Who we are
SubTracked LLC, operating as SubTracked ("we," "us," or "our"), provides grading submission tracking for US card and collectible shops, with a customer portal for individual collectors. This policy covers our website, workspaces, and customer portal. SubTracked is available only in the United States, and workspace and portal users must be at least 18.
Information we handle
- Account and workspace details: names, email addresses, authentication identifiers, profile information, business contact details, memberships, roles, and preferences. Clerk provides authentication and manages sign-in credentials and sessions.
- Customer and submission records: shop-provided customer contact information, verified portal relationships, collectible descriptions and images, grader references and progress, fulfillment details, notes, and activity history. Shops are responsible for having permission to provide customer information.
- Billing records: plan, subscription, credit usage, payment status, and billing references. Stripe processes payment details; we do not store full payment card numbers.
- Integrations and communications: connected PSA credentials, grader responses, notification delivery records, and information you send when contacting us. PSA credentials are encrypted at rest. Resend delivers service emails.
- Technical information: request and security logs, browser and device details, IP addresses, errors, and performance measurements needed to operate and protect the service.
- International interest: email, business country, optional shop name and comments, notification preference, and submission dates when you share feedback about international availability. These responses are separate from workspace and customer records. We use your selected business country to understand demand and email about availability only if you opt in. No launch date is promised.
How we use and share information
We use information to operate accounts and workspaces, track submissions, provide verified portal access, process billing, deliver service notifications, respond to support requests, investigate errors and abuse, and meet legal obligations.
Workspace members receive access according to their permissions. Portal users can access only submissions associated with their verified shop relationships; grade visibility follows the shop's reveal settings. Shop records and a customer's account are separate: disconnecting a portal relationship does not delete the shop's business records.
We use service providers for authentication (Clerk), payments (Stripe), private object storage (Cloudflare R2), email (Resend), hosting and page analytics (Vercel), and operational monitoring (Better Stack), alongside database and background-processing infrastructure. These providers process information needed for their services. Connected grader services receive the requests needed to retrieve submission progress.
We do not sell personal information or use it for targeted advertising. We may disclose information with your authorization, to comply with legal requirements, to protect people or the service, or in a business transfer subject to applicable protections.
Website analytics and operational monitoring
Our marketing site uses Vercel’s IP-derived country hint to offer availability guidance. It is an estimate of your connection’s location, not proof of where your business operates. You can correct the business country in the interest form. The interest record does not include your IP address, precise location, or the detected country, and form contents are not sent to page analytics or application error reports.
Vercel Web Analytics measures page visits and deliberate marketing signup starts without analytics cookies. We record when a visitor proceeds to trial setup or receives a Checkout link, with only the chosen plan, subscription cadence, or Starter credit-pack quantity where applicable. These events measure starts, not completed accounts or purchases. They do not include names, email addresses, account identifiers, payment details, or form contents. Our marketing analytics filter removes URL query strings and fragments and drops events for unrecognized page paths. Application page analytics normalize dynamic identifiers as well.
Better Stack receives application errors and performance measurements. Our application filters normalize URLs and remove query strings, fragments, and dynamic identifiers; operational context uses internal user and workspace IDs rather than names or email addresses. We do not enable session replay, click or form autocapture, or advertising tracking.
When your browser signals Do Not Track (DNT) or Global Privacy Control (GPC), our frontend observability does not initialize and our Vercel page and marketing signup-start analytics events are dropped. Essential authentication, payment, security, and server operational records are still needed to provide the service. See our Cookie Policy for storage and browser controls.
Security and retention
We use access controls, tenant-scoped permissions, encrypted integration credentials, and signed URLs for private item images. No service can guarantee absolute security.
We retain information as needed to provide the service, maintain shop records, resolve disputes, prevent abuse, and satisfy legal and accounting obligations. Retention depends on the record and purpose; subscription cancellation does not delete account or workspace data. Item images marked for deletion are subject to the application's 30-day retention and scheduled cleanup process. Other records, backups, and provider logs may follow separate retention schedules. We do not promise that all information is erased immediately or within a single fixed period.
Your choices and requests
You can manage available account details, preferences, and verified shop connections in the application. Contact privacy@subtracked.com to request access, correction, deletion, or a copy of your personal information. We may need to verify your identity and determine which records we control. Requests about a shop's customer records may also require that shop's involvement. We respond according to applicable law and explain any information that must be retained.
If you believe someone under 18 has provided personal information through an account, contact us so we can investigate and take appropriate action.
Updates and contact
We will post updates here with a revised date and provide additional notice when required by law.
Privacy: privacy@subtracked.com
Support: support@subtracked.com
Mail: SubTracked LLC, 1504 E Main St, Rock Hill, SC 29730, USA