Privacy Policy

This Privacy Policy explains how Thornton Works LTD ("we", "us", "ReverseHolo") collects, uses, stores, and shares your personal information when you use the ReverseHolo website and application.

We are registered in England and Wales and are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller

What Information We Collect

Information you provide directly

• Email address — used as your account identifier and the primary way we recognise your account across sessions.
• Collection data — the cards you choose to track, including quantities, trade flags, and grading information you enter.
• Preferences — your chosen collection mode (Collector, Trader, or Investor).

Information we collect automatically

• Usage data — pages you visit, features you use, and how you interact with the service.
• Technical information — your device type, browser, operating system, and IP address, collected as part of standard HTTP requests.
• Log data — server logs including timestamps and request details, used for security and debugging.

What we do not collect

We do not collect passwords, payment card numbers (these are handled directly by our payment processor), phone numbers, or physical addresses.

How We Use Your Information

• Running the service — processing your requests, displaying your card collection, and syncing your data.
• Improving the service — analysing usage patterns to identify and fix issues, and to develop new features.
• Security — detecting and preventing fraudulent or abusive activity.
• Communications — responding to your queries or support requests.

We do not use your information for advertising, profiling, or selling to third parties.

Legal Basis for Processing

Under the UK GDPR, we process your personal data on the following legal bases:

• Performance of a contract — to provide you with the ReverseHolo service you have signed up for.
• Legitimate interests — to improve the service, ensure security, and analyse usage. We have assessed that our legitimate interests do not override your rights in these cases.
• Consent — for any non-essential cookies or data processing where required. You may withdraw consent at any time.

Who We Share Your Information With

We share your information only where necessary:

• Service providers — third-party companies that help us run the service, such as our hosting and database providers. These are bound by confidentiality obligations and may not use your data for their own purposes.
• Payment processors — if you purchase a subscription, payment details are handled directly by our payment processor. We do not store card numbers.
• Legal requirements — we may disclose information if required by law, regulation, or court order.

We do not sell your personal data to third parties. We also do not share personal data with the third-party pricing or retailer services we integrate with — those integrations fetch only publicly available card and product data.

How Long We Keep Your Information

• Account and collection data — retained for as long as your account is active. If you request account deletion, we will remove your personal data within 30 days.
• Usage and log data — retained for up to 90 days for security and debugging purposes, then automatically deleted.
• Backups — encrypted backups may be retained for up to 90 days as part of our disaster recovery process.

Your Rights

As a UK resident, you have the following rights under the UK GDPR:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct any inaccurate personal data.
• Erasure — request deletion of your personal data (the "right to be forgotten").
• Portability — receive your data in a structured, machine-readable format.
• Restriction — ask us to stop processing your data in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Withdrawal of consent — withdraw any consent you have given at any time by emailing us. This does not affect the lawfulness of any processing carried out before the withdrawal.

We do not carry out any automated decision-making or profiling based on your personal data.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection authority, at ico.org.uk.

Cookies and Similar Technologies

Our website uses cookies and similar technologies to help the site function and improve your experience. This includes:

• Essential cookies — required for the site to function correctly. These cannot be disabled.
• Local storage — used to store your account email and preferences on your device.

You can manage cookie settings through your browser. Note that disabling cookies may affect the functionality of the site.

Security

We take the security of your personal data seriously. We use industry-standard measures including encrypted connections (HTTPS) and secure database storage. However, no method of data transmission over the internet is 100% secure. We cannot guarantee the absolute security of your information, but we will do our best to protect it.

Links to Other Websites

Our service may contain links to third-party websites or services that are not owned or controlled by us. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before sharing any personal information.

Children

Our service is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13, and we do not offer a parental consent mechanism. If you are under 13, please do not use this service. If you believe we have inadvertently collected personal information from a child under 13, please contact us immediately at [email protected] so we can delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. For non-material changes, we will update the "Last updated" date at the top of this page.

For material changes — particularly those affecting how we process your personal data — we will notify you by email at least 30 days before the changes take effect. We encourage you to review this policy periodically.

Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us: