This English version is provided for convenience. If it differs from the French version, the French version prevails: lire en français.
Who is selling?
Les cartes de Lily is the personal website of a private individual selling their own collection of Pokémon cards. Each card is photographed as it is, sold singly or in lots.
Unofficial site: Les cartes de Lily has no connection with The Pokémon Company, Nintendo, Creatures or Game Freak. Pokémon names and artwork belong to their owners.
How does a purchase work?
- You choose cards and send a reservation request with your name and email address, without creating an account; nothing is paid online.
- If the seller accepts it, they write to you by email to agree on payment and shipping.
- Payment by Wero or PayPal (goods and services): the seller sends you the amount, the lot’s reference and their payment details by email; with an account, you also find them in “My requests” while the lot awaits payment.
- To follow your requests online, ask the seller for a link: they send it in their reply, and you use it to choose a password for this site only.
This site will never ask for your password from another site (Pokémon account, Google, bank…), nor for a payment card number, and offers no software to download.
Your personal data
Data controller: Patrick J. R. Kappeler, as a private individual, reachable at the contact address below.
What is kept, and why
- Your account, created by your first request or by signing up: display name, email address and, if you chose one, your password in hashed form (unreadable, even by the seller). It is used to handle your reservation requests: this is the legal basis of the processing (pre-contractual measures, Article 6(1)(b) GDPR).
- Your reservation requests and their message, for the same reason.
- Your IP address, to protect the site against abuse (a limited number of sign-ups, requests and sign-ins per address): in memory only, and in the server’s technical log. Legal basis: the legitimate interest in securing the site (Article 6(1)(f)).
- Anonymous audience measurement, without cookies: each day the site counts its visitors, the pages viewed, the cards opened and the site visitors come from. To count the same device only once a day, it keeps a scrambled fingerprint of your IP address and browser, scheduled for deletion each night within the hour after midnight, Paris time; only totals remain afterwards. If your browser sends the Global Privacy Control opt-out signal, you are not counted.
Nothing is sold, shared for commercial purposes or used for advertising. The site uses no trackers: only a sign-in cookie and your basket, kept in your browser.
For how long
- Declined account: deleted 30 days after sign-up.
- Account never approved: deleted 90 days after sign-up or the last request.
- Request without follow-up (declined, expired or cancelled): deleted 6 months later.
- Account with no request for 3 years: deleted, along with its requests.
- Technical log (IP addresses): 3 months.
- Audience measurement: fingerprints deleted at the end of the day, totals kept for 25 months.
- Backup copies: 12 months at most, then 30 days in a bin. A deleted account is never brought back by a restore.
After a completed sale, the lot stays in the seller’s accounts; deleting your account removes your name, email address and message from it.
Where
The site is hosted by Oracle Cloud in Marseille (France). Backup copies are kept on Google Drive, encrypted before upload since 18 October 2026: Google cannot read them. Google may store them in the United States, under the EU–US Data Privacy Framework.
Your rights
Once signed in, My account lets you correct your name and email address, download all your data (JSON file) and delete your account, without asking anyone.
You may at any time request access to your data, its rectification, erasure, restriction or portability, and object to the processing of your IP address, by writing to the contact below; you will receive a reply within one month. If you believe your rights are not respected, you may lodge a complaint with the CNIL, the French data protection authority (cnil.fr, in French).
The shop can be browsed and a reservation requested without a password; without a password, you exercise your rights by writing to the contact below.
Hosting provider
Oracle France, SAS with share capital of €7,617,978, SIREN 335 092 318, 6 avenue de Messine, 75008 Paris, France, telephone +33 1 57 60 83 02. Oracle Cloud Infrastructure service, Marseille region.
Contact
The site’s code is public: github.com/citizenu03bb/lilydex.