Privacy Policy
Last updated: 20 October 2026
This policy explains what personal data Grailo collects, why, and what rights you have. It applies to grailo.gg and to the emails we send.
1. Who is responsible
The data controller is [Company name to be completed], [Registered address to be completed], VAT [VAT number to be completed]. For anything about your data, write to privacy@grailo.gg.
2. What we collect and why
| Data | Purpose | Legal basis | How long we keep it |
|---|---|---|---|
| Steam account data: Steam ID, public name and avatar | Signing you in and showing your profile | Performance of our contract with you | While your account exists |
| Trade URL and Steam Web API key (encrypted) | Receiving the cards you buy and verifying the offers you send | Performance of contract | Until you remove them or close your account |
| Inventory of your Origins TCG items | Listing items, checking ownership before a sale, building your collection album | Performance of contract | Refreshed when you sync; removed with your account |
| Listings, trades, offers and balance history | Running the marketplace, resolving disputes, preventing fraud | Performance of contract, legal obligations | 10 years, as required for accounting records |
| Payment and payout data, including IBAN (encrypted) and identity checks | Paying you and complying with anti-money-laundering rules | Legal obligation, performance of contract | As required by law, normally 10 years |
| Email address and Discord webhook for alerts | Sending the notifications you asked for | Your consent, which you can withdraw in Settings | Until you remove them |
| Waiting list email | Telling you when Grailo opens | Your consent | Until launch, or until you unsubscribe |
| IP address and technical logs | Security, rate limiting and troubleshooting | Our legitimate interest in keeping the service safe | Up to 30 days |
| Reports you send us | Handling notices about illegal content or abuse | Legal obligation under the Digital Services Act | Up to 2 years |
We do not sell your data, we do not use it for advertising, and we do not build profiles for marketing. Public information, such as your Steam name, listings, completed sales and badges, is visible to other users. You can hide your collection value from the leaderboards in Settings.
3. Who we share it with
We use trusted providers that process data on our behalf, only as needed to run Grailo:
| Provider | What for | Where |
|---|---|---|
| Railway | Hosting of the website and database | United States; transfers covered by Standard Contractual Clauses |
| Stripe | Payments, payouts and identity checks | EU and United States; Stripe is an independent controller for some data |
| Brevo | Sending notification emails and the launch announcement | European Union |
| Valve (Steam) | Sign-in, inventories and trade offers | Valve processes Steam data under its own privacy policy |
| Porkbun | Domain name and DNS | United States |
When a trade happens, the buyer's trade URL is shown to the seller so that the card can be delivered. We may also disclose data when the law requires it, for example to tax or law enforcement authorities.
4. Security
Steam API keys and bank details are encrypted. Access to the database is restricted, connections use HTTPS, and every money movement is recorded in an audit log. No system is perfectly secure: if a breach affects you, we will tell you and the authorities as the law requires.
5. Your rights
You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. You can withdraw consent at any time, without affecting what we did before. Write to privacy@grailo.gg; we reply within one month. Some data, such as accounting records, must be kept even after you close your account.
You also have the right to complain to a data protection authority. In Italy this is the Garante per la protezione dei dati personali (garanteprivacy.it).
6. Children
Grailo is not intended for anyone under 18. If you believe a minor has created an account, contact us and we will close it.
7. Cookies
We only use cookies that are necessary for the site to work. See the Cookie Policy.
8. Changes
If we change this policy in a way that matters to you, we will tell you on the site or by email before the change takes effect.