> ## Documentation Index > Fetch the complete documentation index at: https://docs.nextcards.io/llms.txt > Use this file to discover all available pages before exploring further. # Privacy Policy **Effective date:** 15th October 2026 This Privacy Policy explains how **NextCards PTE LTD**, UEN **202644608D** (“NextCards”, “we”, “us” or “our”), collects, uses, discloses and protects personal data in connection with NextCards. It covers our website, marketplace, online booster pack openings, NFT and wallet integrations, physical card submissions, custody and redemptions, and communications with you. We handle personal data in accordance with Singapore's Personal Data Protection Act 2012 (“PDPA”) and other applicable data protection requirements. This Policy provides information about our practices; reading it or accepting our Terms of Service does not, by itself, give consent to every possible use of personal data or to optional marketing. # 1. Personal data we collect Personal data is information about an individual who can be identified from that information, or from that information together with other information we have or are likely to have access to. Depending on the features you use, relevant categories include: * **Account and contact information:** your name, email address, mobile number, account identifiers, username and any profile information you choose to provide. * **Submission and redemption information:** delivery or collection details, addresses, recipient names, courier instructions, tracking references, proof of handover or delivery, and records linking you to submitted or redeemed cards. * **Wallet and blockchain information:** wallet addresses, account-to-wallet associations, NFT identifiers, ownership and transfer history, transaction hashes, contract interactions, XSGD payment amounts and settlement status. These may be personal data when associated with you. * **Marketplace and pack activity:** listings, offers, purchases, sales, fees, pack purchases and contents allocated to your account, collection records, and preferences or favourites you choose to save. * **Support and preference records:** correspondence, complaints, recovery assistance requests, evidence you provide, notification settings, consent records and unsubscribe requests. * **Technical and usage information:** information generated or received when you use the services, such as IP addresses, browser and device information, session identifiers, access times, interactions with features, and diagnostic or security records. The particular information depends on the tools enabled and the circumstances of use. We do not receive copies of the identity documents you submit to Coinbase for its verification process. NextCards obtains payment and settlement information for its marketplace and vending machine smart contracts from blockchain records. Coinbase's separate handling of identity and financial information is explained in section 6. NextCards personnel do not have access to your wallet's private keys. Do not send us private keys, recovery phrases, passwords or one-time authentication codes in a support request. # 2. How we collect personal data We collect information directly when you register, update your account, make or accept an offer, buy or sell a collectible, open a pack, submit or redeem cards, change communication preferences, or contact us. We also receive information through our authentication and wallet integrations, courier updates and other service providers where necessary to provide the relevant feature. For example, Privy supports account authentication and wallet association, while DHL provides information needed to arrange and track a shipment. Some information is collected automatically through the website, its security and diagnostic tools, or cookies and similar technologies described in section 8. We read relevant public blockchain records to record and reconcile transactions, payments and collectible ownership. If you provide another person's details, such as an authorised recipient's name or delivery address, give them the relevant privacy information and ensure you have an appropriate basis to provide those details. We will use them for the disclosed purpose. # 3. How we use personal data We use relevant personal data for the following purposes: * Creating and managing accounts, authenticating users, associating wallets with accounts and providing the features you request. * Processing marketplace offers and transactions, pack purchases and openings, and recording and reconciling payment and NFT activity. * Authenticating, identifying, storing and tracking physical cards; maintaining ownership and custody records; and arranging submissions, collections, courier deliveries and redemptions. * Providing support, investigating transaction or delivery issues, facilitating appropriate recovery assistance, administering refunds and dealing with insurance claims or disputes. * Sending necessary account, security, transaction and fulfilment communications, and other notifications you request. * Sending optional marketing emails where you have opted in, as explained in section 9. * Maintaining service reliability, diagnosing faults, measuring service use through the tools described in section 8, and improving the services where permitted by applicable law. * Preventing and investigating fraud, unauthorised access and misuse; verifying relevant claims or authority; and protecting users, customer assets and the service. * Meeting applicable legal, accounting, tax, regulatory and record-keeping obligations and establishing, exercising or defending legal claims. We limit collection, use and disclosure to purposes that are reasonable in the circumstances and notified to you, unless the law permits or requires otherwise. We will provide further notice and obtain consent where required before using personal data for a materially different purpose. # 4. Consent and necessary information Where consent is required, we will obtain it through an appropriate process. For some information voluntarily provided for a requested transaction, the law may recognise deemed consent. We may also process information without consent where a specific legal exception or obligation permits or requires it. Optional marketing permission is separate from the information and processing needed to provide your account or complete a transaction. We do not require you to agree to optional marketing as a condition of ordinary use of NextCards. You may choose not to provide personal data or withdraw consent on reasonable notice. We will explain if doing so prevents us from providing a requested feature. For example, we cannot arrange a courier redemption without the necessary recipient and delivery information. Withdrawal does not automatically require deletion of records that we lawfully need to retain. # 5. Who receives personal data We disclose relevant information only for the purposes explained in this Policy, on an appropriate legal basis, and to the extent reasonably necessary. Recipients include: * **Privy:** to support authentication, embedded wallets, account-to-wallet association and relevant wallet support processes. Its own processing is described in the [Privy Privacy Policy](https://www.privy.io/privacy-policy). * **Coinbase:** where you choose its funding, conversion or withdrawal service. Setting up that connection may involve providing your wallet address, a partner account reference and session information needed for the integration. Coinbase collects any information needed for its own service directly as described in its privacy notice; it does not provide NextCards with copies of your identity documents. * **DHL and relevant delivery partners:** to arrange, carry out and track approved submissions and redemptions. Relevant information includes recipient details, addresses, contact information, shipment references and delivery instructions. Information may also be needed by customs authorities for an international shipment. * **Railway:** to host our application and databases, as described in section 10. * **Authorised personnel and professional advisers:** where needed to operate and support the service, address a claim, or meet a legal or accounting obligation. Relevant insurers or claims administrators may receive information needed to assess a card, storage or delivery claim. * **Authorities or other parties where legally justified:** where disclosure is required by law, a binding order or a lawful regulatory process, or permitted for a relevant investigation, legal claim or protection of rights. We do not treat this as unrestricted permission to disclose account information. **Additional operational providers:** * **Resend:** to send service notifications and, where you have opted in, marketing emails. Resend processes recipient email addresses, message contents and relevant delivery information. Any additional email tracking depends on the configuration disclosed in section 8. See the [Resend Privacy Policy](https://resend.com/legal/privacy-policy). * **Cloudflare R2:** to store and deliver public assets, such as images or files intended for publication on NextCards. Assets published through this storage may be accessible to the public. Cloudflare may process the asset content and related request or technical information needed to provide its service. See the [Cloudflare Privacy Policy](https://www.cloudflare.com/privacypolicy/). * **Railway S3-compatible storage:** to store private images and associated file information in Singapore. Access through NextCards is restricted to the user who uploaded the image and authorised NextCards administrators. This application access restriction does not prevent the storage provider from carrying out processing necessary to provide the storage service or meet a legal obligation. See the [Railway Privacy Policy](https://railway.com/legal/privacy). * **PostHog:** we use its hosted cloud service with EU data hosting to analyse use of NextCards and help us understand and improve the service. Depending on the enabled configuration, relevant data may include interaction events, usage information and technical or account identifiers. The collection settings and available choices are described in section 8. See the [PostHog Privacy Policy](https://posthog.com/privacy). * **Sentry:** we use its hosted cloud service with EU data hosting to monitor errors, investigate faults and maintain service reliability. Relevant diagnostic reports may include technical information, error details and identifiers associated with an affected session or transaction, depending on the enabled configuration. We limit or redact information that is unnecessary for these purposes. See the [Sentry Privacy Policy](https://sentry.io/privacy/). * **Alchemy and Coinbase blockchain services:** to connect to supported blockchain networks and support the reading, submission or monitoring of relevant transactions. Depending on the service used, these providers may process wallet addresses, transaction and smart contract information, API requests and related technical information. Coinbase's funding, conversion and withdrawal services are addressed separately in section 6. See the [Alchemy Privacy Policy](https://www.alchemy.com/terms-conditions/privacy-policy) and [Coinbase Privacy Policy](https://www.coinbase.com/legal/privacy). We limit information provided to these operational providers to what is needed for the relevant function and apply appropriate contractual and other safeguards. Processing locations and overseas transfers are addressed in section 10. We do not sell or rent your personal data. We do not give third parties your contact details for their independent marketing without an appropriate separate basis, including consent where required. Other marketplace users may see profile information you make public, listing details, and wallet or transaction information visible through the service or blockchain. Your delivery address, email address and mobile number are not made public as part of an ordinary marketplace listing. Public blockchain visibility is explained in section 7. Where a provider processes data on our behalf, we remain responsible for our applicable obligations concerning that processing. Where you use a provider's separate service, it may also determine its own purposes for processing information under its own privacy notice. Linking to that notice does not remove NextCards' responsibilities for its own disclosures or integration. # 6. Coinbase verification and payment information Coinbase operates its funding, conversion and withdrawal services and determines its own verification requirements. It may ask you directly for identity documents, financial details or other verification information. Its collection, checks and retention are governed by its [Privacy Policy](https://www.coinbase.com/legal/privacy), applicable terms and law. NextCards does not receive your Coinbase identity documents. We use public blockchain information concerning payments to, and settlement through, the marketplace and vending machine smart contracts to maintain our service records. This is distinct from receiving a Coinbase verification file or controlling your bank account. Please direct requests concerning personal data held independently by Coinbase to Coinbase. Contact us for requests concerning information in NextCards' possession or control. We will provide reasonable assistance in identifying the appropriate contact where needed. # 7. Public blockchain records Minting, transferring, selling or redeeming an NFT, or making an XSGD payment, may create records on a public blockchain. Depending on the transaction, those records may include wallet addresses, token and transaction identifiers, amounts, timestamps and contract events. Blockchain nodes, explorers and other third parties may access and retain this information worldwide. Wallet addresses and transaction records are not necessarily anonymous. They may be linked to an individual through their account, public profile, trading history or information available elsewhere. Making a profile private or deleting an account does not automatically make earlier blockchain activity private. We do not intentionally place your name, email address, mobile number, delivery address or Coinbase identity documents in public blockchain records. We seek to keep information placed on-chain to what is necessary for the relevant transaction and functionality. We may be unable to alter or remove historical records from a public blockchain or copies held independently by others. We will nevertheless assess requests concerning data we control and take appropriate steps where required and technically available. Blockchain limitations do not remove our obligations concerning data minimisation, our off-chain records, protection or applicable privacy rights. # 8. Cookies analytics and similar technologies NextCards and relevant integrated services use cookies, session information and similar technologies to support sign-in, maintain authenticated sessions, provide requested functionality and protect the service. Browser storage may also retain preferences where that feature is enabled. We use relevant diagnostic and security information to detect failures, troubleshoot problems and maintain service reliability. Optional usage analytics or other non-essential tracking, where enabled, must be described below. We will provide notice and obtain consent where required by applicable law; a marketing opt-in is not automatically consent to unrelated tracking. **Sign-in and wallet access.** We use Privy authentication cookies, including `privy-token`, to verify that you are signed in and let you use account features such as the marketplace and your embedded wallet. These cookies contain sign-in associated with your account and session. Privy access tokens are short-lived and may be refreshed while your session is active. You can end your session by signing out. **Server analytics and diagnostics.** We use PostHog to monitor selected events on our servers, such as whether blockchain notifications were processed and whether email batches were accepted for sending. These events can include event types, counts and processing outcomes. PostHog and Sentry can also receive error reports that include error messages, technical details about where a failure occurred, and relevant request or event identifiers. Where performance monitoring is enabled, Sentry may also receive timing information. We use these records to investigate failures and maintain service reliability. We retain them in line with section 11. **Email delivery.** We use Resend to send email, check whether messages were accepted for sending and troubleshoot failures. You can unsubscribe from marketing emails as described in section 9. **Your choices.** You can block or clear cookies in your browser settings. Clearing sign-in cookies may sign you out, and blocking them may prevent you from using features that require an account. Browser cookie settings do not stop diagnostic records generated by our servers. # 9. Marketing and service communications We send promotional emails about NextCards where you have opted in. You may withdraw that permission using the unsubscribe method in a marketing email or by contacting [nextcardspteltd@gmail.com](mailto:nextcardspteltd@gmail.com). We will implement withdrawal as soon as reasonably practicable and within any applicable legal timeframe. Necessary account, security, payment, trade, submission and redemption messages may continue where needed to provide the service or meet an obligation. Marketplace alerts that promote products or encourage new purchases are treated as marketing where applicable; calling a promotional message a notification does not change its purpose. We may keep a minimal record of your unsubscribe request so that we can respect your preference. Withdrawing marketing consent does not prevent ordinary use of NextCards. # 10. Hosting and overseas processing Our application hosting and databases are provided through Railway and configured in Singapore. Private images are also stored in a Railway S3-compatible bucket in Singapore. We use PostHog's and Sentry's hosted cloud services with EU data hosting. These locations describe the selected hosting and storage arrangements; provider support, service administration, subprocessors and other ancillary processing may involve additional countries under the relevant service arrangements. Resend's published service information states that stored email data is held in the United States. Selecting an email sending region does not, by itself, change that storage location. Cloudflare R2 public assets may be accessed and delivered internationally, and their storage follows the applicable bucket settings and service arrangements. Alchemy and Coinbase blockchain services also use provider infrastructure that may involve processing outside Singapore under their service terms and privacy information. This Policy does not represent that those services or public blockchain records are confined to a single country. Providers involved in authentication, wallets, payment services, email, file storage, monitoring, analytics or blockchain infrastructure may process relevant information outside Singapore, depending on their service and the arrangements identified in this Policy. International deliveries may also require data to be processed in the destination or transit country. Where we transfer personal data outside Singapore, we take appropriate steps to meet the PDPA's transfer requirements, including ensuring a standard of protection comparable to that under the PDPA through appropriate enforceable safeguards or another legally permitted arrangement. We do not rely on a general statement that you use an international service as a waiver of these requirements. # 11. Retention and account closure We keep personal data only for as long as it continues to serve the purposes for which it was collected or retention remains necessary for a legitimate legal or business purpose. We assess the type of information, the relevant purpose, outstanding obligations and applicable retention requirements. For example, account and delivery information may be needed while a service or shipment is pending. Ownership, custody and transaction records may remain necessary while we hold a card for you, to reconcile transactions, resolve a dispute or meet legal and accounting obligations. Security and support records are retained only for the relevant investigation, support or protection need. Marketing preferences are retained while relevant, including a minimal suppression record after an unsubscribe request. Closing or suspending an account does not automatically erase records needed to return your cards, address a genuine ownership dispute or meet another lawful obligation. It does not permit us to retain all personal data indefinitely. When retention is no longer justified, we delete the relevant records or remove the means of associating them with an identifiable person. Copies in backups are handled through the applicable retention and deletion process and should not be returned to ordinary use without applying relevant deletion instructions. Independently maintained public blockchain records are subject to section 7. # 12. Protection and data incidents We make reasonable administrative, technical and physical security arrangements appropriate to the personal data we possess or control. These include limiting access to authorised persons with a relevant need, managing access to accounts and systems, and using appropriate safeguards with service providers. Please protect your devices and login methods and notify us promptly if you suspect that your account or personal data has been compromised. Do not include wallet secrets in your report. We assess suspected personal data breaches and take appropriate containment and remediation steps. Where notification is required, we notify the Personal Data Protection Commission and affected individuals in accordance with the applicable legal requirements and timeframes. A notification duty to individuals depends on the legal criteria; we do not represent that every technical incident requires the same notification. # 13. Your requests and choices Subject to applicable law and its exceptions, you may: * Request access to personal data about you in our possession or control and information about how we used or disclosed it during the year before your request. * Request correction of an error or omission in your personal data. * Withdraw consent for collection, use or disclosure on reasonable notice, including withdrawing marketing consent. * Ask us to close your account or review whether particular information can be deleted or anonymised. These requests are assessed alongside retention duties, unresolved transactions, ownership rights and other legal requirements; there is no unconditional promise to erase every record immediately. Send requests to [**nextcardspteltd@gmail.com**](mailto:nextcardspteltd@gmail.com). Identify the account and explain the request without sending private keys or authentication codes. We may seek information reasonably necessary to verify your identity or authority and clarify the request. We respond as soon as reasonably possible. If we cannot provide access within 30 days after receiving an access request, we will notify you in writing within that period of when we expect to respond. If an exception limits what we can provide or correct, we will explain the outcome to the extent the law permits. Where permitted, we may charge a reasonable fee for responding to an access request. We will provide a written estimate before charging it. We do not charge for correcting personal data or withdrawing marketing consent. We will explain any service consequences of withdrawing consent and cease the relevant processing where required. Withdrawal does not affect processing that remains permitted or required on another lawful basis. If you are dissatisfied with our handling of a privacy concern, you may contact the [Personal Date Protection Commission](https://www.pdpc.gov.sg/). Contacting us first does not remove a right to seek regulatory assistance or another remedy. Additional rights under other applicable laws remain available where they apply. # 14. Age eligibility NextCards is intended for individuals aged 18 and above, subject to any higher applicable eligibility requirement. We do not knowingly permit registration by a person below that threshold. If you believe an ineligible person has provided personal data or opened an account, contact us so that we can investigate and take an appropriate step, including restriction or deletion where required, while addressing any legitimate outstanding asset or legal obligations. # 15. Changes to this Policy We may update this Policy to reflect changes to our practices, providers or applicable law. We will update the effective date and give appropriate notice of material changes. Where a new use or disclosure requires consent, we will seek it before proceeding. Continued use of the website is not treated as a blanket agreement to new optional marketing or unrelated processing. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.