Information Security Policy
How Card Prices LLC classifies, protects and retains data, and how it responds to a security incident.
This is the Data Security and Privacy policy of Card Prices LLC, a Missouri limited liability company, adopted by its sole Member as Article 8 of the Company's Governance Policies. It applies to card-prices.com, the Card Prices apps and API, and the systems that run them. How we handle personal information in particular is described in our Privacy Policy.
Reporting a security issue: email [email protected]. The same contact is published at /.well-known/security.txt.
The Company shall classify all data it handles into the following categories:
| Classification | Description | Examples |
|---|---|---|
| Public | Data intended for public access | Published pricing data, public API responses, website content |
| Internal | Business data not intended for public access | Financial records, internal analytics, development databases, system configurations |
| Confidential | Sensitive business or partner data | API keys, partner credentials, proprietary algorithms, unpublished research, competitive analysis |
| Restricted | Data subject to legal or contractual protection | User personal data, partner data subject to data use agreements, payment information |
- Access Control: Access to Confidential and Restricted data shall be limited to the Member and any persons specifically authorized in writing. Access credentials shall use strong passwords and multi-factor authentication where available.
- Encryption: Confidential and Restricted data shall be encrypted at rest and in transit. All production systems shall use TLS/HTTPS for data transmission.
- Backup: All Company data shall be backed up regularly. Backups of Confidential and Restricted data shall be encrypted.
- Disposal: When data is no longer needed, it shall be disposed of in accordance with its classification and any applicable retention requirements. Restricted data shall be securely deleted using methods that prevent recovery.
To the extent the Company collects, processes, or stores personal data of individuals located in the European Economic Area (EEA) or the United Kingdom through its platforms or API partnerships, the Company shall:
- Lawful Basis: Identify and document a lawful basis for processing under Article 6 of the GDPR for each category of personal data processed
- Privacy Notice: Maintain a clear, accessible privacy notice that informs data subjects of their rights and the Company's data processing activities
- Data Minimization: Collect only the personal data necessary for the stated purpose and retain it only as long as necessary
- Data Subject Rights: Establish procedures to respond to data subject requests (access, rectification, erasure, portability, restriction, objection) within the required timeframes (one month from receipt of the request, subject to extension as permitted under GDPR Article 12(3))
- Data Processing Agreements: Execute Data Processing Agreements (DPAs) with any third-party processors that handle personal data on behalf of the Company
- Data Breach Notification: Maintain procedures to detect, investigate, and report personal data breaches to the relevant supervisory authority within 72 hours where required, and to affected data subjects without undue delay where the breach poses a high risk
- Cross-Border Transfers: Ensure that any transfer of personal data outside the EEA complies with GDPR transfer requirements (e.g., Standard Contractual Clauses, adequacy decisions)
The Company shall maintain a data retention schedule that specifies:
- The categories of data retained
- The purpose for retention
- The maximum retention period
- The method of deletion upon expiration
Default retention periods (unless a longer period is required by law or contract):
| Data Category | Retention Period |
|---|---|
| Published pricing data | Permanent (historical dataset) |
| Raw scraped/ingested data | 2 years from collection |
| User account data | Duration of account plus 1 year |
| API request/access logs | 1 year |
| System logs | 90 days |
| Analytics/usage data (aggregated) | 3 years |
| Analytics/usage data (individual) | 1 year, then aggregated or deleted |
When the Company receives data through API partnerships, the Company shall:
- Comply strictly with all data use terms, rate limits, and restrictions specified in the API partner's terms of service and any separate data use agreement
- Not resell, redistribute, or sublicense partner data except as explicitly permitted
- Attribute data sources as required by the partner agreement
- Implement technical controls to enforce rate limits and data use restrictions
- Maintain logs of API access sufficient to demonstrate compliance if audited by the partner
- Promptly delete or cease using partner data if the partnership is terminated and the agreement requires it
In the event of a data security incident (unauthorized access, data breach, system compromise):
- Contain: Immediately take steps to contain the incident and prevent further unauthorized access
- Assess: Determine the scope of the incident, what data was affected, and the severity
- Notify: Notify affected API partners, data subjects, and regulatory authorities as required by applicable law and contract obligations
- Remediate: Fix the vulnerability or root cause that allowed the incident
- Document: Prepare a written incident report documenting the timeline, scope, impact, response actions, and preventive measures implemented
- Review: Update security procedures as necessary to prevent recurrence
Card Prices LLC
Security: [email protected]
General: [email protected]