Privacy Policy

Graid Ai is operated by Graid Ai LLC, a Delaware Limited Liability Company. For any privacy-related questions, requests, or concerns, contact us at:

• Email: support@graid.ai
• Website: graid.ai
• Application: app.graid.ai
• Mailing address: Graid Ai, 600 N. Neil St., Unit 200, Champaign, IL 61824

We collect the following categories of personal data:

• Identity — Name, email address. (You provide directly at account creation or checkout.)
• Contact — Shipping address, phone number (optional). (You provide at checkout or in profile settings.)
• Transaction — Order history, card submissions, grades received, fees paid. (Generated through your use of the Services.)
• Payment — Last 4 digits of card, payment method type, transaction reference. (Handled by our payment provider — Graid Ai never sees or stores full card numbers.)
• Card Data — Card photos, extracted card details, pre-grades, catalog entries, grading results. (You provide photos; Graid Ai generates analysis.)
• Usage — App interactions, pages visited, features used, session duration. (Automatically collected.)
• Device — Device type, operating system, browser type, IP address. (Automatically collected.)
• Communications — Support emails, in-app messages, SMS opt-in status. (You provide or generated through contact with us.)
• Referral — Referral code, referral credits earned and used, referred user count. (Generated through your participation in the referral program.)

We do not collect sensitive personal data such as race, ethnicity, health information, religious beliefs, or biometric identifiers.

The Services are currently offered to United States residents only. We process your personal data as necessary to provide the Services, fulfill your orders, manage our business relationship with you, prevent fraud, ensure platform security, and comply with applicable US law. By using the Services you consent to the collection and use of your data as described in this Privacy Policy.

• Service delivery: Processing orders, shipping coordination, grading, Registry population, customer account management.
• Communications: Order confirmations, shipping updates, grading results. We send these transactional messages regardless of marketing preferences as they are necessary for the Services.
• SMS notifications: Only when you have explicitly opted in. You can opt out at any time by replying STOP to any SMS or contacting support@graid.ai.
• Product improvement: Analyzing usage patterns and grading accuracy to improve our grading models and overall service quality. Graid Ai may use images of submitted cards and their grading outcomes to develop, train, evaluate, and improve its own grading models. Third-party AI providers that process images on our behalf do not use them to train their models.
• Fraud prevention & security: Detecting fraudulent submissions, counterfeit cards, account abuse, and protecting platform integrity.
• Legal compliance: Meeting applicable legal obligations, responding to lawful requests from authorities.
• Referral program: Tracking referral codes, awarding credits, and managing the referral program.

We do not sell, rent, or trade your personal data to third parties for their marketing purposes. Ever.

We share personal data only with the following categories of recipients, and only to the extent necessary:

• Payment processing — Name, email, and payment details are handled by a PCI-DSS compliant third-party payment provider. Graid Ai never receives or stores full payment card numbers.
• Hosting, database, and file storage — Application hosting and data storage are provided by third-party infrastructure providers. Personal data is stored on servers located in the United States.
• Communications delivery — Transactional email and, where you have opted in, SMS messages are delivered through third-party messaging providers. Your phone number is shared only if you opt in to SMS.
• Shipping and shipment coverage — Name, shipping address, and (where Return Shipping Protection is elected) declared shipment value are shared with the delivery carrier and, where applicable, a shipping insurance provider, solely to generate the return label and place coverage on the shipment.
• Advertising and measurement platforms — Social, search, and display advertising networks receive information about your visit, such as pages viewed and whether an order was completed, so we can measure advertising performance. In some cases this includes a hashed, irreversible form of an email address. We never share your name, shipping address, or payment details with advertising platforms. Card images and grade results that we publish as promotional content may appear on these platforms as part of our own marketing — always as card content only, never linked to your identity. You can opt out at any time — see Section 7.
• Grading technology — Card images you submit are processed by Graid Ai's grading infrastructure, which includes third-party AI providers acting as our processors under contract, to produce grading analysis. Those providers do not use your images to train their models. Graid Ai retains images of submitted cards and may display, reproduce, and publish them — including on our website, the Registry and lookup database, social media, and in advertising and other promotional materials — as described in Section 9 of our Terms & Conditions. We never sell your card images, and we never publish your name, address, or other personal details alongside them. Published card images show the card only.
• Card reference data — Non-personal card identification details (such as player, year, and set) may be sent to third-party catalog and marketplace sources to match a card. No personal data is shared for this purpose.
• Professional advisors — Legal, accounting, and insurance advisors, each bound by confidentiality obligations.
• Legal and safety — Law enforcement, regulators, or other parties where disclosure is required by valid legal process, court order, or applicable law, or is necessary to protect our rights or the safety of others.

A current list of the categories of service providers we engage is available on request at support@graid.ai.

In the event of a merger, acquisition, or sale of all or substantially all of Graid Ai's assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will endeavor to notify you of such transfer via email or prominent notice on our platforms. Your continued use of the Services following any such transfer constitutes acceptance of the successor entity's terms and privacy practices.

• Account data: Retained while your account is active and for three (3) years following account closure, to support dispute resolution, legal compliance, and Registry integrity.
• Order and grading records: Retained for seven (7) years to comply with applicable tax and business record requirements.
• Card photos (pre-grade): Pre-grade photos you capture are stored on your device and on Graid Ai servers, and are retained while your account is active and for two (2) years following account closure.
• Card photos (submitted and graded cards): Images of cards submitted for official grading are retained indefinitely to support the Registry and lookup database, certification integrity, dispute resolution, and promotional use as described in Section 9 of our Terms & Conditions. These images are associated with card serial numbers rather than personal identifiers after your account is closed.
• Registry entries: Retained indefinitely for Registry integrity. These records are associated with card serial numbers, not personal identifiers, after your account is closed.
• Marketing preferences and communications: Retained until you opt out plus thirty (30) days for processing.
• Support communications: Retained for three (3) years from the date of the last communication.

Depending on the state you live in, you have some or all of the following rights with respect to your personal data:

• Access: Request a copy of the personal data we hold about you, including the categories of sources it came from and the categories of recipients we shared it with.
• Correction: Request correction of inaccurate or incomplete personal data.
• Deletion: Request deletion of your personal data, subject to our retention obligations under Section 6.
• Portability: Request a copy of the data you provided to us in a portable, machine-readable format.
• Opt out of targeted advertising: Direct us to stop using or sharing your personal information for targeted advertising, using the "Do Not Sell or Share My Personal Information" link in our website footer.
• Global Privacy Control: If your browser or extension sends a GPC signal, we treat it as a valid opt-out of targeted advertising automatically. No further action is required from you.
• Opt out of SMS: Reply STOP to any SMS message, or contact support@graid.ai at any time.
• Non-discrimination: We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised a privacy right.
• Appeal: If we decline a request, you may appeal by replying to our response. Residents of certain states may also contact their state Attorney General.

A note on "sale" and "sharing." Graid Ai does not sell your personal information for money, and we do not disclose it to third parties for their own independent marketing. We do advertise on social, search, and display networks and use their measurement tools, and under California, Colorado, Connecticut, Texas, Virginia, and similar state laws that activity may be classified as "sharing" personal information for targeted advertising, or as a "sale" under the broad statutory definition. You can opt out at any time using the footer link or a GPC signal. We do not sell or share the personal information of any individual we know to be under 16 years of age.

To exercise any of these rights, submit a written request to support@graid.ai with the subject line "Privacy Request," including your name, email address, and a description of your request. We will respond within forty-five (45) days and will tell you if we need additional time. We may take reasonable steps to verify your identity before processing your request. You may designate an authorized agent to submit a request on your behalf.

We implement industry-standard technical and organizational security measures including encrypted connections (TLS/HTTPS), access controls, database-level row security, and regular security reviews. However, no data transmission or storage system is 100% secure.

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, Graid Ai will, to the extent required by applicable law:

• Notify the relevant supervisory authority within the timeframe required by applicable law;
• Notify affected individuals where the breach is likely to result in high risk to their rights and freedoms, within the timeframe required by applicable law;
• Document the breach, its effects, and remedial actions taken.

Breach notifications, where required, will be sent to the email address associated with your account. We recommend keeping your account email current. Graid Ai's obligation to notify is limited to what is required under the laws of applicable jurisdictions and does not extend beyond those requirements.

The Services are not directed to individuals under the age of 18. Graid Ai does not knowingly collect personal data from minors. If you are a parent or guardian and believe that a minor has provided personal information to Graid Ai, please contact us immediately at support@graid.ai and we will take steps to delete that information promptly.

The Services are operated in and intended for use within the United States. All data is stored and processed in the United States. If you are located outside the United States, you should not use the Services. By using the Services, you acknowledge that your data will be processed in the United States under US law.

We may update this Privacy Policy from time to time. Notice of material changes will be provided via email or in-app notification at least seven (7) days before the effective date. Your continued use of the Services after the effective date constitutes acceptance of the revised policy.