Legal
Privacy Notice
Last updated: October 26, 2026
1. Who we are
Top-Deck the Halls is operated by Top-Deck the Halls. For the purposes of data protection law, Top-Deck the Halls is the data controller of the personal data described in this notice. You can contact us at support@topdeckthehalls.com.
2. What we collect and why
We collect only what we need to run the Service. The table below lists each category of personal data, what we use it for, and the legal basis we rely on.
| Category | Purpose | Legal basis |
|---|---|---|
| Account details — display name and email address; password or sign-in method (magic link, email + password, or Google sign-in) | Creating and securing your account, signing you in, and contacting you about your exchanges | Contract performance (providing the Service you signed up for) |
| Exchange content — the exchanges you organize or join, your join status, and card preferences (favorite colors, mechanics, things to avoid, and optional notes) | Running the exchange: sharing preferences with the giver building for you, running the secret draw, and showing exchange status | Contract performance |
| Decklist links — optional links you submit to your own decklist | Letting your recipient view the deck after the reveal | Contract performance |
| Payment and order data — Paddle handles checkout and payments; we receive the order status and the exchange the upgrade applies to. We do not receive or store your full card details. | Processing your purchase and applying the participant-limit upgrade | Contract performance |
| Email delivery data — when we send you transactional email (for example, a sign-in link or a notification that your drawing is ready), our email provider processes delivery status such as whether the email was delivered or bounced | Delivering service emails to you reliably and suppressing addresses that no longer work | Contract performance and legitimate interests |
| Usage and device data — IP address, browser type, and basic usage telemetry | Keeping the Service secure, preventing abuse, and fixing problems | Legitimate interests (security and service improvement) |
3. Who we share data with
- Service providers: the companies that host the Service (application hosting and cloud database), deliver our email, and provide sign-in options such as Google sign-in. They process data only to provide their services to us.
- Paddle (Merchant of Record): purchases are processed by Paddle.com, which acts as the Merchant of Record for the sale of the product, subscription management, payments, tax compliance, and invoicing. See Paddle's privacy policy.
- Other participants in your exchange: the organizer sees your join status and preferences, and after the reveal your decklist link. We never show participants the full participant list's contact details.
- Professional advisers: lawyers, accountants, and insurers, where needed.
- Authorities: where required by law, or to protect the rights, property, or safety of the Service and its users.
4. Where data is stored
The Service is hosted in cloud data centers that may be located outside United States (Colorado). Where personal data leaves the UK or European Economic Area, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision, before it is transferred.
5. How long we keep data
We keep your account and exchange data while your account is active and for as long as an exchange may still be viewed. When data is no longer needed, we delete it or anonymise it. If you delete your account, we delete or anonymise your personal data within 90 days, except where we must keep it longer for legal reasons.
6. Your rights
Depending on where you live, you have rights over your personal data, including the right to access it, correct it, delete it, restrict or object to its processing, port it to another service, and withdraw consent. If you are in the UK or EEA, you also have the right to complain to your local supervisory authority. To exercise any right, contact us at support@topdeckthehalls.com — we respond within one month.
7. Security
We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, and row-level security in our database so that participants can only see the exchange data they are meant to see. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.
8. Cookies
We use a small number of essential cookies (and equivalent browser storage) to keep you signed in and remember your preferences, such as your display theme. We do not use advertising or third-party marketing cookies. You can clear or block these in your browser settings, though the Service may not function correctly without them.
9. Children
The Service is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will remove it.
10. Changes to this notice
We may update this notice as the Service evolves. The date at the top shows when it was last updated.
See also our Terms & Conditions and Refund Policy.