Super Cartas Español Pro Open the app

Privacy Policy

Last updated: July 2026

1. Data Controller Identity and Address

Black Engine Technologies SAS de CV, taxpayer ID (RFC) BET180206MU5, registered address at Ciudad Apodaca, Nuevo León, United Mexican States, operator of the SUPERCARTAS platform (hereinafter "SUPERCARTAS", "we", or "the Platform"), is responsible for the processing of the personal data you provide, in accordance with the Mexican Federal Law for the Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations.

2. Personal Data We Collect

For the purposes described in this notice, we collect the following categories of personal data:

Identification and contact data

  • Username
  • Email address
  • Shipping address (street, number, neighborhood, postal code, city, state)
  • Phone number (when voluntarily provided)

Browsing and technical data

  • IP address
  • Browser and device information (user agent)
  • Pages visited and time spent
  • Cookies and session identifiers

Transaction data

  • Purchase and sales history
  • Bidding history
  • Transaction amounts
  • Contact details you share with your counterparty to settle the transaction. In user-to-user sales, payment is settled directly between them; SUPERCARTAS does not process it.
  • For sales of SUPERCARTAS's own inventory, the data needed to charge and invoice: payment method, transaction reference and, if you request a CFDI, your billing details. Card data is handled by the PCI-DSS certified provider; we do not store it.

Data collected through the mobile app (SUPERCARTAS App)

If you use our Android or iOS app, we may additionally collect:

  • Camera and photos: images you capture with the scan feature are sent to our servers solely to identify the card and show you the result. The app requests camera permission on first use; you may deny or revoke it in system settings, and scanning is the only feature that stops working. We do not run facial or biometric recognition on these images.
  • Push notification token: a device identifier issued by Firebase Cloud Messaging (Google) so we can notify you about bids, messages and activity on your listings. You can disable notifications in system settings.
  • Approximate location: if you use the "near me" feature to find nearby sellers or meetup points, the app requests location permission and reads a GPS fix from the device, but rounds it immediately to roughly 110-meter precision before sending it to our servers — we never learn your exact location. We only request it while you use that feature (never in the background or continuously), and you may deny or revoke it at any time in system settings; "near me" is the only feature that stops working.
  • Sign in with Apple or Google: if you choose those sign-in options, the provider gives us your name, your email address (or the private relay address, if you hide it) and a user identifier. We never receive your password.
  • Crash and diagnostic telemetry: when the app crashes we record the technical error, app version, operating system and device model in order to fix it.

The app does not collect background location, your contact list, or gallery content beyond the images you explicitly select.

We do not collect sensitive personal data (racial or ethnic origin, health status, religious beliefs, political opinions, sexual preference).

3. Purposes of Processing

Your personal data will be used for the following purposes:

Primary purposes (necessary for service delivery)

  • Create, manage, and maintain your user account
  • Process and facilitate buy-sell transactions between users
  • Facilitate communication between buyers and sellers
  • Share shipping addresses with sellers to complete deliveries
  • Send notifications about your listings, bids, orders, and platform activity
  • Identify cards from photos you capture with the scan feature
  • Send you push notifications about bids, messages and activity on your listings
  • Diagnose and fix application crashes
  • Verify identity and prevent fraud
  • Respond to inquiries, complaints, and support requests
  • Comply with applicable legal and tax obligations

Secondary purposes (not necessary, but legitimate)

  • Send marketing communications and platform news
  • Conduct statistical and behavioral analysis to improve our services
  • Personalize your experience on the platform

If you do not wish your data to be processed for secondary purposes, you may opt out by sending an email to [email protected] with the subject "Opt-out secondary purposes".

4. Data Transfers

Your personal data may be transferred to the following third parties:

  • Other platform users: Shipping address and contact details shared with sellers/buyers to complete transactions
  • Payment processors (only for sales of SUPERCARTAS's own inventory): Stripe and Conekta, to charge cards and cash at retail
  • Identity providers: Apple and Google, when you choose to sign in with those services
  • Push notifications: Google (Firebase Cloud Messaging) for delivery of alerts to your device
  • Infrastructure providers: Amazon Web Services (AWS), Wasabi, and Cloudflare for content storage and delivery
  • Analytics and diagnostics providers: Umami (self-hosted, cookieless analytics) and GlitchTip (self-hosted error tracking) — both run on our own infrastructure
  • Competent authorities: When required by law or court order

Transfers requiring your consent will not be made without obtaining it beforehand, except for the exceptions provided in Article 37 of the LFPDPPP.

5. ARCO Rights

Under Mexican law, you have the right to:

  • Access: Know what personal data we hold and how we process it
  • Rectification: Request the correction of inaccurate or incomplete data
  • Cancellation: Request the deletion of your data when you consider it is not being processed in accordance with the law
  • Opposition: Object to the processing of your data for specific purposes

To exercise your ARCO rights, send a request to [email protected] with the following information:

  1. Full name and email address associated with your account
  2. Clear description of the right you wish to exercise
  3. Documents proving your identity (copy of official ID)

We will respond to your request within a maximum of 20 business days from the date of receipt. The response will indicate whether the request is valid and, if so, it will take effect within the following 15 business days.

6. Revocation of Consent

You may revoke your consent for the processing of your personal data by sending a request to [email protected]. However, please note that in some cases we may not be able to fulfill your request immediately, as we may need to continue processing your data due to legal obligations.

7. Limitation of Use or Disclosure

To limit the use or disclosure of your personal data, you may:

  • Manage your notification preferences in the Settings section of your account
  • Request exclusion from marketing communications by emailing [email protected]
  • Use the "Unsubscribe" link included in our emails

8. Cookies and Tracking Technologies

We use cookies and similar technologies to improve your experience. For detailed information, please refer to our Cookie Policy.

9. Security Measures

We implement technical, administrative, and physical security measures to protect your personal data, including:

  • Encryption of data in transit (HTTPS/TLS)
  • Secure authentication via magic links (no password storage)
  • For user-to-user sales we store no bank or card data: payment happens off-platform
  • For our own sales, charging runs through PCI-DSS certified providers and card data never reaches our servers
  • Restricted access to personal data limited to authorized personnel

10. Changes to this Privacy Policy

We reserve the right to modify this privacy policy to comply with legislative changes, internal policies, or new requirements. Any changes will be published on this page and, when significant, we will notify you by email.

11. Contact

For any questions, comments, or requests related to the processing of your personal data, you may contact us at:

12. Consent

By registering and using the SUPERCARTAS platform, you acknowledge having read and accepted the terms of this privacy policy, granting your consent for the processing of your personal data as described herein.