.

9. Data Security

We use commercially reasonable technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of sensitive data at rest where applicable
• Hashed password storage (we never store plain-text passwords)
• Access controls and authentication on internal systems
• Vendor security standards via established providers (Stripe, Supabase, Vercel, Anthropic, Resend)

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security. You are responsible for keeping your account credentials confidential. If you suspect unauthorized access to your account, contact us immediately.

In the event of a data breach affecting your personal information, we will notify you and applicable regulators as required by law.

10. Children’s Privacy

The Service is not directed to children under the age of 18, and we do not knowingly collect personal information from children. If we learn we have collected personal information from a child under 18, we will delete it. If you believe we have collected information from a child, contact us at legal@tcgdealflow.com.

11. Third-Party Links and Services

The Service may contain links to third-party websites, marketplaces (e.g., Facebook Marketplace, eBay), or services. We have no control over and are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice in the Service at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Privacy Policy.

13. Contact Us

For any questions, requests, or concerns regarding this Privacy Policy or your personal information, contact us at:

Izzet Labs LLC d/b/a TCG Dealflow

Email: legal@tcgdealflow.com

By using TCG Dealflow, you acknowledge that you have read and understood this Privacy Policy.