Privacy Policy — AI Assistants

What CardNexus does with your data when you connect an AI assistant such as Claude or ChatGPT, who receives it, how long we keep it and your rights.

Last updated About 3 hours ago

Last updated: 24 October 2026

This policy explains what personal data CardNexus processes when you use CardNexus from an AI assistant, why we process it, who receives it, how long we keep it and what you can do about it. It covers the CardNexus connector at https://mcp.cardnexus.com/mcp, which lets assistants such as Claude, ChatGPT, Cursor and Visual Studio Code work with CardNexus. It adds to our general privacy policy, which still applies to your CardNexus account and to everything you do on cardnexus.com and in the CardNexus apps. If the two differ on a point that concerns an AI assistant connection, this policy applies.

1. Who is responsible for your data

The controller of the data described in this policy depends on where you live:

If you use CardNexus in Europe (the CardNexus EU marketplace), the controller is CardNexus SAS, a French company registered with the Bordeaux Trade and Companies Register under number 937 817 674, 68 avenue Jules Guesde, 33110 Le Bouscat, France.
If you use CardNexus in the United States or Canada, the controller is CardNexus, Inc., a Delaware corporation with its registered office at 131 Continental Dr, Suite 305, Newark, DE 19713, United States, and its mailing address at 2261 Market Street STE 46085, San Francisco, CA 94114, United States.

"We" and "CardNexus" in this policy mean the controller that applies to you.

Questions about this policy or your data: support@cardnexus.com.

2. The short version

You choose to connect an assistant. You sign in on cardnexus.com and decide, area by area, whether the assistant can do nothing, view only, or view and change.
When you ask your assistant something about CardNexus, the assistant sends CardNexus a specific request (for example "search for this card") and receives the answer. That answer can contain data from your account.
CardNexus does not receive your conversation with the assistant, and our logs do not record what the assistant asks for or what we answer.
The company that runs your assistant receives what the assistant receives. It handles that data under its own terms and privacy policy, not under ours. CardNexus does not choose it and does not control it.
You can disconnect an assistant at any time. Access ends immediately.
You can also use some CardNexus features from an assistant without an account. See section 8.

3. What CardNexus processes when you connect and use an assistant

Data	When it arises	Why we process it	Legal basis (GDPR)
The record of the connection: the assistant's name, web address and logo as the assistant declares them, the permissions you granted, when you connected, when the connection was last used and whether it is still active	When you approve a connection and each time you use it	To run the connection you asked for, show it in your settings and enforce the permissions you chose	Performance of the contract with you (Article 6(1)(b))
Access and refresh tokens, which let the assistant act on your account	When you connect and each time the assistant renews its access	To authenticate the assistant's requests. We store only a one-way fingerprint (hash) of each token, never the token itself	Performance of the contract (Article 6(1)(b)); our legitimate interest in keeping accounts secure (Article 6(1)(f))
The network (IP) address and the sign-in session used to approve the connection	When you approve a connection	To detect and investigate misuse of your account, for example a connection approved by someone else	Legitimate interest in security and fraud prevention (Article 6(1)(f))
For assistants that register themselves with us: the network address that registered the assistant	When an assistant registers	To investigate abuse of the registration service	Legitimate interest in security and abuse prevention (Article 6(1)(f))
Security log entries: that a connection was created, that its permissions changed, that the assistant obtained new access, that a connection was ended, or that a suspicious reuse of a token was detected, with the time and, for some entries, a network address	When those events happen	To protect your account, investigate incidents and let our support team see the security activity of an account	Legitimate interest in security and fraud prevention (Article 6(1)(f))
Hourly request counters: for each account, how many requests were made to each part of our service, with the outcome (success or error type) and how fast we answered, grouped by hour	Each time the assistant makes a request on your account	To keep the service running, detect abuse, enforce fair-use limits and help our support team when you ask about a problem	Legitimate interest in operating and securing the service (Article 6(1)(f))
Monitoring data: for each request, the name of the tool that was used, whether it succeeded, how long it took, which kind of assistant it came from (for example Claude or ChatGPT), and your account's internal identifier and username	Each time the assistant makes a request on your account	To monitor reliability and performance and to fix faults	Legitimate interest in operating the service (Article 6(1)(f))
Short-lived technical data: a counter of recent requests per network address, and, for actions that change something and for which the assistant supplied a retry key, the result of the action	Each request	To limit abuse and to avoid doing the same action twice when an assistant repeats a request	Legitimate interest in security and reliable operation (Article 6(1)(f))
The data in your CardNexus account that a tool reads or changes for you, for example your inventory, listings, orders, messages or lists	When you ask the assistant to do something with your account	To carry out what you asked. We process it exactly as we would if you did it on cardnexus.com	Performance of the contract (Article 6(1)(b))

We process this data only for the purposes listed in this table. The legal bases above apply where the GDPR applies to you.

4. What CardNexus does not collect

We do not receive your conversation with the assistant, your prompts or anything else you say to it. We only receive the specific request the assistant makes to CardNexus, such as a search or an action it was asked to perform.
Our logs, traces and counters do not record the content of those requests or of our answers. That includes search terms, card lists, messages, notes, list names, reasons and tracking numbers.
To answer a request, our servers must read what the request contains, for example the search terms. They use it to produce the answer and do not keep it in our logs. When a request changes something in your account, for example a message you asked the assistant to send, it is saved in your account as it would be if you had done it on cardnexus.com.
Your CardNexus password is never shared with the assistant. You sign in on cardnexus.com.
We do not collect payment card details, health data or government identifiers through assistant connections. An assistant cannot pay for anything: payment happens on cardnexus.com.

5. What the assistant and its provider receive

When you ask your assistant for something, the CardNexus connector returns data from your account to the assistant, within the permissions you granted. Depending on those permissions, this can include:

your username, account country, currency and settings;
cards, listings, prices and market data;
your inventory, lists and cart;
your sales, purchases and offers, with order status, items, amounts and tracking information;
your disputes;
your conversations with buyers and sellers;
your wallet balance and monthly fee statements.

The connector does not return your email address, your phone number, your street address or postal code, your CardNexus password, or your payment card or bank details.

Once the assistant has this data, it is processed by the provider of the assistant, under your agreement with that provider and its privacy policy. CardNexus does not choose, contract with or control that provider, and this policy does not cover what the provider does. The provider may, for example, store your conversation, use it to operate its service, or process it in other countries. Please read the privacy terms of the assistant you use, and check its settings for how it handles connected services. If you do not want certain data to reach the assistant, do not grant the permission for that area, or choose "View only" or "Off" on the consent screen.

What the assistant does with the data, including whether it passes it to other tools or services you have connected to it, is decided by the assistant and its provider, not by CardNexus.

6. Information about other people that can reach the assistant

Some tools return information about other CardNexus users who are part of your activity, such as the buyer of your sale, the seller of your purchase or the person you are talking to. This is what can reach the assistant:

A seller's or buyer's username, country, account type, rating and reliability figures.
For a sale, the city and country the order is shipped to. We do not return the buyer's name, street address, postal code, phone number or email address.
Tracking numbers and carrier scan events, which can include a place name.
Messages in your conversations, with the sender's username, and the text of cancellation reasons and dispute descriptions written by the other person. These texts are written by other users and can contain anything the sender chose to write, including personal details they typed themselves.
Photos in listings, shown as pictures.

We recommend that you do not ask an assistant to pass this information on to other services.

7. Permissions, disconnecting and expiry

When you connect an assistant, the consent screen lists the areas of your account the assistant asked about (for example inventory, sales, messaging, offers or your cart). For each area you choose Off, View only or View and change. The assistant can do nothing outside what you allow.

You can end a connection at any time under Settings, then Integrations, then Connected applications. Access stops immediately.
A connection that is not used for 30 days stops working and the assistant must be connected again. In any case a connection ends 365 days after you approved it.
Connecting the same assistant again replaces your earlier choices.
Our support team can end a connection, for example if it is misused or if a security problem is found.
A connection stops working if your account is deleted.

8. Using CardNexus from an assistant without an account

Some tools work without signing in. They return only what any visitor to cardnexus.com can see: cards and sealed products, market prices, live listings with their photos, and a seller's username, country, type, rating and number of sales. They cannot read or change anything in an account and write nothing.

When you use CardNexus this way, we do not create an account or a profile for you and we do not link your requests to a person. To keep the service available, we count your requests per network address for a short time (the address as it is for IPv4, and the first 64 bits for IPv6) and refuse requests that go over the limits. These counters are kept for the length of the counting window, which is one minute. If an address is used to abuse the service, we may block it. Our server logs do not record the network address of these requests.

When you connect an assistant, the sign-in steps of the connection are counted per network address in the same way, for up to one hour.

9. Pictures

When an assistant shows you a card, your device or the assistant's app (or servers) loads card art and listing photos from our image provider, ImageKit. ImageKit receives the address of the picture, your network address and the technical details that any web request carries, as when you view a picture on cardnexus.com. The cards we show run without cookies and load nothing else from the internet.

10. Who receives data

Recipient	What	Why
The provider of the assistant you use	Whatever the assistant receives from CardNexus at your request, and whatever you tell the assistant	To run the assistant. It acts under its own terms and is not our processor
Amazon Web Services	The data in section 3	To host the service and its databases. It acts on our instructions
Dash0	The monitoring data in section 3	To monitor reliability and performance. It acts on our instructions
ImageKit	The picture request in section 9	To deliver card art and photos
Clerk	Your sign-in, as on cardnexus.com	To authenticate you when you approve a connection
Authorities	Data we are required to disclose	To comply with the law, or to protect rights and safety

11. How long we keep data

Data	How long
Connection requests and one-time codes	Valid for 10 minutes, or 2 minutes once approved. Deleted one day after they expire
Access tokens	Valid for 1 hour. Deleted 30 days after they expire
Refresh tokens	Valid for 30 days from when they are issued or renewed. Deleted 30 days after they expire or are revoked
Connection sessions	End 365 days after you approved the connection, or when you disconnect. Deleted 30 days after they expire or are revoked
Assistants that registered but were never used	Deleted after 24 hours. Assistants that identify themselves by a web address and have never been connected to an account are deleted after 30 days without use
The record of the connection, including the network address and sign-in session used to approve it	Kept for 1 year after the connection is revoked or expires, then deleted
The network address that registered an assistant which registered itself	Kept until 1 year after the assistant was last used, then cleared
Security log entries	90 days
Hourly request counters	13 months
Monitoring data	30 days
Results saved so that a repeated action is not done twice	Up to 24 hours
Recent-request counters per network address	Up to the counting window: one minute for most counters, and up to one hour for the counter of assistant registrations
Data in your account that tools read or change	As described in our general privacy policy
When your account is deleted	Your account is closed and anonymised after a 7-day grace period. Deleting your account does not remove assistant connection records, security log entries or request counters. Each is deleted when its own retention period above ends

12. Security

Tokens are random values. We store only a one-way fingerprint of them, so a copy of our database does not contain a token that can be used.
Access tokens last one hour. Each refresh token can be used once. If a refresh token is used a second time, we end the whole connection and record it in the security log.
Assistants are shown on the consent screen with the name and web address they declare, and a warning when we cannot confirm who they are. Only continue if you started the connection yourself, from an app you trust.
Connections are limited to the areas and levels you chose.
Requests are limited per account, and sign-in endpoints and signed-out use are limited per network address.
Pictures can only come from our own image location.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.

13. Your choices and rights

You can:

Disconnect any assistant at any time (section 7).
Choose, area by area, what an assistant can see and change.
Ask us for a copy of the data we hold about you, including the connection records described here.
Ask us to correct data, delete it, restrict its use, or send it to you in a portable format.
Object to processing based on our legitimate interests.
Complain to a data protection authority. For CardNexus SAS, this is the CNIL, the French data protection authority (cnil.fr). You can also complain to the authority of your own country.

To use these rights, write to support@cardnexus.com from the email address of your CardNexus account. Rights regarding data held by your assistant's provider are exercised with that provider. If you live in North America, you can make the same requests, and we will handle them under the law that applies to you.

14. International transfers

Some of our providers are outside the European Economic Area, for example our sign-in provider, Clerk, in the United States. They receive data under the European Commission's Standard Contractual Clauses, or under the EU-U.S. Data Privacy Framework where the provider is certified.

Your assistant's provider may process data in other countries. This is governed by its own terms, and CardNexus has no control over where it happens.

15. Children

CardNexus is not directed at children. A CardNexus account requires you to be at least 15 years old, or the age of legal majority in your country if that is higher. Connecting an assistant requires an account. We do not knowingly collect personal data from children through the signed-out features. If you believe a child has used these features and you want data removed, write to support@cardnexus.com.

16. Changes to this policy

We may update this policy, for example when we add tools or change how long we keep data. The date at the top shows when it last changed. If a change significantly affects your rights, we will tell you before it applies, for example by email or in your account.

17. Contact

Privacy questions and requests: support@cardnexus.com
Help centre: https://help.cardnexus.com
CardNexus SAS, 68 avenue Jules Guesde, 33110 Le Bouscat, France
CardNexus, Inc., 2261 Market Street STE 46085, San Francisco, CA 94114, United States

Was this helpful?

Still need help? Ask the team