Privacy policy
How Cardselect handles your data and what choices you have. Updated 13 October 2026.
Who is responsible?
Cardselect.nl is a personal project and an independent card comparison website. The project operator is responsible for the processing described here.
For privacy questions or requests about your data, email privacy@cardselect.nl.
Your comparison and browser storage
The finder uses your preferences, travel habits and spending range to calculate a recommendation in your browser. Answers and progress stay in sessionStorage and are not sent to our analytics. If storage is blocked, progress stays temporarily in memory. ‘Start over’ clears it. Session storage normally ends when you close the tab; restoring a browser session may restore the data. A session marker prevents counting the same finder start repeatedly.
You need no account, name or email address to compare cards. The result is a suggestion, not an eligibility decision or credit application. American Express decides on applications. Offers and referral compensation do not influence the match score.
Switching language stores the functional amex-locale cookie for up to one year. You can remove browser storage and cookies through your browser settings; this can reset progress and preferences. The current site uses no advertising cookies. Vercel Web Analytics uses no tracking cookies. Functional storage supports the comparison and language choices you request, separately from consent to alerts.
Website statistics and hosting
Vercel hosts the website. Vercel Web Analytics measures page use to help improve it. It processes page paths, visit times, referring pages, approximate location, browser, operating system and device type. Our custom events measure finder steps, results and comparison, application and terms clicks using fixed categories, card IDs, language and bounded counts. They contain no questionnaire answers, names, email addresses or referral identifiers. We remove query parameters and fragments from page URLs sent to analytics and discard unknown routes.
Vercel describes aggregated measurement without a personal visitor profile or cross-site tracking. A request-derived visitor hash expires after 24 hours; this does not mean all statistics are deleted after 24 hours. Hosting separately processes technical requests, potentially including IP addresses, requested URLs and headers, to deliver and protect the site. Our account’s hosting log and analytics retention settings still need verification.
Email correspondence
When you email us, we receive your email address, message and information or attachments you include. We use these to answer your question or handle your privacy request. Mijndomein provides our mailbox through Soverin. Contacting us does not subscribe you to alerts.
We keep correspondence for as long as necessary to handle the matter and follow-up, meet a legal obligation or resolve a dispute. We review whether retention remains necessary after the matter is closed. Provider backup and log retention is still being checked. Please do not send identity documents or card details unless specifically necessary for your request.
Offer alerts
Visitor email alerts are not active. There is no active signup form and the site collects no email addresses for alerts. The prepared feature will use explicit consent and email confirmation, with Upstash for subscriptions and Resend for delivery. Processing details will appear here when the feature is enabled after provider setup and retention checks.
Purposes and legal grounds
For website operation, security, limited usage statistics and answering correspondence, we rely on legitimate interests: providing a useful, reliable comparison, preventing misuse, improving usability and answering questions. We limit the data used and do not combine finder answers with visitor statistics. You can object to this processing via our privacy contact.
Active email alerts rely on consent, which you can withdraw at any time. Processing to comply with a legal obligation, including applicable privacy requests, relies on that obligation. We do not sell personal data or use finder answers to build an advertising profile.
Providers, transfers and external websites
Vercel provides hosting and statistics; Mijndomein/Soverin provides our mailbox. When alerts are enabled, Upstash stores subscriptions and Resend delivers messages. Each receives data needed for its function. Data may also be disclosed if a legal obligation requires it.
Vercel and, for future alerts, Resend and Upstash may process data outside the European Economic Area, including in the United States. Their published terms describe safeguards such as standard contractual clauses or the EU–US Data Privacy Framework where applicable. Our actual plan, processing arrangements and storage regions still need confirmation; we do not claim all data stays in the EU. You can request information about applicable safeguards via our privacy contact.
Application and source links lead to external websites. American Express processes applications under its own privacy information. Referral links include an identifier to recognise the offer; Cardselect may receive a referral bonus. The comparison tool does not receive your application or card payment details.
Your privacy rights
You can request access, correction, deletion, restriction or data portability where applicable, and object to processing based on legitimate interests. You can withdraw alert consent using the unsubscribe link or privacy@cardselect.nl. These rights have legal conditions; some records may need retention for a legal obligation.
We normally respond within one month. Complex or multiple requests can require up to two extra months; we explain this within the first month. We may request information needed to verify that the request concerns your data, but do not require an identity-document copy by default. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Policy updates
We update this policy when processing changes and show the date above. New purposes requiring consent need separate consent; changing this text does not provide it.
Further information
These sources explain the providers’ practices and your privacy rights. They do not replace Cardselect’s responsibility for your data.