ValdarLegal
Privacy policy
Last updated: October 27, 2026
This policy explains what Vast Flow, LLP (“Vast Flow”, “we”, “us”) collects when you use the Sports Card Scanner — Valdar mobile app (the “App”) and when you visit valdar.app (the “Site”), why, who else processes it, and how you can see or delete it.
The App and the Site collect different things, so the policy keeps them apart. Scanning a card means sending a photograph somewhere that can read it; visiting this page does not.
In short
- The App sends the card photos you choose to scan to our servers to identify the card and estimate its condition. That is the feature.
- We never sell personal information and we do not use your card photos for advertising.
- Payments are handled entirely by Apple or Google. We never see a card number or billing address.
- The Site has no account, no form and no advertising. Its only third-party script is Microsoft Clarity analytics.
- You can ask for a copy of your data or for its deletion at any time by email.
What the App collects
Card photos. When you scan a card, the photo is sent to our servers and processed by computer-vision and AI models to identify the card and estimate its condition. Photos are used to provide the scanning service and to improve recognition accuracy. We do not use them for advertising and we do not sell them.
Collection data. The cards you save, the collections you create, your favourites and your portfolio entries are stored so the App can show your collection and its value across sessions and devices.
Purchase information. Subscriptions are sold and billed by the Apple App Store or Google Play. We receive an anonymised confirmation, such as a flag that a subscription is active, and never your card number, billing address or other payment details.
Device and usage data. Basic technical data — device model, operating system version, app version, crash logs and anonymised usage events such as which screens are used — so we can keep the App stable and improve it.
The App Store privacy label and the Google Play Data safety section are the per-store declarations of the same processing, filled in by us. If you think one of them and this page disagree, tell us; that is a report worth sending.
What the Site collects
valdar.app is a static page. It has no sign-in, no form and no cookie of its own. It loads one third-party script, Microsoft Clarity, to understand how visitors use the page (clicks, scrolling and session replays). Clarity may set cookies and is a separate controller: what it records is held by Microsoft under Microsoft’s privacy statement. It starts only after your first interaction or 2.5 seconds after the page has loaded, and blocking it in your browser has no effect on the page working.
The Site sets no advertising identifier, loads no ad network and carries no retargeting pixel. Like any web server, the hosting provider logs requests (address, time, path, browser) to keep the service running.
How we use information
- to identify cards, estimate market values and produce condition-grade estimates;
- to store and sync your collections and portfolio;
- to operate subscriptions and unlock Premium features;
- to fix crashes, improve recognition and develop new features;
- to answer your support requests;
- to send optional notifications you turn on, such as price alerts for players you follow.
Who processes data for us
A small number of processors run parts of the service. Each receives only what its job requires and is bound by its own privacy obligations.
| Processor | What it does | What it receives |
|---|---|---|
| Apple App Store, Google Play | Selling and managing subscriptions | The transaction; we get back only an anonymised confirmation |
| AI and cloud infrastructure providers | Card recognition, grade estimation and the in-app card assistant | The photo you scanned and the request made of it |
| Market data providers | Prices built from public marketplace data such as eBay sold listings | A query about a card; no personal data is needed to answer it |
| Crash reporting and analytics tools | Keeping the App stable | Crash traces, device model, OS and app version, anonymised usage events |
| Microsoft Clarity | Analytics for this website | Page interactions on valdar.app only; it is not in the App |
How long data is kept
Collection data is kept while your account or on-device library exists. Scanned photos are kept only as long as needed to provide and improve recognition. Analytics data is stored in aggregated or anonymised form. You can ask for deletion at any time.
How it is protected
Data travels over encrypted connections (HTTPS/TLS) and is stored on access-controlled infrastructure. No transmission or storage method is completely secure, but we apply industry-standard measures suited to the data we process.
Your rights
Depending on where you live — including under the GDPR in the EEA and the CCPA/CPRA in California — you may have the right to access, correct, export or delete your personal data, and to object to or restrict some processing. Email support@vastflow.kz from your account email, say what you want done, and we will respond within 30 days. Inside the App, the account deletion option in Settings does the same where it is available.
Children
The App is not directed at children under 13 (or the equivalent minimum age where you live), and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.
Where data is processed
Vast Flow is based in Kazakhstan and uses cloud infrastructure that may process data in other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses.
Changes to this policy
When this policy changes, the “Last updated” date above changes with it, and material changes are announced in the App where appropriate. Continued use after a change takes effect means you accept it.
Contact
Vast Flow, LLP — support@vastflow.kz. The terms of service cover the other half of the relationship: what the estimates are and the rules for using the App.