Legal

Privacy Policy

Effective [[EFFECTIVE DATE]]. This policy covers ripclub.com ("Ripclub"), operated by [[COMPANY LEGAL NAME, e.g. Card Index Inc.]] ("Card Index", "we"). Ripclub shares its accounts, balance and portfolio with cardindex.com and the Card Index apps; this policy should be read together with the Card Index Privacy Policy. Card Index is the data controller for both.

1. What we collect

Information you give us

• Account: email address, password (stored hashed by our authentication provider), and, if you use it, your Google account identifier. Optional profile details such as a username or name.
• Purchases: the packs you buy, when, at what price, how you paid (balance and/or card), and the slab you pulled. Card numbers are entered directly into Stripe's secure fields and never reach our servers; we receive only a payment token, the card brand and its last four digits.
• Shipping: name, postal address and phone number when you ask for a slab to be shipped.
• Payouts: if you withdraw balance to your bank, Stripe collects identity and bank details directly under its own privacy policy; we receive confirmation of your payout status, not the underlying documents.
• Support: anything you send us when you contact support.

Information collected automatically

• Device and log data: IP address, browser type, pages viewed, referring URL, timestamps and error reports, used for security, fraud prevention, eligibility checks (see Terms §2) and to keep the site working.
• Local storage: your sign-in session is stored in your browser's local storage so you stay signed in. We do not use third-party advertising cookies on Ripclub. [[ADJUST IF ANALYTICS OR AD PIXELS ARE ADDED]]

Information from others

• Card Index: your Pro subscription status, portfolio and balance, which are part of the same account.
• Stripe: payment outcomes, fraud signals and, for payouts, verification status.

2. How we use it

• To run the Service: open packs, record your pulls, show your portfolio, maintain your balance, ship slabs.
• To take payment and pay out withdrawals.
• To apply the correct price (including Pro pricing) and promotions such as the First Rip guarantee.
• To verify eligibility (age, location, one account per person) and to detect and prevent fraud and abuse.
• To send transactional messages: receipts, reveal confirmations, shipping and tracking updates, payout notices.
• To respond to support requests and legal obligations.
• With your consent where required, to send occasional news about new packs. You can opt out from any such email.
• To improve the Service, using aggregated or de-identified data.

Where the GDPR or UK GDPR applies, our legal bases are performance of a contract (running your account and purchases), legitimate interests (security, fraud prevention, improving the Service), legal obligation (tax and payments law) and consent (marketing).

3. Public information

The Live pulls feed and pack pages show slabs that have been pulled — the card, grade, pack and time. They never show who pulled them. Slab photographs and certificate details come from the graders' public certificate databases.

4. Who we share it with

• Stripe (payments, payouts, fraud prevention) — stripe.com/privacy.
• Supabase (authentication and database hosting) and Vercel (web hosting), acting as our processors.
• Shipping carriers receive your name, address and phone number to deliver a slab you asked us to ship.
• Card Index marketplace buyers see your listing under your Card Index username if you list a slab for sale.
• Professional advisers, authorities and successors where required by law, to enforce our Terms, to protect rights and safety, or in connection with a merger, acquisition or sale of assets.

We do not sell your personal information and do not share it with third parties for their own marketing.

5. Retention

We keep account and transaction records for as long as your account is open and thereafter as needed for tax, accounting, dispute and fraud-prevention purposes (generally 7 years for financial records). Pull records are retained because they document ownership of a physical slab. Log data is retained for [[90]] days. You can ask us to delete your account; we will delete or anonymise data not subject to a retention obligation.

6. Your rights and choices

Depending on where you live you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, to withdraw consent, and to lodge a complaint with a supervisory authority. California residents have the rights described in the CCPA/CPRA, including the right to know, delete and correct, and the right not to be discriminated against for exercising them; we do not "sell" or "share" personal information as those terms are defined there.

To exercise any right, email [[privacy@ripclub.com]] from your account address or use the account settings on cardindex.com. We will verify your identity before acting and respond within the time the law requires.

7. Security

Data is encrypted in transit (TLS) and at rest by our hosting providers. Card data never touches our servers. Access to production systems is limited to staff who need it and logged. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as required by law.

8. International transfers

We are based in the United States and our providers process data there and in other countries. Where we transfer data from the EEA, UK or Switzerland we rely on standard contractual clauses or another lawful mechanism.

9. Children

Ripclub is for adults. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us and we will close it and delete the data.

10. Changes

We will post any changes here and update the effective date. For material changes we will also notify you by email or a notice on the Service before they take effect.

11. Contact

[[COMPANY LEGAL NAME, e.g. Card Index Inc.]]
Attn: [[PRIVACY CONTACT NAME OR TITLE]]
[[REGISTERED BUSINESS ADDRESS]]
[[privacy@ripclub.com]]