Privacy Policy

This policy explains what personal information Holy Grail Grading Ltd collects, how we use it and the rights you have. We aim to keep it clear and short.

1. Who we are

Holy Grail Grading Ltd (“HGG”, “we”, “us”) is a trading card grading company based in London, UK. We are the controller of the personal data described in this policy.

2. What information we collect

Depending on how you use our website and services, we may collect:

• Submission and order details – your name, email address, postal address, telephone number, details of the cards you send us, and the service level you choose.
• Payment details – payments are handled by Stripe. We do not see or store your full card number. We keep a record of the payment (amount, date, status) and the email address linked to it.
• Messages you send us – emails, contact form messages and messages sent through the chat widget on our website.
• Waitlist and email sign-ups – your email address if you joined our waitlist or asked to hear from us.
• Card images and grading records – images of your cards, grades, certificate ID and inspection data created during grading.
• Technical information – your IP address, browser type, device, pages visited and the website you came from (for example, a link from Instagram), collected by our hosting providers and any analytics tools described in section 6.

3. How and why we use your information

We use personal data only where we have a lawful reason under UK data protection law:

• To provide our services (contract) – receiving, grading, slabbing, certifying and returning your cards, taking payment, and keeping you updated on your order.
• To keep our public verification registry (legitimate interests and contract) – see section 5.
• To answer your questions (legitimate interests) – replying to emails, contact forms and chat messages.
• To improve and promote our business (legitimate interests) – understanding how people find and use our website, and measuring our advertising.
• To send marketing you asked for (consent) – for example waitlist or offer emails. You can withdraw consent at any time by contacting us.
• To meet legal obligations – such as keeping accounting and tax records.

We do not sell your personal data.

4. Who we share your information with

We use trusted service providers to run our business. They may process your data on our behalf and only as needed to provide their service:

• Netlify – website hosting.
• Render – hosting for our grading, verification, tracking and chat systems.
• Stripe – payment processing.
• Formspree – handling email sign-up and form submissions.
• Airtable and automation tools – storing and processing order and grading records.
• Google Fonts – our pages load fonts from Google, which means your IP address is sent to Google when a page loads.
• Delivery and courier services – to return your cards to you.
• Advertising and analytics providers – such as Meta (Facebook and Instagram) and Google, if we use their tools (see section 6).

We may also share information where required by law, to enforce our terms, or to protect our rights, our customers or others.

5. Public verification registry

Every card we grade receives a unique certificate ID. When you submit cards, you agree that the grade, card details and inspection images for that certificate will be shown in our public verification registry, so that buyers and sellers can check a graded card is genuine. This is essential to how our certification works.

The registry shows card and grading information. It does not show your name, address, email or payment details. If you have a concern about information in the registry, contact us and we will look into it.

6. Cookies and similar technologies

Our website uses only a small amount of browser storage that is needed for it to work, such as remembering whether you have dismissed a message. We may also use analytics and advertising tools, such as Google Analytics or the Meta Pixel, that use cookies or similar technologies to tell us how visitors find and use our website, and to measure and improve our advertising.

Where required, we will ask for your consent before using non-essential cookies. You can also block or delete cookies in your browser settings, and manage ad preferences in your Instagram, Facebook and Google account settings.

7. International transfers

Some of our service providers are based outside the UK, including in the United States. Where your data is transferred outside the UK, we rely on approved safeguards such as the UK International Data Transfer Agreement or addendum, the UK–US data bridge, or an adequacy decision, where these apply.

8. How long we keep your information

We keep personal data only for as long as we need it for the purposes above. In general: order, payment and accounting records are kept for as long as the law requires (usually at least six years); grading records and registry entries are kept for as long as the certificate remains valid; messages are kept for as long as needed to deal with your query and any follow-up; and email sign-ups are kept until you ask us to stop.

9. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct information that is inaccurate or incomplete;
• ask us to delete your data, in some circumstances;
• ask us to restrict or object to how we use your data, in some circumstances;
• ask for your data in a portable format, in some circumstances; and
• withdraw consent at any time, where we rely on it.

To use any of these rights, contact us using the details in section 1. We may need to confirm your identity first. If you are unhappy with how we handle your data, please tell us so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

10. Security

We take reasonable steps to protect your data, including secure hosting and encrypted payment processing. No online service can be completely secure, so please take care when sharing information online.

11. Children

Our services are intended for adults. We do not knowingly collect personal data from children. If you are under 18, please ask a parent or guardian to place orders and contact us for you.

12. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last changed.