Privacy Policy

1. Who we are and how to reach us

The ATC Hub ("the Hub", "we", "us") is operated by Benjamin Clarke, operating as The ATC Hub, based in Ontario, Canada. This policy covers our website, the waitlist, and the Hub platform at app.theatchub.com (together, the "Services"). Our Terms of Service set out the rules for using them.

We have a designated person responsible for protecting personal information (our privacy officer). For any privacy question, request, or complaint, contact:

Benjamin Clarke, Privacy Officer
Email: [email protected]

2. What we collect

What we collect depends on how you use the Hub. We don't ask for more than each feature needs.

If you join a waitlist

• The waitlist: your email address, country, province or state, whether you're an ACEO artist, your consent to receive updates and when you gave it, and, if you joined through a partner community's invite link, that community's code. When you create an account with the same email address, we use your waitlist entry to add any founding or community credits and fee-free trading you're owed, and, if you shared your ACEOs with us, to start your artist application from them, so you don't have to apply again.
• If you tell us you're an ACEO artist: photos of up to three of your ACEOs, and optionally where else we can see your work (for example an Etsy shop or Instagram handle), what mediums you work in, how long you've been making ACEOs, and anything else you'd like us to know.

If you create an account

• Account details: email address and password. We store only a scrambled (hashed) version of your password, never the password itself.
• Account activity: when you signed up and verified your email, your trust tier, completed trade count, and any strikes or bans on the account.
• Profile: a profile photo and a bio, if you choose to add them. Both are shown on your public profile (section 6).
• Community code: if you joined with a partner community's code, which community it was, so we can give you its welcome credits and tell the community how many members joined (as a total, never who).

If you trade ATCs

• Listings: photos of your cards (front, back, and an angled texture shot), medium, condition, edition details, any description you write, and the card's Hub value, which we work out from demand for the artist's work (only you can see your cards' values).
• Artist credit for cards you didn't make: if you list a card by another artist, the artist's name and, optionally, a link to their work, which we show on the listing so they get the credit. Please only give us what the artist has already made public.
• Trades: the proposals you make and accept, and trade history.
• Shipping: your name and mailing address (shared with your trade partner, see section 5), and a carrier and tracking number if you choose to add them.
• Proof of shipping: the three photos you upload when you mark a card as sent: the card before sealing, with its trade code; the sealed envelope, which shows the address and postage; and a receipt or the envelope going into a mailbox. Your trade partner and our team can see them (section 5).
• Messages: the messages you send and receive through the Hub, and the card a message is about, if you attach one.
• Feedback, reports, and warnings: ratings you give and receive after each trade (condition accuracy, shipping promptness, communication), reports you file about AI-generated art and the reason you give, and any warnings on your account. Your average ratings appear on your public profile (section 6).
• Disputes and appeals: what you tell us in a dispute or ban appeal, and any evidence you provide, including links to photos or videos.
• Loyalty credits: a record of credits earned and spent.
• Trade packs: the packs you buy, how many prepaid trades you have left, and which trades they paid for. Payments for packs are processed by PayPal, as described below.

If you buy an ACEO

• Order details: what you bought, the price, and how you paid (PayPal, loyalty credits, or both).
• Shipping address: so we can send your order, and for tax purposes, since sales tax depends on where an order ships.
• Payment: payments are processed by PayPal. We receive only limited details from PayPal, such as the payment status, amount and PayPal's transaction reference, never your card number.

If you apply to sell ACEOs to us, or sell them as an artist

• Artist application: the photos of your work you upload, what you tell us about yourself as an artist (such as your experience, mediums, subjects, artist statement, where you're based and links to your work), and our notes and decision. Only our team sees your application while we review it. If we approve you, your artist statement, experience, mediums, subjects, the craft details you ticked and where you're based (if you gave it) are shown with your ACEOs in our shop, as the application form explains.
• Artist profile: a portfolio link (website, Instagram, or Etsy) and your acceptance of our copyright agreement.
• Submissions: the commissions we offer you or you ask for (how many ACEOs, the pay agreed, the blank cards we mail you, and when your ACEOs arrive and are paid for), and your artist pay tier.
• Payouts: the email address of the PayPal account we pay you through.
• Tax information, US artists only: US tax law may require us to collect a completed IRS Form W-9 before paying you, which includes your taxpayer identification number (such as a Social Security or Employer Identification Number). We use it only for tax reporting.

Collected automatically

• Security and fraud-prevention signals: when you sign in, we create a one-way hash (a scrambled code that can't be reversed) of your IP address and browser details. We keep the hash, not the raw values. We also keep one-way hashes of shipping addresses and payout email addresses. We use these only to detect people returning after a ban (see section 3).
• Technical data: like any website, our servers and service providers receive your IP address, browser type, and the pages you request, and keep short-term logs for security and troubleshooting. If a Hub page fails in your browser while you're signed in, it sends us a short error report (the error and the page's address), kept with those logs, so we can fix it.

We don't collect your precise location, and we don't use analytics or advertising trackers. If we ever add analytics, we'll update this policy first (see section 8).

From other sources

We receive payment and payout confirmations from PayPal, and delivery status from shipping carriers. If another user reports your listing or gives you feedback, that becomes part of your account record.

3. How we use it

• To run the Services: create and secure your account, show listings, process trades and shop orders, ship ACEOs, pay artists, and keep the loyalty credit ledger.
• To choose artists to buy from: look through artist applications and decide who to contact and approve.
• To keep trading safe: set trust tiers, handle disputes and ban appeals, review AI-art reports, and enforce our rules.
• To prevent fraud and ban evasion: when an account is banned, we keep its hashed signals (see section 2) and compare new sign-ups and purchases against them. A match flags the account for review.
• To communicate with you: send account, trade, and order messages (these aren't marketing), and, only with your consent, waitlist and launch updates.
• To meet legal obligations: tax collection and reporting in Canada and the US, bookkeeping, and responding to lawful requests.
• To improve the Hub: understand, in aggregate, how the Services are used so we can fix problems and set fair shop prices and artist pay.

We don't sell your personal information, "share" it for cross-context behavioural advertising, or use it for targeted ads. We use sensitive information (your password, and a W-9 taxpayer number if you give us one) only to provide the Services and meet legal requirements, never to infer things about you.

4. Consent

We ask for your consent in plain language, at the moment we collect information, for the purposes described here. For marketing emails, consent is always an unticked box you choose to check. You can withdraw consent at any time, subject to legal or contractual limits. For example, we can't stop keeping tax records the law requires, and we can't complete a trade without sharing your address with your trade partner. We'll tell you what withdrawing would mean before you decide.

Where the law allows us to use information without consent, for example to investigate fraud, meet a legal obligation, or collect a debt, we do so only for that purpose.

5. Who we share it with

Your trade partner

When you and another collector agree to a trade, we give each of you the other's name and mailing address so you can ship your cards directly to each other. The Hub never handles ATCs. Please use this information only to complete the trade. Using it for anything else breaks our Terms of Service.

Your trade partner can also see your proof-of-shipping photos for that trade, since they're the evidence the card was sent. Nobody else can, apart from our team.

Our team

Messages are private between the two traders in a conversation. Our team reads them only when we need to: to investigate a report, a dispute, or a suspected breach of our rules, or when the law requires it. We look at proof-of-shipping photos for the same reasons.

Service providers

These companies process information on our behalf, only for the purposes we set and under contracts that require them to protect it:

Other situations

• Legal requirements: when required by law, court order, or a valid request from a government authority, or to protect the rights, safety, or property of our users, the public, or the Hub.
• Professional advisers: lawyers and accountants, under confidentiality obligations.
• Business transfers: if the Hub is sold, merged, or reorganized, personal information may transfer to the new owner, who must keep protecting it under this policy. We'll tell you before that happens.

6. What other people can see

Other users can see your profile photo and bio if you've added them, your listings, card photos and descriptions (including the credited artist's name and link, for cards by other artists), your trade count, how long you've had an account, your feedback ratings, and, if you're an artist, the portfolio link you provide. If you're an approved ACEO artist, the "About the artist" details from your application appear with your ACEOs in our shop (section 2). Your email address, mailing address, and payment details are never shown publicly. Your mailing address goes only to a trade partner once a trade is accepted.

7. Automated decisions

Some decisions on the Hub are made automatically, based on rules:

• Trust tiers set how much the trade guarantee covers for you, based on your completed trades, feedback, and any strikes.
• Hub values are worked out from demand for each artist's work on the Hub (how many people offer for their cards, how quickly, and how many follow them). Only the card's owner sees the value, and it's used for loyalty credits and the trade guarantee. You can ask a person to review your card's value.
• Artist pay tiers are set from how many of an artist's ACEOs have sold in our shop. A person sets each shop price and every commission before it's offered.
• Ban-evasion screening compares hashed sign-up and purchase signals against banned accounts.

We never ban anyone automatically. Every ban, including one for AI-generated art, is decided by a person and can be appealed. If an automated decision affects you, you can ask us what information was used and the main reasons for the decision, ask us to correct that information, and ask a person to review it. Contact our privacy officer (section 1).

8. Cookies and similar technologies

• The public website doesn't set cookies or store anything in your browser. Waitlist sign-ups go straight to our own server.
• The Hub platform uses only a few strictly necessary cookies: to keep you signed in, to protect forms against cross-site request forgery, and to return you to the right page after you sign in. The platform doesn't work without them.
• Our network provider, Cloudflare, may set a strictly necessary security cookie to tell people apart from automated traffic and protect the Services from attacks. It isn't used for advertising or to track you across other websites.
• No advertising or tracking cookies. We don't use them, and we don't allow third parties to track you across other websites through the Hub.

Because we don't sell or share personal information or run targeted ads, there is nothing for a "Do Not Track" or Global Privacy Control signal to switch off. We still treat a Global Privacy Control signal as a valid opt-out request, and if we ever add optional tracking, it will be off by default.

9. Where your information is stored

We're based in Canada, but some of our service providers (including Cloudflare, PayPal, Resend, and Google) store and process information in the United States and possibly other countries. Information stored outside your province or country is subject to the laws there, and may be accessible to courts, law enforcement, and national security authorities there. Before sending information outside Quebec or Canada, we assess whether it will be adequately protected, and our contracts require providers to protect it to a standard comparable to this policy. Platform data is stored in Canada, on a server we operate in Ontario. If we move it to a hosting provider, we'll update this policy and tell you where it's stored.

To ask about our service providers outside Canada, or how they handle your information, contact our privacy officer (section 1).

10. How long we keep it

We keep personal information only as long as we need it for the purposes above or as the law requires, then securely delete or anonymize it.

Where information was used to make a decision about you, we keep it long enough for you to access it and challenge the decision.

11. How we protect it

We use safeguards that fit how sensitive the information is. These include encryption in transit (HTTPS), hashed passwords, one-way hashing of fraud-prevention signals, access limited to the people who need it, logging of admin actions, and leaving card processing to a payment provider certified to PCI DSS standards. No system is perfectly secure, so please use a strong, unique password and tell us right away if you think your account has been compromised.

12. Your rights

Wherever you live, you can ask us to:

• Access: tell you what personal information we hold about you, how we use it, and who we've shared it with, and give you a copy.
• Correct: fix information that's inaccurate or incomplete.
• Delete: erase your information, except what we must keep by law (such as tax records) or need to resolve an open dispute. Deleting your account erases your email address, username, mailing address, artist profile and application, the messages you sent, your proof-of-shipping photos, and the photos of cards that never changed hands. Trades and ratings other traders took part in stay on their records, under an anonymous account that can't be linked back to you. If a trade or dispute is still open, we'll finish it first. We'll tell you what we kept and why.
• Port: give you your information in a structured, commonly used electronic format, or send it to another organization you choose.
• Withdraw consent or unsubscribe from marketing emails at any time.
• Get a human review of an automated decision (section 7).
• Stop disseminating information or de-index it, where it's being shown in breach of the law or a court order, or causes you serious harm (a Quebec right we extend to everyone).

How to make a request: email our privacy officer (section 1). To protect your account, we'll confirm your identity first, usually by asking you to reply from the email address on your account. You can also have an authorized agent act for you, with your signed permission. We'll respond within 20 business days. If we need more time, which the law allows in some cases, we'll tell you why within those 20 business days. Requests are free, except that we may charge a small fee for unusually large or repeated requests, and we'll tell you before charging anything.

We will never treat you differently, such as by charging different prices or giving a lower quality of service, for using any of these rights.

If we say no: we'll explain why in writing. You can ask us to reconsider by replying to our decision with "Appeal" in the subject line, and a different person will review it within 30 business days. If you're still not satisfied, you can complain to the privacy regulator where you live (sections 13 and 14).

13. Additional information for Canadian residents

We handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA), and, where they apply, Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), Alberta's Personal Information Protection Act, and British Columbia's Personal Information Protection Act.

• Quebec: our privacy officer (section 1) is the person in charge of the protection of personal information. We run privacy impact assessments before transferring information outside Quebec and before launching new systems that involve personal information. Any technology that could identify, locate, or profile you is off by default.
• If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). Quebec residents can also contact the Commission d'accès à l'information (cai.gouv.qc.ca), Alberta residents the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca), and BC residents the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca).

14. Additional information for US residents

This section provides the disclosures required by the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), and by the consumer privacy laws of other states, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. We give every US resident the rights described in section 12, whether or not their state's law technically applies to a business our size.

Categories of personal information we've collected in the past 12 months

We collect this information from you, automatically from your device, and from PayPal, shipping carriers, and other users, as described in section 2. We use it for the purposes in section 3 and keep it for the periods in section 10. We have not sold or shared personal information (as the CCPA defines those terms) in the past 12 months, have no actual knowledge of selling or sharing the information of anyone under 16, and don't use personal information for targeted advertising or for profiling that produces legal or similarly significant effects. We use sensitive personal information only for purposes permitted by the CCPA, so no "limit the use" right applies.

Notice of financial incentive: loyalty credits

Completing an ATC trade earns loyalty credits (50 credits plus 10% of your card's Hub value, with bonuses and a higher rate as you reach trade milestones), and everyone who joins our waitlist in October 2026 gets 500 credits as a founding trader (1,000 through a partner community's invite link) once they create an account with the same email and confirm it. You can spend credits on ACEOs in our shop. Credits come from trading activity, not from giving us personal information. The only personal information involved is the trade and ledger records we'd keep anyway. Our good-faith estimate of the value of the personal information involved is the value of the credits it earns you, as described above. Each ACEO shows its own price in credits. You join by completing a trade, and you can stop by not trading or by closing your account (subject to our Terms for any unspent balance).

Appeals and complaints

If we deny a privacy request, you can appeal as described in section 12. If the appeal is denied, you can contact your state attorney general, and California residents can also contact the California Privacy Protection Agency (cppa.ca.gov).

Nevada

We don't sell covered information as Nevada law defines it.

15. Emails and unsubscribing

We send waitlist updates and other marketing emails only if you've opted in, as required by Canada's Anti-Spam Legislation (CASL) and the US CAN-SPAM Act. Every one identifies us, includes our mailing address, and has a one-click unsubscribe link. We process unsubscribe requests within 10 business days, usually much sooner. Account, trade, order, and security emails are part of the Services and aren't marketing, so you'll still receive those while you have an account.

16. Children

You must be at least 18, or the age of majority where you live if that's higher, to create an account. The Services aren't directed to children, and we don't knowingly collect personal information from anyone under 13 (or under 14 in Quebec) without the consent of a parent or guardian, as COPPA and Quebec law require. If you believe a child has given us personal information, contact our privacy officer and we'll delete it.

17. If something goes wrong

We keep a record of every privacy incident. If a breach creates a real risk of significant harm to you, we'll notify you and the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information for Quebec residents, and any US state authorities the law requires, as soon as feasible. We'll tell you what happened, what information was involved, what we're doing about it, and what you can do to protect yourself.

18. Changes to this policy

We'll post any changes here and update the date at the top. If a change is significant, for example a new purpose for your information or a new kind of sharing, we'll tell you by email or on the platform before it takes effect, and ask for your consent again where the law requires it.