Legal · Privacy

Privacy Policy

This Privacy Policy explains how GRAIL collects, uses, shares, retains, and protects information across the marketplace.

Effective Date: July 2026
Last Updated: October 2026
Reading time: 9 min
Applies to: All users

Privacy at a glance

How GRAIL handles marketplace data

This summary is provided for orientation only. The complete Privacy Policy below controls.

What GRAIL collects: Account, marketplace, transaction, communication, device, security, and support information needed to operate the Platform.
How it is used: To run the marketplace, process transactions, protect buyers and sellers, prevent fraud, support rewards, resolve disputes, and comply with law.
No sale of personal information: GRAIL does not sell personal information or disclose it for unrelated advertising purposes.
Your choices: You may request access, correction, deletion, portability, or other applicable rights, subject to lawful retention needs.

Welcome to GRAIL (“GRAIL,” “we,” “our,” or “us”). GRAIL Collectibles LLC operates the GRAIL marketplace located at www.grailcollects.com (the “Platform”).

Your privacy is important to us. This Privacy Policy explains what information we collect, how we use it, when we share it, and the choices available to you.

By using GRAIL, you agree to the practices described in this Privacy Policy.

Sections

1. Information We Collect

We collect information in several ways when you use GRAIL.

Information You Provide

When creating an account or using the Platform, you may provide information including:

Name.
Username.
Email address.
Password credentials, handled through secure authentication systems and never stored in plain text by GRAIL.
Profile photo.
Collection information.
Listing information.
Messages sent through the Platform.
Shipping information.
Billing information.
Payment information processed through Stripe.
Identity verification information, when required.
Customer support communications.
Any information you voluntarily submit.

You are responsible for ensuring the information you provide is accurate and up to date.

Marketplace Activity

We collect information relating to how you use GRAIL, including:

Listings created.
Purchases.
Sales.
Offers made.
Offers received.
Auction activity.
Watchlists.
Collection activity.
Reward activity.
GRAIL Credit activity.
Trust Score events.
Shipping events.
Disputes.
Marketplace reports.
Messages exchanged through GRAIL.
Account preferences.

This information allows us to operate the marketplace and improve your experience.

Automatically Collected Information

When you use GRAIL, certain information may be collected automatically, including:

IP address.
Browser type.
Device information.
Operating system.
Time zone.
Pages viewed.
Search activity.
Referring websites.
Session information.
Crash reports.
Performance information.
Cookies and similar technologies.

This information helps us improve performance, reliability, and security.

2. How We Use Your Information

We use collected information to operate, improve, and protect GRAIL.

Examples include:

Creating and maintaining your account.
Operating the marketplace.
Processing purchases and sales.
Processing payments through Stripe.
Delivering GRAIL Credit.
Operating the Rewards Program.
Maintaining Trust Score.
Detecting fraud.
Investigating disputes.
Providing customer support.
Sending account notifications.
Improving marketplace features.
Measuring platform performance.
Protecting buyers and sellers.
Complying with legal obligations.
Enforcing our Terms of Service.

We only use personal information where we have a legitimate business purpose or another lawful basis to do so.

3. Payment Information

GRAIL does not store your complete payment card information.

Payments are securely processed by Stripe, our payment-processing partner.

Stripe may collect payment information directly in accordance with its own privacy practices.

GRAIL receives only the information necessary to process transactions, confirm payments, manage refunds, facilitate seller payouts, and maintain marketplace records.

4. Marketplace Communications

GRAIL provides messaging features that allow buyers and sellers to communicate through the Platform.

Messages may be stored to:

Deliver conversations.
Investigate fraud.
Resolve disputes.
Enforce marketplace policies.
Improve platform safety.

Users should avoid sharing unnecessary sensitive personal information through marketplace messages.

5. Cookies and Similar Technologies

GRAIL uses essential cookies and similar technologies to:

Keep users signed in.
Remember preferences.
Maintain secure sessions.
Prevent fraud.

If you allow it, GRAIL also uses optional analytics technologies (currently Vercel Web Analytics) to understand:

How the Platform is used.
Site performance.
Which features and marketplace pages people use.

Optional analytics operate only when you permit Analytics in your cookie preferences. Analytics is off unless you turn it on, and you can change your choice at any time through Cookie Settings at the bottom of every page. Essential Platform functionality does not depend on analytics consent.

GRAIL does not currently use marketing or advertising cookies. The Cookie Policy describes the technologies GRAIL uses in more detail.

Most browsers allow users to manage cookie preferences.

Disabling certain essential cookies may affect Platform functionality.

7. Service Providers

GRAIL works with trusted third-party service providers to operate the Platform.

These providers may process information on our behalf solely for the services they provide.

Examples include:

Stripe for payment processing, refunds, and seller payouts.
Shippo or other shipping providers for shipping labels and shipment tracking.
PSA for card certification verification.
SportsCardsPro for market value information.
Supabase for secure data storage, authentication, and database services.
Vercel for website hosting and deployment.
Analytics, hosting, infrastructure, security, customer support, and similar providers as needed to operate the Platform.

Analytics, hosting, infrastructure, and security providers receive only the information reasonably necessary to perform their services for GRAIL.

These providers are not authorized to use that information for unrelated purposes.

These providers are contractually or legally responsible for protecting the information they process and may have their own privacy policies governing their services.

8. Legal Disclosures

GRAIL may disclose information when we reasonably believe disclosure is necessary to:

Comply with applicable law.
Respond to lawful requests from courts or government authorities.
Enforce our Terms of Service.
Investigate fraud.
Protect users.
Protect GRAIL’s legal rights.
Prevent illegal activity.
Respond to emergencies involving public safety.

We may also disclose information as part of a merger, acquisition, financing, corporate restructuring, or sale of assets, subject to applicable legal requirements.

9. Data Retention

We retain personal information only for as long as reasonably necessary to:

Operate the Platform.
Complete transactions.
Maintain marketplace records.
Resolve disputes.
Prevent fraud.
Comply with legal, tax, accounting, and regulatory obligations.
Enforce our agreements.

Even if an account is closed, certain information may be retained where required by law or reasonably necessary to protect the Platform, users, or completed marketplace transactions.

When information is no longer needed, GRAIL will delete, anonymize, or securely dispose of it in accordance with applicable law and our data retention practices.

10. Data Security

GRAIL uses commercially reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction.

Security measures may include:

Encrypted communications using HTTPS/TLS.
Secure authentication systems.
Encrypted password storage.
Access controls.
Infrastructure monitoring.
Fraud detection systems.
Secure payment processing through Stripe.
Regular software updates and security improvements.

No method of transmitting or storing information over the Internet is completely secure.

Accordingly, GRAIL cannot guarantee absolute security, but we continuously work to improve the protection of user information.

11. Security Incidents

If GRAIL becomes aware of a security incident affecting personal information, we will investigate the incident and take reasonable steps to mitigate the issue.

Where required by applicable law, GRAIL will provide notifications to affected users, regulators, or other parties.

Nothing in this Privacy Policy guarantees perfect security or eliminates the risks inherent in using online services.

12. Your Privacy Choices

Depending on your location and applicable law, you may have rights regarding your personal information.

These rights may include the ability to:

Access the personal information we maintain about you.
Correct inaccurate information.
Request deletion of certain personal information.
Request a copy of your information in a portable format where applicable.
Exercise other privacy rights required by applicable law.
Update your account information.
Manage communication preferences.
Request additional information regarding our privacy practices.

Some requests may be limited where GRAIL must retain information to comply with legal obligations, prevent fraud, protect security, complete transactions, maintain accounting and tax records, resolve disputes, preserve marketplace integrity, or protect the rights of users and the Platform.

We do not promise deletion of information that GRAIL is legally required or reasonably permitted to retain.

We may request reasonable verification of your identity before fulfilling certain requests to help protect your privacy and security.

13. Marketing Communications

GRAIL may send emails or other electronic communications relating to marketplace activity, new features, promotions, rewards, or other updates.

Where required by applicable law, users may opt out of marketing communications by using the unsubscribe instructions included in those messages or by adjusting available account preferences.

Even if you opt out of marketing communications, GRAIL may continue to send important non-promotional communications, including messages relating to your account, purchases, sales, security, legal notices, and other operational matters necessary to provide the Platform.

14. Children’s Privacy

GRAIL is intended for individuals who are at least 18 years of age or the age of majority in their jurisdiction, whichever is greater.

We do not knowingly collect personal information from children under the age of 13.

If we become aware that personal information has been collected from a child in violation of applicable law, we will take reasonable steps to delete that information as soon as practicable.

If you believe a child has provided personal information through the Platform, please contact us using the information provided below.

15. International Users

GRAIL is operated from the United States.

If you access the Platform from outside the United States, you understand that your information may be transferred to, stored in, and processed in the United States or other jurisdictions where our service providers operate.

By using GRAIL, you consent to the transfer and processing of your information as described in this Privacy Policy, subject to applicable law.

Users are responsible for ensuring that their use of the Platform complies with the laws applicable in their own jurisdiction.

16. State Privacy Rights

Depending on where you live, you may have additional privacy rights under applicable law.

For example, residents of certain U.S. states, including California and other states with comprehensive privacy laws, may have rights to:

Know what personal information we collect.
Request access to personal information.
Request correction of inaccurate personal information.
Request deletion of certain personal information.
Obtain a copy of certain personal information where required by law.
Appeal the denial of certain privacy requests, where applicable.

GRAIL will honor applicable privacy rights as required by law.

To exercise available privacy rights, please contact us using the information provided in this Privacy Policy.

We will verify your identity before fulfilling requests when appropriate to protect your privacy and the security of your account.

17. Changes to This Privacy Policy

GRAIL may update this Privacy Policy from time to time to reflect changes in:

Our services.
Marketplace features.
Security practices.
Applicable laws.
Technology.
Business operations.

When material changes are made, we may notify users through the Platform, email, or another reasonable method.

The “Last Updated” date at the top of this Privacy Policy indicates when the current version became effective.

Your continued use of GRAIL after changes become effective constitutes acceptance of the updated Privacy Policy, to the extent permitted by applicable law.

18. Contact Us

If you have questions about this Privacy Policy or our privacy practices, you may contact us at:

GRAIL Collectibles LLC

Website: https://www.grailcollects.com

Privacy Email: privacy@grailcollects.com

Support Email: support@grailcollects.com

If you wish to exercise your privacy rights or submit a privacy-related request, please contact us at privacy@grailcollects.com. We may request information to verify your identity before responding to your request.

19. Your Privacy Matters

GRAIL is committed to building a marketplace that values trust, transparency, and security.

We strive to collect only the information reasonably necessary to operate the Platform, protect our users, and provide a premium collecting experience.

Legal Library

Explore GRAIL policies

All GRAIL legal pages remain available from one consistent Trust Center library.

TermsOpen policy PrivacyCurrent policy Buyer ProtectionOpen policy Seller RulesOpen policy FeesOpen policy ShippingOpen policy Refunds & DisputesOpen policy Prohibited ItemsOpen policy CookiesOpen policy