Privacy Policy

This Privacy Policy explains how Slingshot Holdings, trading as PrimalRips ("PrimalRips," "we," "us," or "our"), handles personal information in connection with Primalrips.com, related account and support services, and any application that links to this policy (together, the "Services"). We are the controller, or equivalent responsible business, for the processing described here unless a particular notice identifies another controller.

The Services allow eligible adults to obtain physical collectible cards through supported pack-opening experiences and manage related card allocation, storage, delivery, and, where offered, buyback and payout transactions. This policy applies to visitors, account holders, purchasers, and people who communicate with us. A feature described here may not be available in every location. The availability of a privacy right does not establish eligibility to purchase or use a restricted feature.

Contact and requests. Contact contact@primalrips.com. Submit privacy requests through that email. Our customer-support address is also contact@primalrips.com.

This policy is a notice about our practices, not permission to undertake every type of processing. Where consent is required, we request it separately. Accepting the Terms of Use or continuing to browse does not, by itself, authorize optional advertising, biometric processing, or another activity requiring specific consent. The Terms of Use govern purchases and use of the Services; they do not remove your statutory privacy rights.

We receive information directly from you when you register, transact, verify your identity, choose settings, request delivery, participate in a promotion, or contact us. We collect certain device and usage information automatically when you interact with the Services, subject to the choices and permissions described below.

We also receive information from payment and payout providers, identity-verification and fraud-prevention services, vault and inventory operators, shipping providers, and service providers supporting our operations. For example, a payment provider may return a transaction status; a vault may confirm the card assigned to your account; and a carrier may provide delivery tracking. When you use a supported third-party sign-in option, we receive the account information you authorize that provider to share. Referral partners may supply a referral identifier or campaign attribution information.

Information from public or third-party sources is used only where relevant and lawful, such as checking sanctions restrictions or investigating a specific fraud concern. We do not require a general credit report or unrelated background history merely to browse the website. Where local law requires a separate notice about indirectly collected information, we provide that notice unless a lawful exception applies.

Account and contact details. Name, email address, username, telephone number, account identifiers, country or region, date of birth or an age-verification result, account settings, authentication records, and communication preferences. Passwords and authentication credentials require protective handling; do not send them to customer support.

Purchase, card, and transaction records. Pack selections, prices, payment status, transaction timestamps, disclosed offer information, assigned card identifiers, grading or certification references, collection records, vault instructions, buyback offers and acceptances, account credits, payout requests, shipping instructions, refunds, disputes, and relevant promotion participation. We link these records to the account involved to provide and document the transaction.

Payment and payout information. Billing details, payment-method type, masked account or card identifiers, processor tokens, transaction references, payment and refund results, payout destination details, and tax information where required. Payment providers may collect complete card or bank details through their own secure interfaces. Information available to PrimalRips depends on the integration and the transaction. Do not send full payment credentials by email or upload them outside the designated payment flow.

Verification and sensitive information. Where necessary for age, identity, payment security, eligibility, or applicable compliance checks, we or our verification provider may request legal name, address, date of birth, government-issued identification, a verification photograph, and related verification results. Government identification numbers and certain financial information can be sensitive information. Any selfie-based identity matching that creates or uses legally regulated biometric data requires a separate, specific notice addressing the provider, purpose, retention, disclosures, and legally required consent before that process begins. This policy alone is not biometric consent. We request only information proportionate to the check and identify mandatory fields and the consequences of not providing them.

Device, technical, and approximate location information. IP address, browser and device type, operating system, language, time zone, referral source, session identifiers, pages or features used, clicks, error and performance records, login events, and approximate location inferred from network information. These records can help secure an account and enforce geographic restrictions. Precise device location is collected only through an expressly enabled feature with an appropriate notice and permission or other lawful authorization.

Communications and user content. Support requests, correspondence, uploaded evidence, feedback, reviews, and public profile or community content you elect to provide. Calls or screen-sharing sessions are recorded only when a notice and any necessary consent are provided. Please avoid including another person's personal information unless you are authorized to provide it.

Cookie, analytics, and advertising information. Subject to your choices and applicable law, cookie identifiers, device or advertising identifiers, page and interaction events, campaign source, and whether you opened or interacted with a message. Session-replay or similar observation tools, if enabled, require a specific description in our cookie information and appropriate controls; sensitive entry fields must be excluded or masked. We do not authorize recording the contents of identity-document, password, or payment-credential fields through such tools.

Preferences and derived information. We may derive limited preferences, such as preferred card categories, or security indicators, such as whether account activity appears unusual. We do not need information about your health, religion, sexual orientation, or similar intimate characteristics to sell collectible cards. Please do not provide it in optional fields.

Provide the Services. Create and authenticate accounts; establish eligibility; process purchases; allocate and track physical cards; maintain collection and transaction records; arrange vault storage and delivery; administer supported buybacks, credits, refunds, and payouts; and respond to questions or complaints.

Protect users and operations. Detect account takeover, unauthorized payments, duplicate or abusive accounts, technical manipulation, and fraudulent transactions; enforce geographic and age restrictions; investigate incidents; maintain audit trails; and comply with applicable legal obligations. Verification requirements are tied to the relevant risk or requirement, not unlimited permission to collect unrelated information.

Communicate. Send receipts, security alerts, verification requests, order and shipping updates, changes affecting your account or assets, and other service messages. With consent where required, or another lawful basis where permitted, send marketing messages about PrimalRips. You may opt out of marketing without closing your account.

Maintain and improve the Services. Diagnose faults, measure performance, understand use of features, test improvements, and develop aggregate reporting. Optional analytics and personalization use the controls described in Section 6. We distinguish essential security or operational measurement from optional tracking.

Advertise and measure campaigns. Where enabled and lawful, measure referrals and advertising effectiveness, build permitted audiences, and show relevant marketing. Disclosures for these purposes may be regulated as a sale, sharing, or targeted advertising even when no personal information is exchanged for money. Section 6 explains the controls, and Section 12 addresses U.S. state rights.

Meet legal and business responsibilities. Maintain accounting and tax records, comply with valid legal requests, resolve disputes, protect legal rights, obtain professional advice, and assess or complete a corporate transaction using appropriate confidentiality and data-protection measures.

We do not use information for an incompatible new purpose without satisfying the applicable legal requirements, including providing additional notice or obtaining consent when required. Section 13 explains the legal bases used where European or UK data-protection rules apply.

Service providers. We use providers for hosting, databases, authentication, security, customer support, communications, analytics, and other operational services. We provide access appropriate to their function and apply contractual restrictions or other safeguards required by law. Provider labels do not override a provider's actual role or permitted uses.

Card, vault, and fulfillment partners. Inventory and custody providers receive the account or transaction references and instructions necessary to identify, allocate, store, transfer, buy back, or ship a card. Carriers and fulfillment providers receive delivery contact details, package information, tracking references, and, where needed, customs information. They do not need access to your entire account history for an ordinary shipment.

Payment, payout, and verification providers. These providers receive information required to process the requested transaction, conduct proportionate verification, prevent fraud, resolve payment disputes, and satisfy their own legal duties. A provider may act independently for some activities and under our instructions for others. Its own privacy notice applies to its independent processing and is made available in the relevant flow where appropriate.

Advertising and measurement partners. When these tools are enabled and the applicable permission or other legal conditions are met, partners may receive identifiers, device and network data, and event information. Advertising partners may use such information across services. We do not describe all of these disclosures as ordinary service-provider processing or treat an advertising opt-out as merely an email preference.

Professional advisers, authorities, and transaction counterparties. We disclose information where reasonably necessary for professional advice, a lawful investigation or legal process, protection of rights or safety, or a contemplated merger, financing, asset sale, or reorganization. We assess requests and limit disclosures as appropriate. A successor must handle transferred information consistently with applicable law and any required notice or consent process. Affiliates receive information only for disclosed, legitimate purposes with appropriate safeguards.

At your direction and in public features. We share information when you instruct us, such as directing delivery to another recipient or publishing a review. A public activity feed or profile may display the username, avatar, card, and transaction-related details identified in that feature's notice. Private billing details, identification documents, and delivery addresses are not public-profile content. Public participation is optional or clearly identified before publication, and we provide available profile controls.

We may use or disclose aggregated or properly de-identified information that cannot reasonably identify you. Where law requires, we maintain and use de-identified information in that form and do not attempt to re-identify it, except for legally permitted testing of de-identification measures.

Cookies, local storage, pixels, and similar technologies can support authentication, cart and transaction continuity, security, preferences, performance measurement, and advertising. Our detailed cookie information in Cookies and similar technologies we use identifies the technologies actually deployed, their purposes, providers, categories, and duration or duration criteria. Manage applicable settings through Your privacy choices, which the footer of every page also links.

Essential technologies. Technologies genuinely needed to provide a service you request, maintain security, or record privacy choices operate as permitted by law. We do not designate advertising or unrelated analytics as essential merely because it benefits our business.

Optional technologies. Where consent is required, optional technologies are not activated until you make an affirmative choice. The consent interface provides a way to reject optional tracking and later change or withdraw your choice. Browser controls can also block or delete cookies, although this may affect functions and may not control every non-cookie technology.

Sale, sharing, and targeted advertising. Use Your privacy choices to opt out of applicable advertising disclosures. We honor legally recognized browser or device opt-out preference signals, including Global Privacy Control, where required. A recognized signal is applied to the browser or device sending it and, where we can lawfully associate it with a logged-in account, to that account as applicable. You may need to repeat choices across unrelated devices or browsers. Necessary fraud prevention and transaction processing can continue where law permits.

Other signals. A generic "Do Not Track" setting is not necessarily the same as a legally recognized opt-out preference signal. We do not promise to interpret every nonstandard signal, but that does not limit our duties regarding Global Privacy Control or another signal recognized by applicable law.

Opting out of personalized advertising does not eliminate all advertisements. We do not knowingly sell or share personal information of people under 18. A promotion involving an incentive tied to personal information will have a separate notice and any required consent, including an explanation of withdrawal and the relevant value calculation where required.

You may unsubscribe from marketing emails using the unsubscribe link or by contacting contact@primalrips.com. We process requests within applicable legal deadlines. Essential account, security, transaction, and legal notices may continue. Marketing text messages or calls, if offered, require separate enrollment where required, with the applicable message terms and withdrawal instructions; purchasing does not require agreeing to optional marketing.

You can update account details and preferences through available settings or customer support, disable supported device permissions, and close your account. Account closure is not the same as deletion of every transaction record. We may need to retain limited information as described in Section 8, and you should arrange the return or transfer of cards and eligible balances before closure under the Terms of Use.

We retain personal information for no longer than reasonably necessary for the purposes described here, taking into account the nature and sensitivity of the information, ongoing transactions, legal requirements, disputes, and security needs. We assess retention by category rather than treating all account data as permanently required.

Account information is retained while needed to operate the account and complete closure, followed by a justified period for unresolved matters or necessary records. Purchase, ownership, custody, buyback, payment, and shipping records are retained while needed to establish card rights and fulfill transactions, and afterward for applicable accounting, tax, limitation-period, payment-dispute, and recordkeeping requirements. An account cannot be treated as having no continuing purpose while we still hold its user's property.

Verification documents are retained only as long as necessary for the stated check and any applicable recordkeeping obligation. Where a verification result or reference is sufficient, we favor retaining that over a document image. Any regulated biometric information is governed by the separate notice and destruction schedule for that process. Security and technical logs are kept for a period justified by incident detection and investigation needs, with longer retention limited to a specific investigation or legal hold. Today the request logs and traces of our hosting and security provider keep, for 7 days, the full page address of each request with its query, the browser description, the IP address and the approximate location that the network gives (country, region, city, coordinates and network operator). Our hosting and security provider also adds a small performance script to our pages. It measures how fast each page loads and responds. With each measure, the provider records the page address, the referring page, the browser, the operating system, the device type and the country of the visit. The script sets no cookie and stores nothing on your device, and it runs on every visit. The provider discards the IP address at its network edge, keeps the detailed records for 7 days, and keeps a reduced sample for up to 6 months.

Support records are kept as needed to resolve the issue and document relevant obligations. Marketing records remain until no longer needed or you withdraw, with a minimal suppression record retained when necessary to honor an opt-out. Cookie and similar identifiers follow the duration stated in the cookie information and your choices.

A legal hold, active dispute, fraud investigation, or binding retention duty may justify longer retention of the information concerned, not unrelated data by default. When information is no longer required, we delete it, anonymize it, or isolate it pending secure deletion. Backup copies may persist for a limited backup cycle under restricted access and are not restored to ordinary use without applying relevant deletion requests again.

We use organizational, technical, and contractual measures appropriate to the risks of our processing, including access controls, account-security measures, monitoring, and protections for data transmission and storage as appropriate. Access is limited according to job or service needs. No system can guarantee absolute security, and this statement is not a representation that a particular certification, audit, or insurance policy is in place.

Keep your login credentials private, use available account protections, and tell contact@primalrips.com promptly about suspected account compromise. We investigate suspected incidents and provide notifications to affected individuals and authorities when applicable law requires. Nothing in this policy releases us from mandatory security or breach-notification obligations.

PrimalRips and its providers may process information in countries other than your own, which may have different data-protection laws.

Where a cross-border transfer requires safeguards, we use an applicable lawful mechanism, such as an adequacy decision or approved contractual protections, and any required supplementary measures. A provider's mere presence in a country does not establish that it participates in a recognized certification framework. We rely on a framework only after confirming that it covers the relevant provider and processing. Contact contact@primalrips.com for information about safeguards or an available copy, subject to appropriate redactions.

Depending on your location and the law applicable to the processing, you may request confirmation of processing; access to personal information; correction; deletion; or a portable copy. Additional rights may include restricting processing, objecting to particular uses, withdrawing consent, and opting out of sales, sharing, targeted advertising, or certain profiling. You may also complain to an appropriate regulator. We do not discriminate against you for exercising an applicable privacy right.

Send requests to contact@primalrips.com. Describe the request and the account or interaction involved; do not initially send an identity document or complete financial details. We may seek proportionate information to verify a request or an authorized agent's authority, without collecting excessive information. We do not require identity verification for an opt-out where the law prohibits doing so.

We respond within the time required by applicable law. Many U.S. state access, correction, and deletion requests generally have a 45-day response period, with a notified extension where permitted; some requests have shorter deadlines. Requests under the European or UK rules are generally answered within one month, with a permitted extension explained within that first month. These examples do not replace a shorter or different applicable deadline.

Rights have legal exceptions. For example, we may retain a transaction record needed for a legal obligation or an unresolved property claim. Where permitted or required, we explain a refusal or partial response and the available review or complaint process. Authorized agents may act where permitted, with proof of authority and appropriate verification. We ordinarily provide rights responses without charge, except where applicable law permits a charge for a manifestly unfounded, excessive, or repeated request.

This section applies to the extent a U.S. state privacy law covers PrimalRips and the relevant processing. California terms such as "personal information," "sell," "share," and "sensitive personal information" have their statutory meanings. California's advertising-related definition of sharing can apply without a monetary exchange.

Categories and disclosures. The categories in Section 3 correspond, as applicable, to identifiers; customer-record information; age and related legally protected characteristics; commercial information; financial and payment information; internet or electronic activity; approximate geolocation; audio or visual information you provide; inferences; and sensitive identification or account-access information. Section 2 describes sources, Section 4 describes purposes, Section 5 describes recipient categories, and Section 8 describes retention criteria.

Historical collection and disclosure notice. Primalrips.com launched in October 2026. Since launch we collected identifiers (cookie identifiers, a random visitor identifier, IP addresses, and the email addresses of visitors who joined our waitlist), internet or electronic activity (pages viewed, sections viewed, scroll depth, clicks on links, page performance, and campaign source), and approximate location inferred from network information. We disclosed these categories for business purposes to our hosting and security provider, to our analytics provider, which delivers them to our data warehouse and our product analytics tools, and to our email provider, which keeps the waitlist and sends its emails. The analytics events never carry an email address. While you allow marketing, we share identifiers (cookie IDs, IP address, hashed email address) and internet activity (page views, waitlist signups) with an advertising partner for cross-context behavioral advertising. Opt out with Your privacy choices. We honor Global Privacy Control. Categories described as optional elsewhere in this policy are not a claim that we have historically collected them.

Advertising disclosures. Where deployed, advertising or measurement integrations may involve disclosure of identifiers, electronic-activity information, approximate location, and limited campaign or transaction events to advertising and measurement partners. To the extent these qualify as a sale, sharing, or targeted advertising, the opt-out rights and controls in Section 6 apply. We do not provide government identification documents or complete payment credentials to advertising partners for those purposes.

Sensitive information. We use sensitive personal information for reasonably necessary services, verification, security, legal compliance, or another permitted and disclosed purpose. Where a use creates a statutory right to limit processing, that right can be exercised through the privacy contact. Where opt-in consent is required, we obtain it before processing; an opt-out is not a substitute.

State rights and appeals. In addition to Section 11, covered residents may have rights to identify third-party recipients or recipient categories, obtain information about disclosures, and opt out of profiling in furtherance of decisions producing legal or similarly significant effects. We do not use pack-selection or advertising personalization as a basis to claim that such significant-decision rights never apply to other account processes. Where required, you may appeal a denied request by emailing contact@primalrips.com with "Privacy appeal" and the request reference. We respond within the applicable deadline and explain further complaint options.

California residents may also request information about certain disclosures for other businesses' direct marketing under applicable California law. Contact the privacy address for that request. This section does not imply that PrimalRips is subject to every state law, nor does it restrict a right that applies independently of a particular statute.

This section applies when the relevant data-protection law applies to our processing. It is not an offer to provide pack-opening, buyback, or financial features in these territories.

Legal bases. We rely on contractual necessity for account and transaction processing genuinely needed to perform our agreement with you or take requested steps before it. We rely on a legal obligation for duties imposed by applicable law, such as required records or valid authority demands; a provider preference is not automatically our legal obligation. We rely on legitimate interests, after considering your rights and reasonable expectations, for proportionate security, fraud prevention, service improvement, and legal-claims administration where appropriate. We rely on consent for activities that require it, including relevant optional tracking or direct marketing. Consent can be withdrawn without affecting the lawfulness of earlier processing.

We do not rely on ordinary legitimate interests alone to process special-category data where an additional legal condition is required. Any permitted biometric identity process must meet the applicable additional requirements and use the separate notice described in Section 3.

Required information and consequences. Required account and transaction fields are identified when collected. Providing information is generally voluntary unless a law or the requirements of a requested contract make it necessary. Without information genuinely needed to authenticate, verify, process payment, or fulfill delivery, we may be unable to provide that feature. Optional marketing information is not required to purchase.

Automated decisions. Automated tools may flag unusual transactions or impose temporary security checks. Where a solely automated decision has legal or similarly significant effects, we use it only when permitted by applicable law and provide the required explanation and safeguards, including a way to request human intervention and contest the decision where applicable. A separate notice is provided before introducing such a process where required. Contact contact@primalrips.com to seek review of an account decision.

Rights, transfers, and complaints. You may exercise the applicable rights described in Section 11, object to direct marketing at any time, and object to legitimate-interest processing on grounds relating to your situation. International transfers are subject to Section 10 and the safeguards applicable in your territory. You may complain to your local supervisory authority; UK residents may contact the Information Commissioner's Office, and Swiss residents the Federal Data Protection and Information Commissioner. You do not have to contact us first.

The Services are intended for people at least 18 years old and any higher minimum age required in their location. They are not intended for children. We do not knowingly permit underage accounts or knowingly collect children's information for use of the Services. Parental permission does not create an exception to the Services' minimum age.

If you believe a child has provided personal information, contact contact@primalrips.com. We investigate, restrict the account as appropriate, and delete or otherwise handle the information as required by law, retaining only information justified by a lawful requirement, security purpose, or the need to resolve an outstanding transaction. An adult-only statement does not remove our obligations if children are in fact using or being targeted by a feature.

Third-party websites, social platforms, or services linked from PrimalRips may have their own privacy practices. Review their notices before interacting with them. A link does not make those services part of our privacy policy or excuse our responsibilities for a provider processing information on our behalf.

We may update this policy as our practices or legal requirements change. We post the revised policy and update the date. For material changes, we provide additional notice appropriate to the change, such as an account notice or email, and obtain consent when legally required before a new use begins. An update does not retroactively authorize processing that required an earlier consent. Contact contact@primalrips.com for questions or an accessible copy.