Privacy Policy
Effective: June 20, 2026 · Last updated: June 20, 2026
Bentonville Digital LLC, doing business as RipDeck ("RipDeck," "we," "us," or "our"), operates ripdecktcg.com. This Privacy Policy explains what information we collect, how we use it, when we share it, and what rights you have. By using RipDeck you agree to this policy.
1. Information We Collect
A. Information You Provide Directly
- Account: Email address collected via Google OAuth. We do not store passwords.
- Shipping address: Full name, street address, city, state, ZIP code, and email when you request card delivery.
- Seller payout info: your Stripe Connect account, or an alternative payout handle (e.g. Cash App) if you set one up.
- Seller card submissions: Card photos (front and back), card name, set, condition, and asking price.
- Feedback and support: Any content you submit through our feedback, bug report, or support channels.
B. Information Collected Automatically
- Log data: IP address, browser type and version, referring URL, pages visited, and timestamps.
- Device information: Operating system, screen resolution, and device type.
- Transaction data: Spin history, tier selections, card pulls, pity counter, credit and cash balance history, and shipping requests.
- Session cookies: Authentication tokens managed by Supabase. See Section 4.
C. Information from Third Parties
- Google OAuth: Name and email from your Google account when you sign in.
- Stripe: Confirmation of payment success/failure. We do not receive or store your full card number (see Section 3).
- Market pricing data: Card prices reference publicly available secondary-market data when a seller looks up a card. No personal data is shared with any pricing source.
D. CCPA Categories of Personal Information Collected
For California residents — the following CCPA categories apply to the data above:
- Identifiers (name, email, IP address)
- Categories of personal information in Cal. Civ. Code § 1798.80(e) (name, address)
- Commercial information (transaction history, purchase records)
- Internet or other electronic network activity (log data, session data)
- Geolocation data (shipping address; general location from IP)
- Financial information (processed by Stripe; not stored by RipDeck)
- Inferences drawn from other data (account tier, seller level)
2. How We Use Your Information
- To create and maintain your account
- To process spins, payments, and credit/cash balances
- To fulfill card shipments and communicate shipping status
- To enforce the pity system and tier thresholds
- To verify seller submissions and manage the spin pool
- To process seller payouts and track 1099 tax obligations
- To calculate and remit Arkansas state sales tax
- To investigate fraud, abuse, chargebacks, and policy violations
- To respond to complaints, disputes, and support requests
- To send transactional emails (spin results, shipping confirmations, payout notices)
- To improve, debug, and optimize the platform
- To comply with legal obligations
We do not use your data for behavioral advertising or sell it to data brokers. We do not use automated decision-making that produces legal or similarly significant effects without human review.
5. Data Retention
- Account data: Retained while your account is active and for 7 years after closure for legal and tax compliance.
- Transaction records: Retained indefinitely for dispute resolution, audit, and tax purposes.
- Shipping addresses: Retained per transaction record. Not maintained as a separate address book.
- Card photos (seller submissions): Retained while the card is active in the pool; archived for 2 years after sale or removal.
- Support and feedback submissions: Retained for 3 years.
- Log data: Retained for up to 90 days.
You may request earlier deletion subject to legal retention obligations (see Section 8).
6. Security
We implement industry-standard technical and organizational security measures including:
- TLS/HTTPS encryption for all data in transit
- Row-level security (RLS) policies in our database preventing unauthorized cross-account data access
- Service role keys stored as environment secrets, never exposed to clients
- No storage of payment card numbers — all payments processed by PCI-compliant Stripe
No system is completely secure. In the event of a data breach affecting Arkansas residents, we will notify affected individuals as required by the Arkansas Personal Information Protection Act (Ark. Code Ann. § 4-110-101 et seq.) without unreasonable delay and within 45 days. For breaches affecting residents of other states, we will comply with applicable state notification laws.
7. Children's Privacy
RipDeck is intended for users 18 years of age and older. We do not knowingly collect, use, or disclose personal information from children under 13 in violation of the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq. We also do not knowingly allow minors under 18 to use the service.
If we become aware that we have collected personal information from a child under 13 without parental consent, we will delete that information promptly. If you believe a child has provided us personal information, contact support@ripdecktcg.com immediately.
8. Your Privacy Rights
Depending on where you live, you may have the following rights regarding your personal information:
- Right to Know / Access: Request a copy of the personal information we hold about you.
- Right to Correct: Request correction of inaccurate personal information.
- Right to Delete: Request deletion of your personal information, subject to legal retention obligations.
- Right to Portability: Request a machine-readable copy of your data.
- Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising. You may still submit this request; we will confirm there is nothing to opt out of.
- Right to Non-Discrimination: We will not deny service, charge different prices, or provide a lower quality of service because you exercised a privacy right.
To exercise any right, contact us at privacy@ripdecktcg.com or support@ripdecktcg.com. We will respond within 45 days. We may require identity verification before fulfilling a request. You may designate an authorized agent to submit requests on your behalf by providing written authorization.
9. State-Specific Privacy Rights
California (CCPA / CPRA — Cal. Civ. Code § 1798.100 et seq.)
California residents have the right to know what personal information is collected and how it is used, to delete personal information (subject to exceptions), to correct inaccurate information, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information, and to receive non-discriminatory treatment. California residents may also request disclosure of personal information shared with third parties for direct marketing purposes under the "Shine the Light" law (Cal. Civ. Code § 1798.83) — we do not share data for direct marketing. To submit a verifiable consumer request, contact us at privacy@ripdecktcg.com.
Virginia (VCDPA — Va. Code Ann. § 59.1-571 et seq.)
Virginia residents have the right to access, correct, delete, and obtain a portable copy of their personal data, and the right to opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling. To appeal a denial of a rights request, contact privacy@ripdecktcg.com.
Colorado (CPA — Colo. Rev. Stat. § 6-1-1301 et seq.) · Connecticut (CTDPA) · Oregon (OCPA)
Residents of these states have rights to access, correct, delete, portability, and opt out of targeted advertising, sale, and profiling in furtherance of legal or similarly significant decisions. Contact privacy@ripdecktcg.com to exercise these rights.
Texas (TDPSA — Tex. Bus. & Com. Code § 541.001 et seq.)
Texas residents have the right to access, correct, delete, and receive a portable copy of their personal data, and to opt out of targeted advertising and the sale of personal data.
Nevada (SB 220 — Nev. Rev. Stat. § 603A)
Nevada residents may opt out of the sale of personal information. We do not sell personal information; however, you may submit an opt-out request by contacting privacy@ripdecktcg.com.
Utah (UCPA) · Montana · Iowa · Indiana · Tennessee · Delaware
Residents of these states have access, deletion, portability, and opt-out rights as provided by their respective state privacy laws. Contact privacy@ripdecktcg.com to exercise your rights.
Arkansas (APIPA — Ark. Code Ann. § 4-110-101 et seq.)
RipDeck is based in Arkansas. We comply with the Arkansas Personal Information Protection Act, including breach notification requirements. Arkansas residents may contact us at privacy@ripdecktcg.com with any privacy concerns.
10. Do Not Sell or Share My Personal Information
RipDeck does not sell your personal information to third parties. RipDeck does not share your personal information with third parties for cross-context behavioral advertising purposes. Accordingly, there is currently nothing to opt out of with respect to the sale or sharing of your personal information. If this practice changes in the future, we will update this policy and provide a mechanism to opt out before any such change takes effect.
To confirm our data practices or submit a formal opt-out request, contact privacy@ripdecktcg.com.
11. Business Transfers
If RipDeck is involved in a merger, acquisition, asset sale, or other business transfer, your personal information may be transferred as part of that transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.
12. Third-Party Links
Our platform may link to third-party websites (e.g., PirateShip, Stripe, Supabase). This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party sites you visit.
13. Changes to This Policy
We may update this Privacy Policy periodically. We will post the updated policy with a revised "last updated" date. For material changes, we will provide notice via email or a prominent notice on the site at least 30 days before the change takes effect.
14. Contact Us
Bentonville Digital LLC (d/b/a RipDeck)
Privacy requests: privacy@ripdecktcg.com
General support: support@ripdecktcg.com
Response time: We will respond to verifiable requests within 45 days. If we need additional time (up to 90 days total), we will notify you of the extension and reason within the initial 45-day period.