CardOpz
Book a demo

PRIVACY

Privacy Policy

What we collect, why, who else handles it, and how to ask us to see, correct or delete it.

Effective: · Last updated: October 17, 2026

First published June 14, 2025.

CardOpz LLC runs this website and the CardOpz platform that cardrooms and poker clubs use to run their floor. We're a US business. We do not sell or share personal information. The CardOpz platform is for running brick-and-mortar rooms and keeping players informed. No gambling, betting, or wagers of any kind happen through it.

What this policy covers

  • cardopz.com: this website, including the shop and the client resources area
  • cardopz.app: the platform room staff sign in to
  • Player apps: each room's own address on cardopz.com (for example, [clientname].cardopz.com)

When we hold player information for a cardroom, we hold it on that room's behalf and act on the room's instructions. If you're a player, the room decides what it collects about you and how long it keeps it. Contact your room first, and we'll help them with your request.

What we collect and why

On this website

  • Demo bookings: your name, email, phone (optional), room name, what you'd like to cover, and the time you pick. We use it to set up the call and follow up about your room.
  • Guide and hardware requests: your name, club, city or location, email, phone, and what you run or need. We use it to answer you.
  • Newsletter: your email address, once you confirm it.
  • Shop orders: Stripe's checkout page collects your name, email, phone, billing and shipping address and payment details. We get the order details and ship-to address; we never see your card number.
  • Page views: the page, its title, the site that sent you, any campaign tags in the link, a random visit ID kept in your browser tab, and the time. We don't store your IP address or browser details with them.
  • Resources area (clients only): your sign-in email and organization, which documents you open, the time, and the IP address and browser of the request.

Forms use your IP address for up to an hour as a counter that stops repeated submissions. It isn't stored with your request.

Contact Information

What We Collect: Name, email address, phone number.

Why We Collect It: To communicate with you, respond to inquiries, and provide updates.

Account Information

What We Collect: User credentials, roles, and permissions.

Why We Collect It: To manage access to our platform and keep it secure.

Business Data

What We Collect: Player information, transaction records, game data.

Why We Collect It: To provide platform services and generate reports for poker room operators.

Usage Data

What We Collect: Feature usage, performance metrics, error logs.

Why We Collect It: To improve our services and fix problems.

Support Communications

What We Collect: Tickets, emails, call recordings (with consent).

Why We Collect It: To resolve issues and train our team.

Profile Data (App Users)

What We Collect: Name, player ID, contact preferences.

Why We Collect It: To personalize the app for players.

Game Activity (App Users)

What We Collect: Session history, waitlist status, tournament participation.

Why We Collect It: To track player activity and make the app work.

Device Information (App Users)

What We Collect: App version, device type, push notification tokens.

Why We Collect It: To keep the app compatible and deliver notifications.

Text messages from the platform

Texts come from the CardOpz platform, not this website. Rooms send them through Twilio, and they cover:

  • Waitlist and seat calls
  • Tournament seating
  • Sign-up links for the room's player app
  • Security codes and one-time login links for staff and players

Texts are never marketing.

How people opt in

  • Staff (cardopz.app): a manager adds the staff member's mobile number with their OK. The staff member agrees to security texts when they claim their account: "I agree to receive SMS notifications for account security including login alerts. Msg & data rates may apply. Reply STOP to opt-out." Each login request shows a notice before a text is sent.
  • Players (the room's player app): players opt in at the room when they sign up, or when they first sign in to the player app online.
  • Consent is recorded in the room's CardOpz system when a player or staff member opts in. Consent is never pre-checked.

How often, and what it costs

  • Staff: one text per login request.
  • Players: it depends on activity, like how often you join a waitlist or play a tournament.
  • Message and data rates from your carrier may apply. CardOpz doesn't charge for texts.

Stopping texts

  • Reply STOP to any text to stop them. You'll get one confirmation.
  • Reply HELP for help, or email support@cardopz.com.
  • To turn texts back on, contact your room or support@cardopz.com.
  • If you stop security texts, text sign-in and login alerts stop too.

Carriers and your number

We follow carrier consent rules. Texts work on major US carriers, including AT&T, Verizon, T-Mobile and U.S. Cellular, and most regional carriers. Your phone number is never sold or shared for marketing.

Cookies and browser storage

This is everything cardopz.com stores in your browser.

Name What it's for How long When
cardopz_cookie_consent (cookie) Remembers your cookie choice 1 year Always (necessary)
cardopz_session_id (session storage) A random ID that groups the page views of one visit for our anonymous page counts Until you close the tab Always
cardopz_auth_token and related cardopz_auth_* entries (session storage) Keeps a client signed in to the resources area Until you close the tab or sign out Resources login only
__stripe_mid, __stripe_sid (Stripe cookies) Fraud checks during checkout About 1 year (__stripe_mid); 30 minutes (__stripe_sid) On /shop (necessary for checkout)
_ga, _ga_9RYZ4N3NJX (Google Analytics cookies) Show us which pages people read Up to 2 years Only after you turn analytics on

Sentry, our error monitoring, sets no cookies. Vercel Web Analytics is cookieless. We use no advertising, retargeting or social media pixels.

Your cookie choices

  • Cookie settings: use the "Cookie settings" link in the footer of any page, or the Cookies button in the corner once you've chosen. Turning analytics off deletes the Google Analytics cookies.
  • Global Privacy Control and Do Not Track: if your browser sends either signal, we treat it as "Necessary only" and keep analytics off.
  • Your browser: you can also block or delete cookies in your browser settings. Google offers its own Analytics opt-out.

Refusing analytics doesn't change how the site works.

Who else handles data

We don't sell or share personal information. These companies handle it for us, and this is what each one does.

For this website and our own business

  • Vercel: hosts cardopz.com, runs its server functions and keeps its request logs. Its data store (Vercel KV) holds leads, demo bookings, newsletter subscribers and anonymous page views.
  • Vercel Web Analytics: cookieless page counts.
  • Sentry: error monitoring and performance sampling on cardopz.com. When something breaks, it gets the error, the page, and your browser and IP address. It times a sample of page loads. No session recording.
  • Google Analytics: page views and events, only after you turn analytics on.
  • Stripe: shop checkout. Stripe takes your name, email, phone, billing and ship-to address and payment, and gets the IP address and browser of the checkout request for fraud checks.
  • Resend: sends our email: demo confirmations, quotes, order notices, follow-up email and the newsletter. It gets your email address and the message.
  • Microsoft 365: a demo booking creates a Teams meeting through Microsoft Graph and sends the invite to the email you give. Lead, order and payment notices post to our own Teams channels with name, email, phone and ship-to address.
  • Documenso: contracts you sign with us. It gets signer names, emails and signing records.
  • Anthropic: helps draft our own blog articles. No visitor data goes to it.

For the CardOpz platform, under each room's agreement

  • Microsoft Azure: hosts the platform. Each room has its own database.
  • Twilio: texts the room sends: waitlist and seat calls, tournament seating, sign-up links and security codes.
  • SendGrid: email the room sends.
  • TINCheck: tax ID checks for payouts.

Vercel hosts this website only. It does not host the platform.

Follow-up email

When you book a demo or ask for a pricing quote, we add you to a short series of follow-up emails about your room. Every one has an unsubscribe link.

How long we keep it

  • Page views: stored without IP address or browser details. We keep the latest 20,000 and drop older ones.
  • Daily page and visit counts: 90 days.
  • Leads, demo requests and newsletter subscribers: while we work with you, or until you ask us to delete them.
  • Demo booking records: 90 days.
  • Newsletter sign-ups you haven't confirmed: 48 hours.
  • Form spam counters: up to an hour.
  • Platform data: as set by each room's agreement with us.

Your requests

Anyone can ask to see, correct or delete what we hold about them. Email privacy@cardopz.com and we'll answer within 30 days. For player data we hold for a cardroom, we act on that room's instructions, so players should contact their room.

California

California's online privacy law asks us to point out a few things:

  • What we collect: see "What we collect and why" above.
  • Who receives it: see "Who else handles data" above.
  • How we announce changes: see "Changes to this policy" below.
  • When this policy took effect: the date at the top of this page.
  • Do Not Track: we treat a Do Not Track or Global Privacy Control signal as "Necessary only".

Data security

We use technical and organizational measures to protect your information from unauthorized access, use, or disclosure. No method of sending or storing data over the internet is 100% secure.

Children

Our services are not directed to children under 18, and we do not knowingly collect personal information from children.

Automated Processing & AI

AI-Assisted Content

Some content on CardOpz.com and our blog is drafted with the help of AI tools. A member of our team reviews it before it's published. We do not publish AI output without human review.

Internal Use

We also use AI tools internally to help run our business, for example to help with drafting and internal documentation. AI tools do not make final decisions about your account or your access to our services without human review.

Changes to this policy

Changes are posted here with a new date. Material changes to customers are emailed 30 days before they take effect.

Contact us

Questions about this policy or your information: