TCGthemall — Privacy Policy

Version 1.1 · Last updated October 28, 2026 · Effective October 28, 2026

1. Who we are

TCGTHEMALL INC. (“TCGthemall,” “we,” “us,” “our”) operates tcgthemall.com and related applications (the “Service”). We are a corporation incorporated in Ontario, Canada, with a mailing address at PO Box 84, Midland PO Main, Ontario, L4R 4K9, Canada.

We are responsible for the personal information we handle. This policy explains what we collect, why, who we share it with, how long we keep it, and what you can do about it.

Questions or requests: info@tcgthemall.com.

2. Who this policy covers

This policy applies to:

Shoppers who use the Service, with or without an account

Subscribers who pay for a subscription

Store operators who claim a listing or subscribe

Creators in our affiliate program

Visitors to our website, wherever you access it from

It does not cover the privacy practices of the stores listed on the Service, or any other third-party website or service. If you buy from a store, visit its site, or attend its event, that store’s own privacy practices apply.

3. What we collect

3.1 Information you give us

What

When

Name, email address, password

Creating an account

Billing name, address, and postal or ZIP code

Subscribing

Payment card details

At checkout — handled directly by our payment processor; we do not see or store full card numbers

Saved searches, alert preferences, favourites

Using subscriber features

Affiliate code and supported creator

Applying a code

Business name, address, contact details, opening hours, listings, inventory, pricing, event details

Claiming or managing a store listing

Tax details, payment details, legal name and address

Joining the affiliate program

Messages, support requests, feedback

Contacting us

3.2 Information we collect automatically

What

Notes

IP address

Used among other things to estimate your approximate location

Device and browser type, operating system, language, screen size

Pages viewed, searches run, features used, time and duration of visits

Referring page, and the affiliate code applied to your visit or account

Cookies and similar technologies

See Section 8

3.3 Location

Search range is central to the Service, so location matters.

We estimate your approximate location from your IP address by default.

You can enter a location manually instead.

You can turn off precise location in your device or browser settings at any time. The Service will still work using approximate or manually entered location.

3.4 Information from others

Payment processor — confirmation of payment, partial card details, subscription status

Store data sources — publicly accessible store websites, from which we collect listings, prices, buylists, and events

Infrastructure and analytics — technical and aggregate usage data

3.5 What we do not collect

We do not intentionally collect government identification numbers from shoppers, health information, biometric information, or precise financial account details. We do collect a SIN or business number from Canadian affiliates, and tax identification numbers from affiliates, because tax law requires it.

4. Why we use it

We use personal information to:

Create and run your account

Provide search, alerts, saved searches, and other features

Show results relevant to your location

Take payment, manage subscriptions, and handle renewals, refunds, and failed payments

Apply affiliate discounts and attribute subscriptions to the right creator

Calculate, pay, and report affiliate commission, and meet tax reporting obligations

Send service messages about your account, billing, and these policies

Send alerts and notifications you have asked for

Send marketing messages where you have consented

Respond to your questions and provide support

Monitor, secure, debug, and improve the Service

Detect and prevent fraud, abuse, and breaches of our terms

Produce aggregated, de-identified statistics about how the Service is used

Comply with law and enforce our agreements

Consent. Under Canadian law we rely on your consent to collect, use, and disclose your personal information, which may be express or implied depending on the sensitivity of the information and the purpose. You can withdraw consent as described in Section 10, though some withdrawals mean we can no longer provide the Service.

We do not sell your personal information.

We share it only as follows:

Service providers who work for us and are bound to use it only for that purpose:

Payment processing and payouts — Stripe. Receives billing and payment information. We do not see or store your full card number.
Hosting and infrastructure — Base44. Stores the data that runs the Service.
Email and notification delivery — our email provider. Receives your email address and the content of messages we send you.
Analytics — Base44, the platform that hosts the Service, records aggregate usage data (such as searches performed and errors) that we read in our admin dashboard. We do not use third-party analytics providers such as Google Analytics.
Advertising — none today. If we enable advertising, Google AdSense would receive limited device and usage data to show ads to non-Pro users, and we will update this policy before switching it on.
Customer support tools — receive your messages and account details as needed to help you.

Creators in our affiliate program. A creator connected to your subscription earns commission from it. Creators do not receive your name, email address, or any other personal information. They see counts and totals only — how many subscriptions are attributed to their code and what they have earned.

Stores.

Others:

Legal and safety — where required by law, court order, or a valid request from an authority, or to establish or defend legal claims, prevent fraud, or protect the rights and safety of any person

Business transfer — to a buyer or successor in a merger, acquisition, financing, or sale of assets, subject to this policy continuing to apply

With your direction — where you ask us to share something

6. Where your information goes

We are based in Canada. Our service providers may store or process personal information in Canada, the United States, or elsewhere.

This means your personal information may be subject to the laws of those countries, and may be accessible to their courts, law enforcement, and national security authorities under those laws.

We take reasonable steps, including contractual protections with our providers, to give your information a comparable level of protection wherever it is processed.

7. How long we keep it

8. Cookies and tracking

We use:

Essential cookies — sign-in, security, and basic functioning. These cannot be turned off.

Preference cookies — remembering your settings, location, and recent searches.

Usage measurement — we measure how the Service is used in aggregate through our hosting platform, Base44, which is how we improve it. We do not set third-party analytics or advertising cookies.

Advertising — we do not currently display ads and set no advertising cookies. If we enable advertising, we will use Google AdSense to display ads to non-Pro users, and you will be able to opt out of personalized advertising via Google’s Ads Settings (adssettings.google.com) or through your browser’s cookie controls.

You can block or delete cookies in your browser settings. Blocking essential cookies will stop parts of the Service working.

9. Marketing and alerts

Service messages about your account, billing, renewals, security, and policy changes are part of holding an account and cannot be opted out of while your account is open.

Alerts and notifications — restock alerts and saved search notifications go to you because you asked for them. Change or turn them off in your account settings at any time.

Marketing messages are sent only with your consent. Every one includes an unsubscribe link, and we honour unsubscribes promptly. Canadian recipients are covered by Canada’s Anti-Spam Legislation; U.S. recipients by CAN-SPAM.

10. Your choices and rights

Whatever jurisdiction you are in, you can:

Access the personal information we hold about you

Correct anything inaccurate or incomplete

Delete your account and information, subject to what we must keep by law

Withdraw consent, subject to legal and contractual limits — note that withdrawing consent to information we need to run your account means we cannot keep providing the Service

Unsubscribe from marketing at any time

Complain to us, and to a regulator

Much of this you can do yourself in your account settings. For anything else, email info@tcgthemall.com. We will respond within 30 days, and will verify your identity before acting on a request.

10.1 If you are in Canada

Your rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), and under provincial legislation where it applies, are as described above.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

If you are in Quebec, Law 25 gives you additional rights, including data portability, the right to request de-indexing in certain circumstances, and the right to be informed about and contest decisions made solely by automated processing. You may complain to the Commission d’accès à l’information du Québec.

10.2 If you are in the United States

Depending on your state, you may have the right to know what personal information we collect and how we use it, to access a copy, to correct it, to delete it, to opt out of sale, sharing for cross-context behavioural advertising, targeted advertising, or profiling, to limit use of sensitive information, and to appeal a refused request.

We do not sell your personal information. We do not currently display ads. If we enable advertising through Google AdSense, depending on your U.S. state this may be treated as “sharing” for cross-context advertising; you will be able to opt out by emailing info@tcgthemall.com or enabling a Global Privacy Control signal in your browser, and we will honour it where required.

We will not discriminate against you for exercising any privacy right.

To make a request, email info@tcgthemall.com. If we refuse, you may appeal by replying to our decision, and we will respond within the period your state’s law allows. You may also complain to your state Attorney General.

10.3 If you are elsewhere

We index stores in Canada, the United States, Mexico, and other countries, and anyone is welcome to use the free search from anywhere.

We operate from Canada. Our service providers may process personal information in Canada, the United States, or elsewhere, as described in Section 6. Paid subscriptions are offered from the countries shown at checkout, and we may add or remove countries over time.

If you are outside Canada and the United States, you can still contact us at info@tcgthemall.com to access, correct, or delete your information, or to withdraw consent, and we will handle your request consistent with the law that applies to you. Where the law where you live gives you a right that this policy does not describe, that right is not affected.

11. Security

We use reasonable technical and organizational measures to protect personal information, including encryption in transit, access controls, and restricting staff access to what they need. Payment card details are handled by our payment processor and are not stored on our systems.

No system is completely secure. If a breach occurs that creates a real risk of significant harm, we will notify affected individuals and the relevant regulators as the law requires.

12. Children

The Service is not intended for children under 16, and we do not knowingly collect personal information from them.

If you are under the age of majority where you live, you may use the Service only with a parent or guardian’s involvement, as set out in our Terms of Service.

If you believe a child has given us personal information, email info@tcgthemall.com and we will delete it.

13. Automated decisions

We do not make decisions producing legal or similarly significant effects about you using solely automated processing.

14. Changes to this policy

We may update this policy. If a change is material we will tell you by email or through the Service before it takes effect. The “last updated” date at the top always shows the current version, and we keep prior versions available at info@tcgthemall.com (available on request).

15. Contact us

Privacy Officer TCGTHEMALL INC. PO Box 84, Midland PO Main, Ontario, L4R 4K9, Canada info@tcgthemall.com

[PIPEDA requires you to designate an individual accountable for privacy compliance and to make their contact details available. Name a person internally even if the published contact stays a shared address.]