LEGAL
Privacy policy
Last updated 11 November 2026
Grail Grading Pty Ltd (ABN 73 702 453 521) (GRAIL, we, us) handles personal information in connection with grading services and this website. This policy explains what we collect, why we collect it, and how you can ask about it. It should be read with the Terms and Conditions.
1. Who we are
GRAIL is GRAIL GRADING PTY LTD (ABN 73 702 453 521), a proprietary company registered in Australia. Postal address: PO Box 9216, West Bathurst NSW 2795. It operates this website and the grading service. Enquiries go to the email on Contact. If GRAIL is required to appoint a privacy officer under applicable law, that officer may be reached at the same contact address.
2. What we collect
We collect the account name and email you provide; return name, address and telephone number; the email address you give to join the waitlist, and the time you asked to be emailed; order contents, declared values and photographs of submitted cards; grade data and certificate identifiers; technical logs such as IP address and device type reasonably required to run the site and prevent fraud. Live card, Apple Pay and Google Pay details are collected by Stripe on Stripe Checkout. GRAIL does not store, process, or transmit full payment-card numbers. GRAIL may keep the processor identifier, payer name, payer email, and last four digits. A telephone number is optional carrier contact, not an identity check. For a register note we also collect the identity document you provide, the country you declare, and the insured value agreed for that holder. The identity document is not published and is not written to Base.
3. Why we collect it
We use this information to create and manage accounts, receive and return cards, grade and encapsulate, issue certificates, provide customer support, meet legal and insurance obligations, and improve the security of the service. A waitlist address is used only to email you when intake opens and to send occasional updates about GRAIL. GRAIL-created photographs and grade data may appear on public certificate pages, on this website, in GRAIL’s own advertising and education, and in population or market information GRAIL publishes from its grades. Public pages do not show your home address. The photographs, labels, and certificate files GRAIL creates are GRAIL’s property. GRAIL reserves all rights in that digital property, including the right to use, license, assign, or otherwise deal with it for any lawful purpose — marketing and advertising of the GRAIL service, education, population reports, and the operation of the register. Those rights remain with GRAIL unless GRAIL assigns or otherwise disposes of them in writing.
4. Certificates, photographs and the Base network
Public certificate pages show card description, photographs, grade, subgrades and certificate identifier. Where a declared sale country has been recorded, the page may also show a flag, the country name, and the date of that note. That display is the applicant’s declaration. It is not proof of ownership and it is not your address. Identity documents are not shown. After a grade is final, GRAIL queues certificate data for Base, a public blockchain. The record is on Base only after a transaction identifier is recorded. That on-chain copy is designed to be durable. It may not be possible to erase it in the same way as a row in GRAIL’s database. Do not submit a card if you require the resulting certificate to remain unpublished.
Writing to Base involves overseas disclosure of certificate data (including to infrastructure in the United States). By submitting cards you acknowledge that disclosure.
5. Disclosure
We may disclose information to shipping carriers, payment processors, professional advisors, insurers, and service providers who process data on GRAIL’s instructions. We may disclose information if required by law or to protect GRAIL, our customers, or the public against fraud.
6. Storage and security
We store information only as long as needed for the purposes above, including the life of a public certificate, and as required by law or insurance. We use reasonable technical and organisational measures. No method of transmission or storage is completely secure.
GRAIL is registered for GST. We keep the tax invoice for each supply, including the price and the GST, for at least five years, as Australian tax law requires. That record is not published.
7. Access, correction and deletion
You may request access to, or correction of, personal information we hold about you, and you may request account deletion after open orders are completed. We may refuse a request where the law allows, including where information is part of a public certificate or an on-chain record that cannot be fully erased. We will explain the reason if we refuse.
8. Children
The service is for persons aged 18 years or older. We do not knowingly collect personal information from children.
9. Complaints
If you have a privacy complaint, contact GRAIL first using the details on the Contact page. If you are in Australia and are not satisfied, you may complain to the Office of the Australian Information Commissioner (OAIC). Other countries have their own supervisory authorities.
10. Changes
We may update this policy. The version current on the date you submit an order applies to that order. Material changes will be indicated by the last-updated date above.